Privacy Policy

```

1. Information we collect

We collect information you provide and information generated through your use of Rally.

Account and profile information

• Account information: email address, name, user ID, and authentication credentials used to sign in.
• Profile information: bio, about-me text, social vibe tags, looking-for tags, and a home city you enter in the app.
• Profile photo: if you choose a photo from your device library, Rally uses the selected photo locally to display your avatar in the app. The photo is not uploaded to Rally servers or retained by Rally.
• Apple Sign In: if you use Sign in with Apple, we receive the identity token and related account information needed to authenticate you through our backend.

Activity and social information

• Run activity: RSVPs, check-ins, attendance history, and related social context for events you join.
• Connections: connection requests, accepted connections, and social graph data needed for messaging eligibility.
• Messages and user content: direct messages and other content you submit in the app.
• Safety information: reports you submit, blocks you create, and moderation records related to your account.
• Membership information: subscription status, founding member status, and related access records.
• Support communications: messages you send to support@joinrally.app.

City and discovery preferences

• Home city: a city name you type during signup or profile editing, stored with your account.
• Selected city preference: a city you pick to browse runs and clubs, which may be stored locally on your device to personalize discovery.

On-device app data

Rally stores limited information on your device to keep you signed in and remember preferences, such as your auth session, onboarding state, and selected city. This stays on your device unless you delete the app or sign out.

2. Location information we do not collect

Rally does not collect precise GPS location or coarse device location from your phone or tablet. Rally does not use device location for event discovery, nearby recommendations, or check-in verification.

Check-in is a self-attested action in the app. It records that you checked in and a timestamp; it does not verify your physical presence using GPS.

A future "Near Me" feature may request location permission if we ship it. If we do, we will update this policy and ask for permission in the app before collecting location data.

3. Information we do not collect

• Phone numbers.
• Advertising identifiers (such as IDFA) for cross-app tracking.
• Third-party behavioral analytics, usage telemetry, or advertising data from analytics SDKs.
• Crash logs or performance diagnostics through third-party crash reporting SDKs.
• Contacts, photos other than a profile photo you explicitly choose for local in-app display, microphone audio, or health/fitness data from Apple Health.

Rally does not sell your personal information. Rally does not use your data for third-party advertising and does not track you across other companies' apps or websites for advertising purposes, as "tracking" is defined by Apple.

4. How we use information

We use information to:

• Create and manage your account.
• Display your profile and help you discover runs, clubs, and other runners.
• Enable RSVPs, check-ins, attendee lists, and post-run social features.
• Deliver messaging and community features you choose to use.
• Process membership status and founding member eligibility.
• Investigate reports, enforce blocks, and protect community safety.
• Respond to support requests and improve Rally.
• Comply with legal obligations and prevent fraud or abuse.

5. How we share information

We share information only as needed to operate Rally:

• With other users: profile details, attendance context, and messages you choose to share in the app, consistent with in-app visibility settings.
• With service providers: Supabase provides authentication, database hosting, and backend services for Rally. If paid memberships are enabled, payment processing may be handled by Apple (In-App Purchase) or Stripe according to the purchase flow shown in the app. Those providers process payment information according to their own terms; Rally does not store your full payment card number in the app.
• For safety and legal reasons: when required to respond to lawful requests, protect users, investigate abuse, or enforce our terms.
• Business transfers: if Rally is involved in a merger, acquisition, or asset sale, subject to this policy.

6. Your choices and account controls

• You can update much of your profile information in the app.
• You can block other users and report profiles or messages.
• You can delete your account from Profile → Delete Account.

7. Account deletion and data retention

When you delete your account:

• Your profile is deactivated and active social access is removed.
• Your display name is anonymized and profile content such as your bio is cleared.
• Pending connection requests are declined and blocks you created or received may be removed.
• You are signed out on your device after the deletion request is submitted.

Rally does not guarantee complete erasure of every historical record at deletion time. Some messages, attendance history, safety reports, and billing records may be retained where required for safety review, fraud prevention, legal compliance, or service integrity.

8. Data security

9. Children's privacy

Rally is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are between 13 and 18, you may use Rally only with permission from a parent or legal guardian, consistent with our Terms of Service. If you believe a child has provided us personal information, contact us at support@joinrally.app.

10. International users

Rally is operated from the United States. If you use Rally from outside the United States, your information may be processed in the United States or other countries where our service providers operate.

11. Your California privacy rights

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, request deletion or correction, and not be discriminated against for exercising these rights.

Categories of personal information we collect

In the preceding 12 months, we have collected these categories of personal information:

• Identifiers: name, email address, user ID, and account credentials.
• Customer records: membership or subscription status (not full payment card numbers stored by Rally in the app).
• Internet or other electronic network activity: your interactions with Rally features such as RSVPs, check-ins, and messages.

We do not collect precise geolocation, coarse geolocation, or sensitive personal information as defined by the CCPA for the current version of the Rally app.

Sale and sharing

Rally does not sell personal information for money. Rally does not share personal information for cross-context behavioral advertising ("sharing," as defined by the CCPA).

How to exercise your rights

You can request access, correction, or deletion by emailing support@joinrally.app with the subject line "California Privacy Request," or delete your account from Profile → Delete Account in the app. We may need to verify your identity before fulfilling a request.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above when changes are posted. If we make material changes, we may provide notice in the app. Continued use of Rally after an update means you accept the revised policy.

13. Contact us

Questions about this Privacy Policy or your data can be sent to support@joinrally.app or our Support page.

```