01 Who is responsible
Vertex City LLC operates Rally and is responsible for its handling of personal information. Contact Luis Acosta at luije87@gmail.com or 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States. This policy explains information used to provide an adults-only sports community and your choices.
02 Account and profile information
The app handles your phone number for authentication, name, full birth date, photos, Melbourne suburb, sports and skills, availability, social preferences and profile text. Optional answers include email, pronouns, gender, height, exercise, drinking and smoking preferences. Messages, likes and passes, matches, games, invitations, blocks, reports, appeals and notification records are processed when you use those features. Enter only information you are comfortable sharing. Profile email is not a verified account-recovery method.
03 Subscriptions and purchase information
For Rally Plus, Apple processes the purchase and payment method. Rally and RevenueCat process your Rally account identifier, product and transaction identifiers, purchase and renewal history, subscription status and expiry, and relevant store, currency and technical request information to validate purchases, restore access, prevent fraud and provide subscription analytics. Rally also records limited paywall and premium-feature events, such as where an offer was opened or a paid feature was used; message bodies and profile photos are not included in those billing events. We do not receive your full payment-card or bank-account details through this purchase flow, and we do not send your phone number, email address or profile photos to RevenueCat as customer attributes. Subscription data is linked to your Rally account and is not used for cross-app advertising tracking. Apple and RevenueCat may process data outside Australia and retain records under their service and legal requirements; deleting your Rally account does not cancel an Apple subscription or immediately erase records held by those providers.
04 What other members can see
Eligible signed-in members can see selected profile information: name, age, approved photos, suburb, sports, availability, social preferences and any public profile text or optional lifestyle answers you supply. Full phone number, email and birth date are excluded from member-facing profiles. Conversations use server access controls; they are not end-to-end encrypted. Authorized reviewers can access selected reported evidence. Recipients can copy information they can see.
05 Location and device permissions
Rally can suggest an approximate Melbourne suburb when location permission is granted. A suburb can also be chosen manually. The reviewed flow does not save exact device coordinates. Photo access supports selecting profile pictures; notification permission supports push alerts. Device permissions can be changed in device settings.
06 How information is used
We use information to authenticate accounts, show profiles, suggest eligible players, match mutual interests, deliver conversations, coordinate games, send operational notifications, prevent abuse and investigate safety reports. We screen profile photos with automated tools and authorized human reviewers before they can be shown to other members. We do not sell personal information or use it for advertising or cross-app advertising tracking. Optional profile answers are voluntary; avoid including health, sexuality, identity documents or other sensitive information in free text unless you intend to share it with the audience who can view that field.
07 Service providers and overseas processing
Supabase provides authentication, databases and private photo storage; our project is hosted in the United States (us-west-2). Twilio Verify handles phone verification. Expo and Apple, or Google for Android, deliver push notifications using device tokens and generic notification content. Vercel hosts our website and routes photo-screening requests through AI Gateway to OpenAI. Screening sends a short-lived image link, without your account phone number or email, and returns a publication or human-review category. Requests disable model training through the Gateway and do not ask the model to identify you or estimate your age. Authorized human reviewers may inspect held photos and selected reported evidence. Providers may process information in the United States and other locations outside Australia. Optional Sentry crash reporting is not enabled in this release. Provider technical logs, abuse monitoring and backups may have separate retention requirements; we do not promise immediate erasure or Australian-only processing.
08 Storage, security and retention
Authenticated sessions persist on your device using protected storage. Server access controls limit access to profiles, conversations and private photos. Conversations are not end-to-end encrypted. Temporary photo links and copies in recipients’ caches may remain usable for a limited time after access changes. No system can guarantee absolute security. The app does not intentionally save or log verification-code input. We retain data for the purposes and periods described below and restrict exceptional safety retention.
09 Access, correction and deletion
Edit supported fields in your profile, or use Delete account in Account settings. Deletion targets ordinary active-system account data within 30 days, usually sooner, and removes app-managed local photos and caches on the requesting device where supported. Selected reported evidence may remain for the limited investigation period below; deleted identity references do not necessarily anonymize text inside evidence. Contact luije87@gmail.com for access, correction, deletion questions and privacy complaints.
10 Ordinary data retention
Active profile data is kept while needed for your account. Our approved inactivity approach is notice after 12 months without activity and at least 30 days to return; this process stays off until legal and support release checks are complete, and requires recorded notice delivery. Removed or abandoned photos become eligible after 24 hours continuously unreferenced, with cleanup intended within 48 hours. Ordinary ended direct-conversation messages are deleted after 90 days; game records are deleted 90 days after completion or cancellation. Account deletion can remove those shared records sooner. Notifications are kept 90 days, completed push-delivery records 30 days, unused push tokens 60 days and revoked tokens up to 7 days. Access is revoked sooner when you sign out or delete your account.
11 Reports, appeals and exceptional retention
Selected reports and evidence are normally retained for up to 90 days from submission or 30 days after closure, whichever is earlier. A serious documented investigation can receive an extension, reviewed every 30 days, ordinarily capped at 180 days from submission. A justified legal hold can last longer while required, with reviews at least every 30 days. Moderation access and decision records are kept 180 days and should contain minimal notes, not copied message bodies. Closed appeals are kept 90 days. Open cases approaching expiry are flagged for review; report submission is not a reason to retain an entire account indefinitely.
12 Provider logs, backups and support records
Provider logs and backups are separate from active app data and follow each provider’s service and legal requirements; deletion from active systems does not immediately erase all backups. We aim to minimize routine operational logs and backup retention to 30 days where supported, with minimal justified security records up to 90 days. These targets are not promises about every provider’s retention. Restored data must have prior deletion requests reapplied. Support records are targeted for deletion 90 days after closure unless needed for an unresolved dispute or a legal obligation. The support mailbox luije87@gmail.com is monitored daily. We do not claim a verified restoration or disaster-recovery guarantee.
13 This website
This website has no contact form, advertising scripts, analytics scripts or application cookies added by Rally. Vercel may process request metadata and technical logs to deliver and protect it. Emailing support sends your message and contact details to our monitored Gmail mailbox; do not send passwords, verification codes or unnecessary sensitive information.
14 Children, updates and contact
Rally is for adults aged 18 and over. Phone verification and a self-declared birth date do not establish identity or verified age. Report suspected underage use through the safety menu or support email. Contact luije87@gmail.com to raise a privacy complaint; we will investigate and respond, and you may also contact a regulator with jurisdiction, including the Office of the Australian Information Commissioner where applicable. We will publish dated policy versions and notify members of material changes through the app or a verified contact method. Version 2026-10-25. Published and effective 25 October 2026.