Privacy Policy

Version 2026-09-30

1. The short version

   Rally is run by one person, not an ad company. We don't sell your data, we don't share it for advertising, and there are no third-party trackers on this site. What we hold is what the app needs to work, and you can delete all of it yourself from Profile.

2. What we collect, and why

   Email and nameTo sign you in and show you to your crew.

   Health detailsSex, date of birth, height, weight entries, activity level and goal. These produce your calorie and macro targets — without them the app can't calculate anything.

   Health questionnaireOptional. Your answers about sleep, energy, digestion and diet, used only to generate supplement suggestions.

   Daily check-insWhat you did each day, plus optional notes, weight, and alcohol- or nicotine-free flags.

   Food and workout logsWhat you ate and lifted, including barcode scans and any photos you attach.

   Crew contentMessages, comments, reactions and your position on the leaderboard.

   Billing identifiersA Stripe customer and subscription id. We never see or store your card number.

   Usage eventsWhich page was viewed, the campaign tag that brought you, phone or desktop, and the referring site's hostname — never the full URL.

   Time zoneSo 'today' means your today, and reminders don't arrive at 3am.

   What we deliberately don't keep: your IP address, your browser user-agent, your precise location, your contacts, or any cross-site identifier. There is no Google Analytics, no Meta pixel, and no advertising SDK anywhere in this app.

3. Health information

   Your weight, body details, questionnaire answers and anything you write in a check-in note are health information, and we treat them as the most sensitive thing here. They are used to produce your targets and your plans, shown to you, and — for the parts you choose to share, like a check-in or a PR — to your crew. They are never used for advertising, never sold, and never shared with anyone outside the processors listed below.

4. Who else processes it

   Rally is built on other people's infrastructure. Each of these sees only what it needs to do its job, and each is bound by its own data-processing terms:

   SupabaseAccounts, sign-in, the database, and photo storage.

   NetlifyHosting and delivery of the site itself.

   StripePayments. Your card details go to Stripe, never to us.

   ResendSending email — reminders, digests and nudges.

   Anthropic and GoogleGenerating meal plans, training plans and supplement suggestions. Your goal, age, sex, weight and questionnaire answers are sent so the plan fits you. Your name and email are not.

5. Who can see what

   Your crew sees your check-ins, streak, points, rank, PRs, and anything you post to the crew — that is the point of the app. Your weight, your macros, your plans, your questionnaire answers and your notes are yours alone unless you post them.

   Photos you attach are stored on a public URL. They are not listed anywhere or indexed, but anyone who has the link can open it. Treat an attached photo the way you'd treat one you'd texted to the group — and if that isn't what you want, don't attach it.

6. Cookies and storage

   We use a sign-in cookie, one first-party analytics cookie, and some settings saved in your own browser. Nothing is shared with anyone. The Cookie Policy lists every one and what it does.

7. How long we keep it

   Your account data stays while your account exists. Usage events are kept for 24 months. Rate-limiting records are swept within the hour. When you delete your account we remove your profile, your check-ins, logs, messages, plans and uploaded photos, and your sign-in identity — immediately and permanently, not after a grace period. Copies can persist in our hosting provider's routine backups for a short period before those roll off. We may keep the minimum needed for a legal or tax obligation, such as a record that a payment happened.

8. Your choices and your rights

   Delete everything from Profile → Delete account. It is immediate and there is no undo.

   You can turn off reminder emails and push notifications in Profile, and you can leave a crew at any time.

   Depending on where you live, you may have the right to access, correct, export, or delete your data, to object to or restrict how it's used, and to be free from discrimination for exercising those rights. Deleting your account satisfies most of these immediately; for anything else, contact the app owner through the app and we'll handle it within 30 days. We don't sell personal information or share it for cross-context behavioral advertising, and we never have.

9. Security

   Traffic is encrypted in transit, the database is access-controlled with row-level security, and your password is handled and hashed by Supabase — we never see it. No system is perfect; if something goes wrong that affects you, we will tell you.

10. Children, changes and contact

    Rally is not for under-16s and we don't knowingly collect their data. If a change to this policy matters, we'll ask you to read it the next time you open the app. Questions, or a request about your data: reach the app owner through the app. See also the Terms and the Refund Policy.