Privacy Policy
Rally holds records about people who never signed up for it — your clients, and the academy players you list on a timesheet. This explains what's stored, why, who else can touch it, and how to get rid of it.
1. The short version
- We store what you type into Rally, and almost nothing else.
- There is no advertising, no tracking pixels, no analytics scripts and no third-party cookies.
- We never sell your data, and we never use it to train anything.
- You can export it whenever you like, and delete your account yourself from Settings.
- Card numbers never reach us. Stripe handles those.
2. Who is responsible for what
Rally holds two kinds of personal data, and the responsibility for each sits in a different place.
Your coach account. Your name, email, business name, timezone and subscription status. For this, Alexandra Vasilyeva is the controller — we decide what's held and why, and you can bring any request straight to us.
Everything you record about your clients. Their names, emails, sessions, hours, balances, and the attendee names on academy timesheets. For this, you are the controller and we are your processor. We only act on your instructions. If one of your clients wants their data changed or removed, the decision is yours — see §8.
3. What we collect
From you, the coach
- Name, email address and password (stored only as a hash — we cannot read it).
- Business name and timezone. The timezone decides how much notice a cancellation gave, which sets the fee tier.
- Subscription status, trial end date and Stripe customer and subscription identifiers.
About your clients, entered by you
- Name and, if you invite them to the app, email address and login.
- Sessions, hours, rates, court costs, balances, charges and whether each is marked paid.
- Bookings, cancellations, the notice given and any cancellation fee calculated.
- Messages sent in group chats.
- Attendee names on academy sessions — see §4.
Technical
- Server and security logs from our hosting provider, including IP address and timestamps, kept briefly for reliability and abuse prevention.
- A session cookie so you stay logged in, and a theme preference stored in your browser so the app remembers whether you chose day or night mode. Both are strictly necessary; neither is used to track you, and there is nothing else.
We do not collect health data, location, contacts, or anything from your device beyond the above. Payment card details are entered on Stripe's own pages and are never sent to or stored by Rally.
4. A specific word about attendee names
When you list who attended an academy session, you are recording personal data about people who have no relationship with Rally, and who may be children.
Rally stores those names because a club won't pay a freelance coach without knowing which of their players were coached. That's a legitimate reason to keep them — but it's your reason, not ours, and the duty to those people is yours as controller.
Practically: record first names or initials rather than full names where that's enough for the club, make sure the academy knows you're keeping the list, and delete old timesheets once you've been paid and your tax records are settled.
5. Why we hold it, and on what basis
- To provide the service — performance of our contract with you. Without your account and your records there is no product.
- To take payment for the subscription — performance of contract, and legal obligation for the tax records that follow.
- To email you about your account — invitations you send, cancellations, denied requests, a trial about to end, a payment that failed. Performance of contract. These are transactional; there is no marketing list to unsubscribe from because we don't send marketing.
- To keep the service secure and working — our legitimate interest in preventing abuse and diagnosing faults.
- To meet accounting and tax law — legal obligation.
6. Who else touches it
We use a small number of providers to run Rally. They act on our instructions and may not use your data for their own purposes.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, authentication and file storage — where your account and your clients' records actually live. | Region selected for the project |
| Vercel | Application hosting and delivery. Processes request logs and IP addresses. | Global edge network |
| Stripe | Payment processing for your Rally subscription, and — if you enable client payments — for the payments your own clients make to you. | EU / US |
| Resend | Transactional email: invitations, cancellation notices and account messages. No marketing email is sent. | EU / US |
Where a provider processes data outside the European Economic Area, that transfer relies on the European Commission's Standard Contractual Clauses or an equivalent approved mechanism.
We would also disclose data if the law required it, and we'd tell you unless we were forbidden from doing so. Otherwise: nobody. We do not sell or rent personal data, and we have no advertising partners.
7. How long we keep it
- While your account is open — everything, because it's the record you came for. Rally doesn't quietly delete old sessions.
- After you delete your account — your data is removed from the live database immediately, and disappears from encrypted backups within 30 days as those backups roll over.
- Invoices and payment records — kept as long as tax law requires, typically six to ten years depending on the country. This is a legal obligation we can't waive, and it's the one thing deletion doesn't reach.
- Server logs — a short rolling window at our hosting provider.
8. Your rights
If you're in the EEA or UK you have the right to see a copy of your data, correct it, delete it, restrict or object to how it's used, take it elsewhere in a portable format, and complain to a supervisory authority. Similar rights apply in many other countries.
Our supervisory authority is the Österreichische Datenschutzbehörde (dsb.gv.at). You can complain to them directly, or to the authority where you live — you don't have to come to us first, though we'd rather you did so we can fix it.
If you're a coach: write to rallycoachingapp@gmail.com, or use the delete button in Settings. We'll respond within one month.
If you're a client or a player on a timesheet: the records about you belong to your coach, so please ask them first — they can change or delete anything about you directly. If you can't reach them, write to rallycoachingapp@gmail.com and we'll help you get it resolved.
We don't charge for any of this, and we won't treat you differently for asking.
9. Deleting your account
Settings → Delete account removes your login, your business, your clients, their sessions, charges, bookings and messages. It cannot be undone, so export anything you want to keep first — the Reports page exports academy timesheets to Excel.
Deleting your account does not cancel your Stripe subscription on its own, so cancel that too, or write to us and we'll make sure both are done.
10. Security
Data is encrypted in transit and at rest. Each coach's records are isolated at the database level by row-level security, so one coach's queries cannot return another coach's rows even if the application has a bug. Passwords are hashed by our authentication provider and are not readable by us or by anyone at Rally.
No system is perfectly secure. If a breach affected your data and posed a real risk to you, we'd tell you and the relevant authority without undue delay, and within 72 hours where the law requires it.
11. Children
Rally accounts are for adults. We don't knowingly create accounts for under-18s. Children do appear in coaches' records — as players and on attendee lists — and that data is the coach's responsibility as controller, with the extra care children's data deserves. If you believe a child's data is in Rally without a proper basis, tell us at rallycoachingapp@gmail.com and we'll act.
12. Changes
If we change something that matters, we'll email you before it takes effect. The date at the top of this page always shows the current version. See also the Terms of Service, which this policy forms part of.
13. Contact
Alexandra Vasilyeva
Einzelunternehmen (sole trader), Austria
Kurbadstraße 8/1311, 1100 Wien, Austria
rallycoachingapp@gmail.com
Rally is a one-person business, so there is no separate Data Protection Officer — none is required at this size. Data-protection requests come straight to the address above and are handled by the person who wrote this page.
Full trade details are on the Imprint.