Rally - Privacy Policy

Who we are

Rally is a free group trip planning app at rallyyourpals.com, run from the UK. Rally is the data controller for the data described below. Contact: joshua@rallyyourpals.com.

What we collect, and why

Everything below is collected for one of two reasons: to run the trip you’re planning — finding the dates that suit the most people, shaping the shortlist to your group’s budget and taste, showing everyone who’s in — or to keep the app working. Each item says which.

Your name — that alone is enough to take part in a trip someone invited you to: mark your dates, vote, suggest a city. It’s shown to everyone in that trip, and it’s stored on the rows you create, so your votes and suggestions carry it. Basis: performing our contract with you.
Your email address — needed once you want to save what you’ve done and come back to it, and to create an account of your own. Basis: contract.
Your account — creating one also asks for the city you fly from, and you pick an emoji to stand for you. Both are shown to your trip. Basis: contract.
Your trip planning — preferences, budget, vibes, the dates you’re free, your votes, and anything you add to the trip’s checklist, including notes and amounts you type. All of it is visible to the trip. Basis: contract.
Sign-in details — a password, a one-time code we email you, or Google (below). Passwords are set, hashed and checked by Supabase, our sign-in provider; Rally never stores one. The one-time code is passed straight to Supabase and never stored or logged by Rally either. Basis: contract.
Error reports — the page, the error, your browser, the trip id, and your email if you’re signed in. Basis: our legitimate interest in finding and fixing faults before they cost people their trip.
Usage and page speed — events like “trip created”, the page, the trip id, and a random id that lasts one visit. No name or email unless you switch that on in profile settings. Basis: our legitimate interest in seeing where groups get stuck, and your consent for the version linked to your account, which you can withdraw in the same place.
Push notifications — if you turn them on, the push address your browser gives us and its keys. Basis: your consent; turn them off in your browser.

The emails Rally sends you are about your account: your one-time sign-in code, and confirming your address when you create an account. If you tick the box for product updates and the newsletter when creating your account (or turn it on later in profile settings), we’ll also send occasional emails about new features, flight deals, and destination inspiration. Basis: your consent, which you can withdraw at any time in profile settings.

Signing in with Google

Optional. It gives Rally your name, email address, Google account id, and a link to your Google profile picture — which Rally doesn’t display, as it uses the emoji you pick. We use it to sign you in and to show your group who’s in the trip. It’s stored and deleted on the same terms as the rest of your account, below. Revoke it any time at myaccount.google.com/permissions.

Rally’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google data is never sold, never shared beyond the providers named below, and never used for advertising.

Who else sees it

Your trip. Everyone in it sees your name, emoji, departure city, availability, preferences and checklist notes.

Votes are not private. Unless the host turns on secret ballot, a trip’s votes can be read by anyone who has the trip — its link or its id — not only the people in it. Secret ballot keeps them hidden until everyone has voted.

Anyone with the invite link. The link opens the trip and lets someone join it by giving a name. Treat it like a key.

Our providers. Supabase (database and sign-in) and Cloudflare (hosting). If you turn on push notifications, your browser’s push service — Google or Mozilla, depending on your browser — handles delivery.

Our booking partners. Rally is free to use. If you book through a flight or hotel link we show you, we may earn a commission from Expedia — it never changes your price. Making that booking hands Expedia and its tracking partner Partnerize your IP address and browser details, under their terms.

We don’t sell your data, and no third-party advertising or tracking scripts run on Rally.

Outside the UK. Our providers may process data outside the UK; where they do, the transfer relies on the standard contractual clauses in their data processing terms. Tapping a booking link sends the details above to Expedia and Partnerize, who operate internationally under their own terms.

How long we keep it

Trip data lasts as long as the trip: leave a trip, or have the host delete it, and your votes, dates, checklist entries and member record go with it. Error reports are kept for 90 days — long enough to spot a fault that only shows up occasionally. Usage events are kept for 12 months, so we can compare one season against the last. To delete your account and everything tied to it, email joshua@rallyyourpals.com.

Two things outlast that. When a trip is deleted we keep a note that it existed, including the host’s email address, so our own usage figures don’t count a deleted trip as one that never happened — ask us and we’ll delete that too. And anything deleted can survive a little longer in our database provider’s routine backups, until those are overwritten.

Your rights

Under UK GDPR you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or get it in a portable form. Where we rely on your consent you can withdraw it at any time. Email joshua@rallyyourpals.com. If you’re unhappy with our answer you can complain to the Information Commissioner’s Office.

Rally isn’t intended for under-13s.

Changes

When what we collect or who sees it changes, this page and the date above change with it.