Privacy policy
Rally Club runs six-week cohorts in London. To do that we have to know who you are, roughly where you play, and whether you are coming on Tuesday. This page is the complete account of what that means in practice: what we hold, why we are allowed to, who else sees it, and how you get it back or get rid of it.
We are the data controller. Under the United Kingdom General Data Protection Regulation that means we are the ones answerable for the below, and the ones you complain to first.
- Trading name
- Rally Club
- Registered company
- to be confirmed before launch, company number to be confirmed before launch
- Registered office
- to be confirmed before launch
- Information Commissioner’s Office registration
- to be confirmed before launch
- Contact
- hello@joinrallyclub.com
What we hold, and why
This is the whole list. If something is not here, we are not collecting it. Notably absent: your full postcode, your card number, and your location while you are not using the app.
| What | Why | Our basis | Kept for |
|---|---|---|---|
| Name and email address | To sign you in, to say who is in your cohort, and to send you the messages a cohort needs. | Contract | While your account exists, then 30 days. |
| Phone number | To send session reminders over WhatsApp. Optional, and only used for messages about cohorts you are in. | Contract | While your account exists, then 30 days. |
| Borough, postcode prefix, activity and level | To match you to a cohort near you at a standard you will enjoy. We store the first part of a postcode, never the full one. | Contract | While your account exists, then 30 days. |
| Cohort membership, attendance and replies to reminders | To run the six weeks: who is on the roster, who is coming on Tuesday, who needs a substitute. | Contract | Six years, because it evidences what we were paid for. |
| Payment records | What you paid, what was refunded, and the Stripe reference that ties the two together. Card details never reach us; Stripe holds those. | Legal obligation | Six years, as tax law requires. |
| Session feedback | To find out whether the format works. Scores are read in aggregate; free-text notes are read by the founders. | Legitimate interests | Three years, then aggregated and the original deleted. |
| Sign-in sessions, including internet protocol address and browser | To keep you signed in and to spot someone else using your account. | Legitimate interests | Until the session expires, and 90 days in server logs. |
| Product analytics | Which screens get used and where a flow is lost. Only collected if you accept analytics cookies, and never linked to your payment records. | Consent | 12 months. |
Where the basis is legitimate interests, the interest is running a club that works: knowing whether a format is enjoyed, and being able to tell a real sign-in from somebody else using your account. We have weighed that against your privacy and think it is a fair trade, but you can object, and the section on your rights says how.
Who else sees it
Other players in your cohort see your first name and whether you have replied to a session. That is the product working as intended: eight people who show up for each other every week cannot be strangers to each other on the roster.
Beyond that, we use the following companies to run the service. They process your data on our written instructions and cannot use it for their own purposes.
| Company | What it does for us | Where |
|---|---|---|
| Hetzner | Runs the app and the database everything above is stored in, and keeps short-lived request logs. | European Union |
| Cloudflare R2 | Stores the nightly backup copies of the database. | European Union |
| Cloudflare Email Routing | Delivers email you send to our contact address, and any reply you send us. | United States |
| Stripe | Takes payments and issues refunds. Your card details go to Stripe and never to us. | United States |
| Resend | Sends sign-in links and cohort emails. | European Union |
| Twilio | Sends WhatsApp session reminders, if you gave us a phone number. | United States |
| Verifies who you are, only if you choose to sign in with Google. | United States | |
| PostHog | Product analytics, on the European Union instance. Runs only if you accept analytics. | European Union |
| Sentry | Error diagnostics. | European Union |
We also tell a partner venue the number of players expected and the name on the booking. We do not pass them your email, your phone number or your payment history.
We do not sell your data, and we do not run advertising. There is no third party in the list above that is paying us for access to you.
Data leaving the United Kingdom
Some of the companies above are based in the United States. Where data reaches them, the transfer is covered by the United Kingdom International Data Transfer Addendum to the European Commission’s standard contractual clauses, which is the mechanism the law provides for exactly this. Your database record and your analytics both stay in the European Union.
Cookies
Two kinds, and only one of them is a question. Cookies strictly necessary for something you asked us to do are exempt from consent under the Privacy and Electronic Communications Regulations, which covers keeping you signed in. Analytics is not exempt, so we ask, and we do not load the analytics script at all until you say yes.
Essential, set either way
| Name | Purpose | Lasts |
|---|---|---|
| rc.session_token, rc.session_data | Keeps you signed in between visits, and saves a database lookup on every page. | 30 days, and 5 minutes |
| rc_consent | Remembers your answer to the analytics question, so we stop asking. | 12 months |
If you go looking for these in your browser, the sign-in ones appear with __Secure- in front of the name. That is an instruction to the browser to send them over an encrypted connection only, not a different cookie.
Analytics, only if you allow it
| Name | Purpose | Lasts |
|---|---|---|
| ph_* | PostHog. Counts a return visit as the same person, so a funnel is a funnel rather than eight strangers. | 12 months |
You can change your mind whenever you like, and this is the button rather than an email address that goes to somebody who then has to do it for you.
Your rights
You can ask us to:
- Show you everything we hold. We will send it in a readable format within one month.
- Correct something wrong. Most of it you can edit yourself in the app.
- Delete your account. We will, except for payment records, which tax law requires us to keep for six years. Those get stripped back to the transaction and your name.
- Send your data somewhere else, in a machine-readable file.
- Stop a particular use, including anything we do on the basis of legitimate interests.
- Withdraw consent for analytics, without it affecting anything else.
Email hello@joinrallyclub.com and we will action it. There is no charge and no form.
Keeping it safe
Data is encrypted in transit and at rest. There are no passwords to steal, because we do not use them: you sign in with a one-time link, a passkey, or Google. Card details never touch our servers, and payment pages are served by Stripe on Stripe’s own domain. Access to the live database is limited to the founders. If a breach ever puts you at risk, we will tell you and the Information Commissioner’s Office within 72 hours.
Age
Rally Club is for adults. You need to be 18 or over to hold an account, and we do not knowingly collect anything about anybody younger. If you think we have, tell us and it will be gone the same day.
Changes to this policy
If we change something that matters, we will email you before it takes effect rather than quietly updating the date at the bottom of the page.
Complaining
Come to us first, at hello@joinrallyclub.com. If we get it wrong, you have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data protection regulator, at ico.org.uk or on 0303 123 1113. You do not have to ask us first, but we would rather you did.
For what happens to your money rather than your data, see the refunds policy.