Rallyist — Privacy Policy

Last updated: 1 July 2026

Effective date: 1 July 2026.

This Privacy Policy describes how Rallyist ("Rallyist," "we," "us," or "our") collects, uses, shares, and protects personal data when you use the Rallyist mobile app, website, and APIs (together, the "Services").

The data controller for the Services is Rallyist. You can reach us about anything in this policy at privacy@rallyist.app.

1. Categories of personal data we collect

We collect the following categories of personal data:

1.1 Account and identity data

Name (or display name) you choose to show in the app.
Email address (from your Google or Apple sign-in, or one you separately verify).
Profile photo, bio, country, language preferences.
Garage data: cars you add (make, model, year, colour, photos, modifications, ledger of services).

1.2 Location data

Real-time location ("location pings"): latitude, longitude, speed bucket, heading, accuracy, timestamp. Collected only while you are actively sharing your location in an event you joined or in a Drive Room you joined. Collection stops as soon as you stop sharing or leave the event/room.
Historical location traces: collected when you record a journey (Drives feature). Stored for the retention period in §7.
Coarse location for discovery: when you open the discovery map, we use your approximate location (city-block resolution) to load nearby content. This is not stored beyond the request.
Address-derived data when you create or attend an event with a meeting point you provide.

1.3 User-generated content

Photos you upload (cars, spots, photo-spots, moments, event covers). We extract EXIF metadata for sanity-checks (timestamp, GPS where available, camera model) and may strip the EXIF before serving the photo to other users to protect your home address. The original EXIF is kept on the storage backend for evidence purposes and is removed from the served image.
Text content (spot descriptions, comments, chat messages, road whispers, rally calls, profile bio).
Voice content (Drive Room audio in real time; recorded segments only where the recording feature is enabled and consented to by all participants).
Reports you submit about other content or other users.

1.4 Behavioural and analytics data

App events: which screens you open, which features you use, error reports, performance traces. Used to operate, secure, and improve the Services.
Karma ledger: every karma-eligible action you take (posting a validated spot, confirming a sighting, hosting a completed rally, etc.). Stored in an append-only ledger.
Behaviour-trust signals: the frequency and pattern of your validations, the geographic plausibility of your activity, and similar derived signals used to detect abuse (spam, sock-puppeting).

1.5 Device and technical data

A per-install analytics identifier, device model, OS version, language, time zone.
IP address (logged in security and access logs).
Push notification token (FCM/APNs) when you grant notification permission.

We do not collect the iOS advertising identifier (IDFA) or the Android advertising ID (AAID), and Rallyist carries no advertising. Because we never track you across other companies' apps or websites, the app does not ask for App Tracking Transparency permission.

1.6 Communications

Messages you send to support, in-app feedback, ratings.

1.7 Payment data (only if you make a purchase)

We do not receive your full payment-card data. Apple App Store and Google Play handle the payment and tell us only the outcome, receipt identifier, and product purchased. For events with third-party payment, the relevant processor's policy applies.

We process your personal data for the following purposes, on the following legal bases:

Purpose	Categories used	Legal basis (GDPR)
Provide your account and the core Services (authentication, garage, discovery, events, chat, drives, maps)	1.1, 1.2, 1.3, 1.5	Performance of contract — Art. 6(1)(b)
Operate live location sharing and Drive Room voice	1.2, 1.3 (voice), 1.5	Performance of contract — Art. 6(1)(b), with explicit opt-in for each session
Karma ledger and trust scoring	1.1, 1.4	Performance of contract — Art. 6(1)(b) and our legitimate interest in operating an honest community — Art. 6(1)(f)
Push notifications (alerts, chat, friend nearby, karma awarded)	1.5	Consent — Art. 6(1)(a)
Content moderation (NSFW scan, text moderation, perceptual hash for de-duplication, behavioural anomaly detection, response to reports)	1.3, 1.4	Legitimate interest in keeping the Services safe and lawful — Art. 6(1)(f); compliance with our obligations under the EU Digital Services Act and applicable national law — Art. 6(1)(c)
Analytics and product improvement	1.4, 1.5	Legitimate interest — Art. 6(1)(f)
Marketing communications (only if you opt in)	1.1	Consent — Art. 6(1)(a)
Crash reporting and security monitoring	1.4, 1.5	Legitimate interest — Art. 6(1)(f)
Comply with legal obligations and respond to lawful requests	All categories	Legal obligation — Art. 6(1)(c)

For US residents, equivalent purposes apply under the California Consumer Privacy Act (CCPA) categories.

3. Apple App Privacy labels

The Apple App Privacy labels for Rallyist are:

Data Used to Track You: None. We do not use your data for cross-app or cross-website tracking.
Data Linked to You: Identifiers (account ID), Contact Info (email), User Content (photos, voice, text, ledger), Usage Data, Location (precise and coarse), Diagnostics.
Data Not Linked to You: Aggregated analytics derived from any of the above after de-identification.

4. How long we keep data ("Retention")

Data	Retention
Account profile (name, email, photo, bio)	Until you delete your account, then 30 days then anonymised (where practical) or deleted (where required)
Location pings during a session	Real time; persisted for at most 24 hours after session ends, then deleted
Recorded journey traces	Until you delete the journey, or the lifetime of the account
User-generated content (spots, photos, comments, chat)	Until you delete the content, or the lifetime of the account; perceptual hashes (for de-duplication and abuse detection) are kept indefinitely after content deletion
Karma ledger entries	Permanent (append-only); attribution scrubbed if the subject account is deleted
IP addresses in security logs	90 days, then deleted or aggregated
Crash reports	90 days
Analytics events (linked to account ID)	24 months, then aggregated/anonymised
Reports of content violations and moderation decisions	5 years (DSA Transparency Database obligation when we cross the small-enterprise threshold)
Communications with support	24 months
Backups	Up to 90 days after deletion (legal-hold and operational restoration)

We do not sell personal data. We share personal data with the following categories of recipients, only to the extent necessary for the purpose listed:

Sub-processors (the list below).
Other Rallyist users to whom you choose to share content (public posts, event participants, Drive Room participants, followers).
Law enforcement and authorities in response to valid legal process (subpoena, court order, lawful request under GDPR Art. 6(1)(c)). We will challenge requests we consider overbroad. We publish a transparency report annually beginning in [year of first full calendar year of operation].
Third parties in connection with a corporate transaction (merger, acquisition, financing, sale of assets). We will notify affected users in advance.

6. Sub-processors (who processes data on our behalf)

The following providers process personal data on our behalf, under data-processing agreements that meet GDPR requirements (and the Standard Contractual Clauses where data leaves the EU/EEA).

Who	What they process	Where	Purpose
Apple or Google, when you sign in with them	Your account identifier and email	EU + USA	Sign-in
Apple and Google push services	Push tokens	EU + USA	Notifications
Our app analytics and crash reporting provider	App usage events, crash reports, device info	EU + USA	Keeping the app stable and improving it
Our hosting and storage providers	Application data, photos, all categories	EU	Running the Services
Our voice provider	Live voice audio in Drive Rooms, not recorded	EU	Drive Room voice
Map and place-search providers	The map area you view and places you search	EU	Maps and search
Our email delivery provider	Email address and message	EU + USA	Account emails

We will email you at least 14 days before adding a provider that materially changes the categories of data we process.

7. International transfers

Where personal data leaves the EU/EEA (for example, when we use a sub-processor in the United States), the transfer is protected by the EU Standard Contractual Clauses (SCCs) and, where applicable, by the EU-US Data Privacy Framework. You can request a copy of the SCCs applicable to your data by emailing privacy@rallyist.app.

8. Your rights

Under GDPR (and equivalent rights under CCPA, LGPD, UK GDPR, Swiss FADP, and similar laws), you have the following rights, free of charge:

Right of access — get a copy of your personal data.
Right of rectification — correct inaccurate data.
Right of erasure ("right to be forgotten") — delete your data, subject to retention obligations.
Right to restrict processing — pause processing in certain circumstances.
Right to data portability — receive your data in a machine-readable format.
Right to object — to processing based on legitimate interest.
Right to withdraw consent — at any time, where processing is based on consent.
Right to lodge a complaint with your local supervisory authority (e.g. your national Data Protection Authority in the EU).

We provide in-app endpoints for the most common requests:

Settings → Account → Download my data — exports your account, garage, journeys, content, karma ledger, and reports as a single JSON file plus media in a ZIP.
Settings → Account → Delete my account — initiates the deletion flow. Your data is deleted or anonymised within 30 days; certain data is retained for the periods listed in §4.
Settings → Privacy → Manage consents — toggles for analytics, crash reporting, marketing, location precision, push categories.

For other requests, email privacy@rallyist.app from the email address on your account. We respond within 30 days (extendable by 60 days under GDPR for complex requests, with notice to you).

9. Children

The Services are intended for users aged 16+ in the EU/EEA and 13+ elsewhere (or older where local law requires). We do not knowingly collect personal data from children below those ages. If you believe a child has used the Services, please email privacy@rallyist.app and we will close the account and delete the data.

10. Cookies and similar technologies

The Rallyist mobile app does not use browser cookies. The Rallyist website uses strictly-necessary cookies for session and CSRF, and optional analytics cookies that you can decline at the consent banner.

11. Security

We use industry-standard security practices: TLS in transit, AES-256 at rest, hashed credentials (Argon2id where we hold them), least- privilege access, isolated production environments, automated intrusion detection. No system is perfectly secure; if a breach occurs that affects your personal data we will notify you as required by law (GDPR Art. 33–34; CCPA equivalent).

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the current version. For material changes, we will notify you in-app or by email at least 14 days before they take effect.

13. Contact

Write to privacy@rallyist.app with any question about your data or this policy, or to exercise any of the rights above.