Privacy Policy

What we collect

Account information. Your name, email address, and password (stored only as a secure hash). If you sign in with Apple or Google, we receive your name and email from them. If you use Sign in with Apple's "Hide My Email," we receive a private relay address instead.

Profile information you add. Your phone number, home address (used by tournament directors for scheduling and travel, and to keep nearby teams from meeting in the first round), your skill and personal ratings, and an optional profile photo used by clubs to verify check-ins.

DUPR information. If you link your DUPR account, we receive your DUPR ID, your DUPR ratings, and your DUPR membership tier, along with access tokens that let us keep your ratings current. We store those tokens encrypted.

Activity in RallySync. The clubs, leagues, tournaments, and events you join, your registrations, match results, scores, standings, check-ins, reservations, and the players you follow.

Payments. Payments are processed by Stripe on behalf of the club or organizer you're paying. We receive a record of each payment (the amount, the status, and what it was for), but we never receive or store your full card number.

Device and notification information. If you turn on notifications, we store a notification token for your device or browser so we can send match calls and updates. We also record basic technical information such as your device type, app version, and browser.

Usage information. We use product analytics (provided by Pendo) to understand how features are used, so we can improve them. This includes pages viewed and features used, linked to your account.

Google user data

If you choose to sign in with Google, RallySync receives your name, email address, and profile picture from your Google account. We use this information only to create your account, sign you in, and show your name and photo in RallySync. We don't use Google user data for advertising, we don't sell it, and we don't share it with third parties except the service providers listed below that help us run RallySync. We store it securely, and delete it when you delete your account. RallySync's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use it

We use your information to:

• run your account and keep it secure
• let clubs and organizers run their events: registrations, scheduling, court assignments, match calls, results, and payments
• send you notifications and emails you've asked for, or that are needed for an event you're in (for example, "You're up on Court 3" or a schedule change)
• seed and schedule tournaments fairly, including using ratings and home ZIP codes
• submit match results to DUPR when the organizer of your event turns on DUPR submission and you've linked your DUPR account
• understand how RallySync is used, so we can improve it
• comply with the law and prevent fraud or abuse

We don't sell your personal information, and we don't use it for third-party advertising.

Who can see your information

Clubs and organizers you join or register with can see what they need to run their events, such as your name, contact information, home address, ratings, registrations, payments to them, and results.

Other players and the public can see your name, team, ratings shown in brackets, match results, and live scores for events you take part in, including on live displays at the venue. They never see your email, phone, or home address.

Staff and refs for an event can see what they need to score and run matches.

Who we share it with

We share information only with services that help us run RallySync, and only for that purpose:

• Stripe, for payments
• DUPR, for rating sync and result submission, when you link your account
• Apple and Google, for sign-in and push notifications
• Our hosting, database, and email providers (Render, Vercel, MongoDB Atlas, and Resend)
• Pendo, for product analytics

We may also share information if the law requires it, to protect someone's safety, or as part of a business transfer, in which case this policy continues to apply.

How long we keep it

We keep your information while your account is open. When you delete your account, we delete your sign-in, profile, follows, devices, and notification history. Past tournament results stay in event records so brackets and standings remain correct, but they're shown as "Deleted player." Payment records are kept as required for the clubs' accounting and legal obligations, with your name and email removed.

Your choices

• Edit your profile at any time from Profile.
• Turn off notifications in your device or browser settings.
• Unlink DUPR from Profile.
• Delete your account from Profile, in the app or on the website. If you own a club or an active tournament, you'll be asked to transfer or close it first.
• Ask us for a copy of your information, or to correct or delete it, by emailing james@rallysync.io. Depending on where you live (for example, California), you may have additional rights, and we'll honor them.

Security

We use encrypted connections, store passwords as secure hashes, encrypt DUPR tokens, and limit who can access personal information. No system is perfectly secure, but we work to protect your information.

Children

RallySync isn't directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has given us information, contact us and we'll delete it.

Changes

If we make important changes to this policy, we'll update the date above and let you know in RallySync or by email.

Contact

Questions about privacy: james@rallysync.io