Privacy Policy

Effective date: August 20, 2026  ·  Applies to: Rally for iOS (the “App”)  ·  Publisher: Rally (“we,” “us”)

Rally is a social fitness accountability app. Friends and squads help each other show up through check-ins, Instants, Stories, and messages. This policy explains, in plain English, what we collect, why, who sees it, and how to delete it. If anything here is unclear, email us — the address is at the bottom.

We wrote this policy to match Apple's App Privacy (“nutrition label”) categories so you can compare it line-for-line with what you see on the App Store.

1. What we collect

We try to collect as little as possible. Here is the complete list.

Identifiers

• User ID. When you sign in, Firebase Authentication creates a random string (a “UID”) that identifies your account to our servers.
• Account identifiers. If you sign in with email, we store the email address you use to sign in. If you use Sign in with Apple, we store the Apple-provided relay email when you choose Hide My Email. Anonymous IDs from earlier test builds are signed out before production use.
• Device and installation identifiers. We use Firebase installation identifiers and, if you opt in, an APNs/FCM device token to route squad invitations, messages, Story activity, check-in engagement, and service notices to your device.

User content

• Workout media. Check-in photos and short videos you capture or choose, plus thumbnails needed to load them quickly. Access is limited to the relevant squad audience.
• Posts and captions. Workout type, activity details, captions, reactions, and consistency history.
• Stories. Text, photos, or videos shared with a selected squad or followers. Stories expire after 24 hours and do not affect goals or streaks.
• Messages. Direct messages, squad chat messages, and shared check-in references. We do not use message contents for analytics.
• Goals and streaks. The structured data behind your personal goals and streak calendar. Goals are personal commitments only — Rally does not handle money, donations, or wagers.

Usage data

• In-app activity. Posts you create, cheers you give or receive, streaks you hit, and the last time you opened the app — all stored in Firestore so the app has something to show you.
• Product analytics. We use PostHog to measure high-level flows such as sign-in completion, onboarding completion, squad creation, invitations, chat delivery, and Story failures. We do not send message contents, media, exact addresses, or exact coordinates to analytics.
• Crash and performance data. Firebase Crashlytics and Apple's diagnostics may collect crash traces, app version, device model, operating-system version, and technical identifiers needed to diagnose failures.

Contact info

• Email address. Used for email sign-in, account recovery, privacy requests, and support. Sign in with Apple's “Hide My Email” is fully supported.

Location and nearby discovery

• Optional device location. If you grant When In Use permission, Rally briefly uses your device location to select an approximate area and suggest nearby public squads and people with shared activities. You may enter a place manually or skip this step.
• Private discovery coordinate. We store an approximate coordinate privately for nearby queries. Other users see only a broad area label; Rally never shows another person's exact coordinate or exact distance.
• Squad locations. A squad may publish a broad city or neighborhood. Its exact Google Place ID, venue, address, and coordinate are member-only and appear only after someone joins.
• Google Places. Text you enter into location search and selected place identifiers are processed by Google Places to provide autocomplete and location details.
• Rally does not read your contacts or calendar and does not process payments. You can revoke location permission in iOS Settings at any time.

Metadata in photos

• Photos Rally prepares for upload are re-encoded for display and do not intentionally include photo-library GPS metadata. Squad discovery location is stored separately under the controls described above.

2. How we use what we collect

We use your data for exactly these reasons. Nothing else.

• To run the app. Authenticate your account, personalize onboarding, show squad feeds and Stories, deliver messages and invitations, track goals, and provide nearby discovery you enable.
• To keep the app and squads safe. Investigate abuse reports, honor block requests, and respond to legal requests.
• To communicate with you. If you opt in to push, send squad invitations, direct and squad messages, Story replies/reactions, check-in engagement, reminders, and service notices. You can turn these off anytime in iOS Settings.

We do not sell your data. We do not use your photos or messages to train advertising profiles. We do not run ads.

3. Who sees your data

Rally is built on a small set of service providers. They act as processors on our behalf and handle data only to operate the relevant service.

• Firebase (Google Cloud). Authentication, Firestore, Storage, Cloud Functions, App Check, Crashlytics, Remote Config, and Cloud Messaging.
• Google Places. Location autocomplete and selected-place details when you use the optional location flow.
• Apple. Apple handles the Sign in with Apple exchange. Push notifications flow through Apple Push Notification service when you opt in.
• PostHog. Privacy-limited product analytics as described above.

We do not share your data with advertisers, data brokers, analytics companies, or affiliates. There are no affiliates.

We may disclose data when legally required (a valid subpoena, a safety emergency, or as part of a business transfer, in which case we will notify you first and give you the chance to delete your account).

4. How long we keep your data

• Check-in media. Stored until you delete the post or your account. Deletion requests remove active Storage objects; backup copies age out under our provider's backup schedule.
• Stories. Expire after 24 hours and are removed by scheduled cleanup. Authors and moderators may delete them sooner.
• Comments and posts. Same retention as photos.
• Account record. Kept while your account is active. When you delete your account, we delete the record and your personal content within 30 days, except minimal records we are legally required to retain (none today).
• Messages and safety records. Messages remain until the relevant account or service data is deleted. Reports and moderation records may be retained as needed to protect users, prevent repeated abuse, or meet legal obligations.

5. Your rights and controls

You can do all of the following from inside Rally or by emailing us:

• Access. See every photo, post, and message tied to your account. Most of this is already visible in-app.
• Export. Request a copy of your data in a machine-readable format. We'll deliver it within 30 days.
• Correct. Edit captions, workout type, and your profile anytime from the app.
• Delete specific content. Delete check-in photos/posts and Stories you created. Direct message deletion is not part of this release; account deletion removes account-associated data under the retention terms above.
• Delete your account. Open Rally, go to You → Settings → Delete Account. Rally revokes supported provider credentials and requests deletion of your profile and associated content.
• Safety controls. Report content, block another account, or contact support from the app.
• Withdraw consent. Revoke camera, microphone, photo, location, or notification permissions in iOS Settings → Rally at any time.

If you live in California, the EEA, the UK, or another jurisdiction with data-protection laws, you also have the right to object to processing, request portability, and lodge a complaint with your local regulator. Email us and we'll honor the same rights globally.

6. How we protect your data

• Photos and data are transmitted over TLS.
• Firebase Storage and Firestore enforce per-user access rules — the rules that decide who can read or write a post live in our code repository and are reviewed before every release.
• Squad photos and comments are readable only by members of the same squad, enforced by Firestore security rules.
• We do not store any secrets, payment card numbers, or government identifiers.

No system is perfect. If we learn of a breach that affects you, we will notify you by email (if we have one) or an in-app notice, and we'll tell you what happened and what to do.

7. Children

Rally is for people 13 and older. The App Store age rating reflects that. We do not knowingly collect data from children under 13. If you believe a child under 13 is using Rally, email us and we'll delete the account.

Some jurisdictions set the minimum age higher (for example, 16 in parts of the EU). In those places, the local minimum applies.

8. International users

Rally's servers run in the United States on Google Cloud. If you use Rally from outside the US, your data will be transferred to and processed in the US. We apply the same privacy commitments to your data regardless of where you live.

9. Changes to this policy

If we change this policy in a material way — for example, when a new service provider is added — we will update the effective date at the top and notify you in-app before the change takes effect. Older versions are available on request.

10. Contact

Questions, requests, complaints, or a polite nudge to fix a typo:

Email: abenuro@gmail.com

We respond to privacy requests within 30 days.

Thanks for trusting us with your streak. We take it seriously.