Privacy
Privacy policy
Rally is a tournament management app built in Quebec. This page says what we collect, why, who it is shared with, and how to get it corrected or deleted. No jargon — and if anything stays unclear, write to us.
Last updated: September 6, 2026
The short version
- We ask for the minimum: an email to sign in, and whatever you type into your own tournaments.
- The email you leave in a support request is only ever used to reply to you.
- With your permission, analytics receive at most an account id, but never your name or email.
- No data selling, no advertising, no advertising trackers.
- You delete your account yourself, from the account menu: it goes along with every tournament you own. Support requests delete themselves after 12 months.
Who is responsible
Rally (gorally.games) is an independent project run from Quebec. For any question about your personal information, write to [email protected]: the same person reads it and answers.
This policy is governed by Quebec law, in particular Law 25 — the Act to modernize legislative provisions as regards the protection of personal information. The authority that oversees it, and where you can file a complaint, is the Commission d’accès à l’information du Québec.
If you are reading this from Europe, the GDPR may cover you as well: the rights it grants largely overlap with the ones described below. Rally’s primary regime remains the Quebec one.
What we collect, and why
Rally only collects what it needs to run a tournament and to answer you. Here is the full list, category by category.
- Account and sign-in
- Your email address and the display name you choose. To sign you in we email a six-digit code; it expires after 5 minutes and is only stored as a hash. You can then set a password, which is never stored in clear text. To stop anyone from flooding a mailbox with codes, your address and the IP address of the request are kept for one hour, then deleted.
- Your tournaments
- Everything you enter: tournament name, description, dates, venue, team names, player names, scores and standings. Those names are often real people, and they are visible to anyone you send a share link to. You decide what to write and who gets the link.
- Online registration
- When a player or captain fills in your registration form, we store the team or player name and the roster they declare. No account is required, and the form asks for neither an email nor a phone number.
- Support requests
- The request type, your message, the address of the page you are writing from, your browser name, your email if you leave one, and your account id if you are signed in. The email is only used to reply to you. The request is stored and a copy is emailed to us.
- League inquiries
- From the "Contact us" form on the pricing page (Leagues column): your club or organization name, your email, your name if you give it, the sport, an approximate size, and a message if you leave one. It is only used to answer your business inquiry — no account is required to send it. The request is stored and a copy is emailed to us.
- Analytics
- Only if you accept, PostHog receives page views and a few product events — "a tournament was created", "a sport page was viewed". While you are signed out, all of it is attached to an anonymous identifier stored in your browser. Once you sign in, your account id is added — a string of characters, with neither your email nor your name — so your visits can be tied together. There is no session recording and no automatic capture of your clicks or keystrokes, and share-link tokens are stripped before anything is sent. If your browser sends the "Do Not Track" signal, no analytics are recorded or sent.
Share links
Spectator links (/public/…) and registration links (/join/…) carry a secret token in their address: anyone with the link can see the tournament, with no account. That is deliberate — it is what lets people follow scores from any phone.
One consequence to know: if you write to us from one of those pages, the full address travels with your support request, token included — it is what tells us where the problem happened. Our analytics never receive those tokens: they are replaced before anything is sent.
The scorekeeper link secret travels after the "#" in the address. That part is never transmitted: not with a support request, not to analytics.
Who it is shared with
We do not sell, rent or trade any personal information. Only three providers ever see data, each for one precise job:
- Resend (Plus Five Five, Inc.) — United States
- Sends our emails: your sign-in codes, the copy of your support requests, and the copy of your league inquiries. It therefore receives your email address and the content of those messages. All of it is processed and stored in the United States: message content, delivery logs and account data stay there, including when delivery is routed through Resend’s European region. The transfer is framed — Resend commits to standard contractual clauses in its data processing addendum, and is certified under the EU-US Data Privacy Framework. Resend privacy policy
- PostHog — European region
- Only after you accept, receives page views and product events. Rally uses PostHog’s European region: that data is stored in the European Union. If you are signed in, PostHog also receives your account id, but never your email or your name.
- Cloudflare — United States
- Acts as the network front door of the site. Like any network intermediary, it sees your IP address and the technical requests.
The app and its database run on our own server, not on a third-party cloud host. Going through these three providers means some data leaves Quebec. Law 25 requires such transfers to be framed: those to Resend are, through standard contractual clauses and an EU-US Data Privacy Framework certification, and those to PostHog stay inside the European Union. We would rather write it down than leave it out.
How long it is kept
Here is what the software actually does, not what we intend.
- Account and tournaments
- Kept as long as the account exists. You can delete a tournament yourself: its teams, registrations and share links go with it.
- Support requests
- Kept for 12 months, then deleted automatically. The copy we received by email does stay in our inbox.
- League inquiries
- Same schedule as support requests: kept for 12 months, then deleted automatically. The copy we received by email stays in our inbox.
- Sign-in codes
- The code expires after 5 minutes. The traces kept to limit abuse — your email and the IP address of the request — are deleted after one hour.
- Scorer link sessions
- A scorer session lasts 12 hours. After that, the row is deleted from the database the next time any scorer link is opened.
- Account deletion
- From the account menu, "Supprimer mon compte" immediately deletes your account, your open sessions and EVERY tournament you own — including their teams, matches, registrations and public pages. It is final: nothing is archived, nothing can be restored. The dialog tells you the exact number of tournaments involved before you confirm.
Support requests made before an account is deleted follow their own 12-month clock: write to us if you want them gone sooner.
Your rights
Quebec’s Law 25 gives you rights over your personal information. In practice, with us:
- Know what we hold
- Ask, and we answer with what the database holds about you.
- Get it corrected
- Tell us what is inaccurate or incomplete, and we fix it.
- Get it deleted
- You delete your tournaments — and your whole account, from the account menu — without going through us. For a support request you would rather not wait 12 months on, write to us: it is done by hand, but it is done.
- Withdraw your consent
- You can stop using Rally and ask for deletion at any time. To withdraw permission for analytics, open the “Cookies” button available at the bottom of the screen and decline analytics. Your browser’s “Do Not Track” signal also blocks analytics.
- File a complaint
- If our answer does not satisfy you, you can file a complaint with the Commission d’accès à l’information du Québec, the authority that oversees Law 25. cai.gouv.qc.ca
One address for all of it: [email protected]. Law 25 requires us to answer an access or correction request within 30 days: that is the legal deadline that applies, not a commercial promise on our part. In practice, we answer well before.
Security
The site is served over HTTPS. Passwords are hashed, never stored in clear text, and share-link tokens are only kept as hashes: not even we can read them back.
That said, Rally is a small independent project. No security is absolute, and we will not pretend otherwise.
Changes to this policy
This page follows the code. The day Rally collects something new, this page is updated before the collection starts, not after, and the date at the top changes.
A question about your data?
Write to us. Same address for an access request, a correction, a deletion, or just a question on your mind.
[email protected]