Privacy policy
Effective date: 1 November 2026
RallySpace is an app, for your phone and in a browser, for running sports clubs and their events (open play today, tournaments later). It is operated by SIDDLAB ("we", "us"). This policy explains what information RallySpace collects, why, and what you can do about it.
If anything here is unclear, write to us at [email protected].
1. What we collect
Your account. Your email address and a password. The password is stored only as a hash; we never see it.
If you sign in with Google. Instead of a password, Google confirms who you are and sends us your Google account's identifier, name, email address (and that Google has verified it), and a link to your Google profile picture. We keep these with your sign-in record. Your name starts your RallySpace profile, where you can change it; the picture is not used. We never see your Google password, and we receive nothing else from your Google account. Google's own privacy policy covers what Google does.
Your profile. A username and full name (required), and optionally a profile photo, gender, a short bio, and your country and city. Your appearance preference (light or dark) is stored too.
Your clubs. Which clubs you create or belong to, your role in each (Owner, Admin or Member), the skill grade the club has assigned you, and when those changed. For clubs you administer: the club's name, logo, description, contact email, website, and venue address.
Your play. When you check in to an event, the matches you play, who you played with and against, the outcome, and the times. This is the point of the app — it is how a club runs an event and how your history is kept.
People you add. A club admin can add a person to a group by name, before that person has an account. If you do this, you are giving us that person's name; please only do it for people who play with your club. That person can later claim the record by creating an account.
People you invite. A club admin can invite someone by email. We keep that email address with the invitation, so that only that person can use it, until it is used or expires (14 days). We send the invitation email from [email protected], through Resend, naming the admin who invited them; that address receives nothing.
Places you look up. When you look up a city or a venue, the words you type are sent to LocationIQ, a place-search service, which suggests matching places. We store only the place you choose: its name, address and coordinates. The app never reads your device's location and never tracks where you are.
Technical data. Like any online service, our servers record the IP address and time of each request. These logs are used for security and troubleshooting and are not linked to your profile by us. Each installation of the app also has a random identifier, sent with its requests, so that a live event is run from one device at a time.
Error reports. If the app runs into an error, it sends a report to Sentry: what went wrong, the app version, and the device model and operating system. Reports do not include your name, email address, photos or messages.
We do not collect contacts, location history, advertising identifiers or analytics about how you use the app. RallySpace contains no advertising and no tracking or analytics SDKs; the only reporting it does is the error reports above.
2. Why we collect it
- To run your account and let you sign in.
- To let clubs organise members, grades and events, and to keep an accurate record of play.
- To show other members of your club who you are: your name, photo, grade and play history are visible to the club's members.
- To respond when you contact us.
- To keep the service secure and to investigate abuse.
The legal basis, where one is required, is the service you asked for and, for the optional profile fields, your consent.
3. Who can see your information
- Members of your clubs can see your profile and your play within that club. Club admins can also see when you joined and your grade history.
- Anyone using the app can find clubs (name, sport, city, logo, description) when they browse. Member lists and play records are only visible inside the club.
- Nobody else. We do not sell, rent or share personal information with advertisers or data brokers.
4. Service providers
We use a small number of providers to run RallySpace. Each processes data only on our instructions.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in, and file storage (photos and logos) | United States (Ohio), on Amazon Web Services |
| PowerSync | Keeps an event's data in sync with the host's device so an event keeps working without Wi-Fi | United States |
| LocationIQ | Place search: suggests cities and venues from the words you type | Their own servers |
| Resend | Sends our emails: account emails (confirming your address, resetting your password, telling you your password or email address changed, confirming your account was deleted) and club invitations | United States (Virginia) |
| Sentry | Receives error reports from the app | United States |
| Cloudflare | Serves the web app and this site, and forwards email sent to our addresses | Their global network |
| Expo | Builds the app and delivers its updates to your device | United States |
| Apple / Google | App distribution | Their own regions |
Your data may therefore be stored or processed outside the country where you live, where different laws apply. We choose providers that commit to protecting it contractually.
5. On your device
To keep an event running when the venue's Wi-Fi does not, the app keeps a local copy of the active event's data (the club, its members and their photos, the event's participants and matches) on the device that runs it. Signing out keeps this copy, so that anything recorded offline is still sent when you sign back in; it is removed when someone else signs in on that device, or when you delete the app.
The app also keeps a few small things on your device so it works the way you left it: your sign-in, the random installation identifier described in section 1, your appearance and event-screen preferences, and which release notes you have read. In a browser these are kept in the browser's storage for our site. They are not used to track you and are not shared.
6. How long we keep it
- Your account and profile: until you delete your account.
- Play records: matches are part of the club's record, not only yours. When you delete your account, your name is removed from them and replaced with "Former member". The match itself is kept so the club's history stays intact.
- Server logs: a short period, typically no more than 30 days.
7. Your choices
- See and change your profile at any time in the app.
- Leave a club from the club's screen.
- Stop signing in with Google by removing RallySpace from your Google Account (Security → Your connections to third-party apps and services). This does not delete your RallySpace account; you can no longer sign in to it with Google.
- Delete your account from Profile → Delete account. This removes your account, profile and photo immediately. If you own a club, you will be asked to hand it over or delete it first, because a club needs an owner. Without the app, see rallyspace.app/legal/delete-account.
- Ask us for a copy of your information, or to correct it, by emailing [email protected]. We answer within 30 days.
8. Children
RallySpace is for people aged 13 and over. We do not knowingly collect information from anyone younger. If you believe a child has created an account, contact us and we will remove it.
9. Security
Data travels between the app and our servers over encrypted connections. Access to each club's data is enforced by the database itself, so a member of one club cannot read another's. No system is perfectly secure; if we learn of a breach affecting you, we will tell you.
10. Changes to this policy
When we change this policy, we will update the date at the top and, for significant changes, tell you in the app. RallySpace is currently free; if we introduce paid features we will update this policy before doing so.
11. Contact
SIDDLAB [email protected]
You may also complain to the data protection authority where you live if you believe we have not handled your information properly.