Privacy Policy

Rally is operated by Rally, a volunteer-run, not-for-profit software project. This policy explains how we handle personal information in a way that is consistent with the Australian Privacy Principles (APPs) and other applicable privacy law.

Privacy contact: support@example.com

Rally hosts booking and balance records for badminton clubs. Each club's administrators enter and manage member information. We provide the software and process information on their behalf.

We collect only what is needed to run the portal for your club:

• Identity and contact — name, email address, and mobile number (when your club admin adds them or you request a sign-in link)
• Membership — club membership, display name, role (player, admin, or super admin), and active status
• Bookings and activity — session bookings, cancellations, and related attendance records. Other members of your club can see your display name on a session's confirmed roster
• Balance records — deposit balances, charges, refunds, adjustments, settlements, and transaction history shown in the portal
• Sign-in and security — hashed sign-in tokens, server-side session records, sign-in timestamps, and rate-limiting data derived from connection information (such as IP address) to protect against abuse
• In-app notices — messages shown in your Rally inbox (for example low balance or booking confirmations)
• Communication preferences — whether you have opted in to new-session alerts by email or SMS
• Technical logs — limited diagnostic and security information our hosting and infrastructure providers may record when you use the service

We do not collect payment card numbers through Rally. Money owed to or held by your club is handled outside the portal. Balances shown in Rally are records maintained by your club, not a bank account with us.

We use personal information to:

• verify your identity and keep your account secure
• let you book sessions, see who is playing, and view your balance and history
• let club administrators run sessions, manage players, and settle costs
• send operational messages you request or that are necessary to run your account (such as sign-in links and security notices)
• send optional new-session alerts by email or SMS when you have opted in
• maintain accurate records for your club
• investigate errors, abuse, and service reliability

We do not use your information for unrelated advertising or sell your contact details.

Essential messages include sign-in links you request and other account or security communications needed to operate the service. These are not marketing messages and do not require a separate marketing opt-in.

Optional session alerts — if you turn on “Email me when a new session is added” or “SMS me when a new session is added” in your profile settings, we will use your email address or mobile number to notify you when your club publishes a new session you can book.

• Opt-in is off by default.
• You can change or withdraw consent at any time in settings or via an unsubscribe link in a message.
• Withdrawing consent stops future alerts; it does not delete your account.
• SMS alerts may incur message and data charges from your carrier.
• Session alerts are not a condition of using Rally.

Rally uses an essential HTTP-only session cookie to keep you signed in on your device. We do not use advertising or cross-site tracking cookies. You can end a session by signing out.

Rally is intended for people aged 18 and over. We do not knowingly collect information from children. We do not verify age at sign-in; clubs are responsible for who they add to their member list.

Personal information is stored in:

• a PostgreSQL database hosted by our database host (as configured for this deployment)
• application infrastructure hosted by Vercel

Sign-in links may be sent by email through Resend when your club uses email delivery. Optional SMS alerts, when enabled, are sent through our SMS provider.

Data is transmitted over HTTPS. Access is limited to what is needed to operate and support the service.

Some of our service providers may process or store information outside Australia (for example in the United States or other regions where their infrastructure runs). Where this occurs, we take reasonable steps to ensure overseas recipients handle information in a way that is consistent with this policy and applicable law.

We share personal information only:

• with your club's authorised administrators — to manage sessions, players, and balance records
• with service providers that help us run Rally (hosting, email, SMS), under confidentiality and security obligations
• where required or authorised by law

We retain personal information only for as long as reasonably necessary to provide the service, maintain security, meet legal obligations, and support club record-keeping. This includes:

• active account and membership data while you remain a member of a club using Rally
• booking and transaction records while your club requires them for its records
• expired sign-in tokens and revoked sessions for a limited period for security and audit purposes
• backups and infrastructure logs for limited periods according to our providers' practices

When information is no longer needed, we take reasonable steps to delete or de-identify it, subject to any legal or legitimate record-keeping requirements.

If we become aware of a data breach that is likely to result in serious harm, we will take reasonable steps to contain it, assess it, and notify affected individuals and the Office of the Australian Information Commissioner where required under the Notifiable Data Breaches scheme.

You may request access to or correction of your personal information by contacting your club administrator (who can update most details in the portal) or us at support@example.com.

Some changes (for example sign-in email or mobile number) may require a super admin at your club.

If you believe we have mishandled your personal information, contact us at support@example.com. We will respond within a reasonable time.

If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au.

We may update this policy from time to time. The “Last updated” date at the top of this page will change when we do. Material changes will be communicated where practical (for example on the sign-in page or in the portal).