Privacy Policy

RallyBook is an independent product by Petro ("the operator"). The legal entity, address, and data-protection contact will be listed here once finalised. Until then, please reach hello@rallybook.app for any privacy-related inquiry.

From riders

• Authentication identity: your email and display name from Sign in with Apple, Google, or email. We never see your password.
• Device fingerprint: an opaque per-install identifier used to enforce per-device entitlement limits and to render a short human-readable code (e.g. XK4F-MP9Q) so the organizer can recognise you in their approval queue.
• Country flag: the ISO country code you picked in the app settings, shown next to your bib in the organizer's participants list.
• Event entitlement and join records: which events you joined, when, and via which event password or invitation.

When you plan, draw or share a roadbook

• Route planning (Create Roadbook): the start, the end and any control points you enter are sent to our server when you ask for routes. If you chose "My location" as a point, that point is your position at that moment. The planned routes are kept for 30 days so the same request is not computed twice; they are stored by the points themselves, not against your account.
• Drawing a roadbook from a GPX (one you created or one you imported): the app sends points along the course to our server to fetch the roads, the terrain and the heights around it. The answers are kept (roads for 60 days, heights for a year) by the stretch of course they describe, not against your account, so the next rider on the same road does not ask again. The drawn roadbook itself stays on your device.
• A roadbook you share with a link ("Share with a friend"): the course of that roadbook is uploaded and stored with its title, its start and finish towns, its distance and route figures, your display name as its author and the date you created it. For a roadbook made from a GPX file of yours, what is uploaded is its line and its waypoints (their place, name and description): the times, sensor data and anything else in the file stay on your device. Anyone who has the link and a RallyBook account can fetch it and will see that name and date. A route can start at your door: share the link only with people you would tell where it starts. We count how many times a link is opened, not by whom.
• Your position is used on your device to navigate. It leaves the device only as part of something you ask for or record: a route planned from "My location", and the ride sessions and journals described in this policy.
• Place search: what you type in the route planner's search field goes to your phone's own map search (Apple's on iPhone, Google's on Android) to find places, and coordinates are sent to the same service to name the town they are in.

From organizers

• Organization name, slug, and members.
• Event metadata: name, dates, location, type, banner image.
• Uploaded roadbook files (GPX, .cap). These are encrypted at rest with AES-256-GCM before being stored in Cloud Storage; the decryption key per file lives in a separate Firestore document behind strict access rules.
• Participant lists you create, including names, bibs, optional emails, and optional pre-list device codes you assign.
• Billing records for the event plans you buy: a Stripe customer reference, which plan was bought for which event, and when. RallyBook never sees full card numbers. Payment capture happens directly between your browser and Stripe.

When you buy or spend Credits

• Your wallet and its ledger: your Credit balance and one record of every movement in and out of it, including purchases, Analysis Report unlocks, Marketplace rentals, refunds and any adjustment we make. The ledger is what makes a balance answerable, so it is kept as an accounting record.
• Purchase records for Credits and RallyBook Pro: the store you bought from, the store transaction identifier, the product, and when. We use the transaction identifier to make sure one receipt cannot be redeemed on more than one account.

In the Marketplace

• Sale records: which listing you rented, for how many Credits, when, the rental window, and whether it was started, expired or refunded.
• Riding session and journal data from your rides on a rented roadbook. We use it to determine when a rental was actually activated (the window starts when you ride, not when you buy), and to detect one rental apparently being ridden in two places at once. This data is tamper-evident by design, which is what lets it settle a dispute about a rental.
• Review text and star ratings you publish, shown publicly under your display name, along with any public response from the creator.
• From creators: the listings you submit and their content, the moderation decisions made on them, and your earnings ledger in euros. When you request a payout we collect your name, country and bank details. Those are collected outside the platform, and we record your name and country against the payout for tax and accounting purposes.

• To run the service: authentication, access control, DRM key delivery, transactional emails.
• To enforce entitlement rules (event windows, per-device caps).
• To bill organizers for the event plans they buy.
• To keep your wallet honest, to deliver what you bought, and to handle refunds and chargebacks. Keeping records of the sales themselves is also a legal accounting obligation, not only a product choice.
• To work out when a Marketplace rental started and whether it was used as one rental, and to detect fraud and abuse against Credits, rentals, reviews and creator earnings.
• To pay creators, and to keep the records a tax authority may ask for about those payments.
• To plan the routes you ask for, to draw roadbooks (the roads, terrain and heights around a course), and to deliver a roadbook you shared to the people you gave its link to.
• To debug failures. Cloud Functions logs may contain user IDs and event IDs but never roadbook contents or passwords. For route planning they hold how many points were asked for and how far apart, not where.

We do not sell, rent, or trade your data. We do not embed third-party advertising tracking. We do not run general-purpose analytics tracking like Google Analytics on rallybook.app.

• Google Firebase / Google Cloud: hosts our Firestore database, Cloud Storage, Cloud Functions, and Auth. Region: europe-west1 (Belgium). Google's data-processing terms govern.
• Apple: when you sign in with Apple, Apple authenticates you and shares your email (or a relay address) and display name with us. Apple also sells Credits and RallyBook Pro on the App Store and passes us the purchase records for them.
• Google: when you sign in with Google, Google shares your email and display name with us. Google Play also sells Credits and RallyBook Pro and passes us the purchase records for them.
• Event organizers: when you join an event, the organizer sees your display name, email, device code, and country flag in their participants list.
• Stripe: processes organizer payments for event plans. Stripe receives the organizer's billing details, not rider data.
• Routing and map data services: to plan a route and to draw a roadbook, our server sends coordinates, and nothing that identifies you, to a routing server (BRouter, operated by the BRouter project in Germany), to OpenStreetMap query servers (Overpass API instances) and to an elevation service (Open-Meteo). They see our server, not you. When our server cannot be reached or cannot get an answer, the app asks the OpenStreetMap query servers itself, and it asks Open-Meteo and a satellite imagery service (Esri) directly for a roadbook's height profile and for the picture on its card: those services then see your device's IP address and the area of that roadbook.
• Apple Maps: the maps in the app, the place search in the route planner and the town names on roadbook cards come from Apple's map services, which receive the search text or the coordinates involved under Apple's privacy policy.
• People you share a link with: whoever holds a roadbook's share link and a RallyBook account gets that roadbook's course, your display name as its author and the date it was created.
• Other RallyBook users: a review you publish is public, and carries your display name. A creator whose roadbook you rented sees that a rental happened and its value, but not your identity.

All storage and processing happens in the European Union (Google Cloud's europe-west1 region, Belgium). If you sign in with Apple or Google from another region, those identity providers may briefly process your authentication request in their own regions per their respective privacy policies. The routing, map data and elevation services named above answer from their own servers, which receive coordinates and nothing about you.

• Active accounts and their data: for as long as your account exists.
• Entitlements and event history: retained after the event ends as a personal history (shown as "Ended" cards in the library) so you can see what you've done. Destroyed with your account.
• Encrypted roadbook files: deleted when the producer deletes the roadbook or the parent event.
• Your wallet and its ledger: for as long as your account exists. Both are destroyed with it.
• Marketplace sale records, store receipt records, and creator earnings and payout records: kept for as long as accounting and tax law requires, which outlives your account. See the next section.
• Roadbooks you shared with a link: until you delete your account. Deleting the roadbook from your device does not take the link down; write to us if you want one removed sooner.
• Planned routes, road data and heights kept to avoid asking twice: 30 days, 60 days and one year. They are not linked to an account.
• Cloud Functions logs: retained for 30 days per Google's defaults.

Deleting your account is not the same thing as erasing every trace of you, and we would rather be plain about that than let you find out later.

Destroyed: your profile, your email and display name, your country flag, your device fingerprints, your entitlements, your event history and roster rows, your ride sessions along with the journals uploaded from them, the roadbooks you shared with a link (their links stop working), and your access to anything you hold. Your wallet and its whole ledger go too, so any Credits left in it are lost. They are not refunded and not paid out.

Kept: the record of any Marketplace sale you were a party to; the store receipt records that tie a store transaction to one account, so that a receipt cannot later be redeemed a second time; your creator earnings ledger, flagged as belonging to a deleted account, with the euro amounts intact; and any reviews you published. These survive because they are accounting, anti-fraud and legal records, not because they are useful to us. They are no longer attached to a live account or to your name and email, and what is left is a record that a transaction happened, for how much, and when. Published reviews stay up under the display name they were published with.

If you are a creator with earnings still owed to you, the app will refuse to delete the account until that money is settled. We would rather stop you than quietly keep it. If you want a review taken down, delete the review before deleting the account, or ask us.

You have the right to access, correct, export, or delete your personal data. Email hello@rallybook.app with your request and we'll respond within 30 days. For account deletion you don't need to email us: tap "Delete Account" on the account screen in the iOS or Android app, or use the account deletion page on this site.

The right to erasure has limits, and financial records are the main one here. Where the law requires us to keep an accounting record, we keep it and pseudonymise it rather than delete it. The section above sets out exactly which records those are.

The rallybook.app website uses a small number of first-party cookies / browser storage entries:

• Authentication: Firebase Auth stores your session token so you don't have to sign in again on every visit. Strictly necessary; not optional.
• Cookie banner choice: your accept / reject choice on the consent banner is stored in localStorage so we don't ask again.

No analytics or advertising cookies are set today.

RallyBook is not aimed at children under 16. If you believe a child has created an account, email us and we'll delete it.

We'll post a revision date at the top whenever we change this policy. Material changes that affect how we use your data will be announced by email and in the app at least 30 days before they take effect.

Privacy questions, deletion requests, or general feedback: hello@rallybook.app.