Privacy Policy

RallyBook is an independent product by Petro ("the operator"). The legal entity, address, and data-protection contact will be listed here once finalised. Until then, please reach hello@rallybook.app for any privacy-related inquiry.

From riders

• Authentication identity: your email and display name from Sign in with Apple, Google, or email. We never see your password.
• Device fingerprint: an opaque per-install identifier used to enforce per-device entitlement limits and to render a short human-readable code (e.g. XK4F-MP9Q) so the organizer can recognise you in their approval queue.
• Country flag: the ISO country code you picked in the app settings, shown next to your bib in the organizer's participants list.
• Event entitlement and join records: which events you joined, when, and via which event password or invitation.

From organizers

• Organization name, slug, and members.
• Event metadata: name, dates, location, type, banner image.
• Uploaded roadbook files (GPX, .cap). These are encrypted at rest with AES-256-GCM before being stored in Cloud Storage; the decryption key per file lives in a separate Firestore document behind strict access rules.
• Participant lists you create, including names, bibs, optional emails, and optional pre-list device codes you assign.
• Billing records for the event plans you buy: a Stripe customer reference, which plan was bought for which event, and when. RallyBook never sees full card numbers. Payment capture happens directly between your browser and Stripe.

When you buy or spend Credits

• Your wallet and its ledger: your Credit balance and one record of every movement in and out of it, including purchases, Analysis Report unlocks, Marketplace rentals, refunds and any adjustment we make. The ledger is what makes a balance answerable, so it is kept as an accounting record.
• Purchase records for Credits and RallyBook Pro: the store you bought from, the store transaction identifier, the product, and when. We use the transaction identifier to make sure one receipt cannot be redeemed on more than one account.

In the Marketplace

• Sale records: which listing you rented, for how many Credits, when, the rental window, and whether it was started, expired or refunded.
• Riding session and journal data from your rides on a rented roadbook. We use it to determine when a rental was actually activated (the window starts when you ride, not when you buy), and to detect one rental apparently being ridden in two places at once. This data is tamper-evident by design, which is what lets it settle a dispute about a rental.
• Review text and star ratings you publish, shown publicly under your display name, along with any public response from the creator.
• From creators: the listings you submit and their content, the moderation decisions made on them, and your earnings ledger in euros. When you request a payout we collect your name, country and bank details. Those are collected outside the platform, and we record your name and country against the payout for tax and accounting purposes.

• To run the service: authentication, access control, DRM key delivery, transactional emails.
• To enforce entitlement rules (event windows, per-device caps).
• To bill organizers for the event plans they buy.
• To keep your wallet honest, to deliver what you bought, and to handle refunds and chargebacks. Keeping records of the sales themselves is also a legal accounting obligation, not only a product choice.
• To work out when a Marketplace rental started and whether it was used as one rental, and to detect fraud and abuse against Credits, rentals, reviews and creator earnings.
• To pay creators, and to keep the records a tax authority may ask for about those payments.
• To debug failures. Cloud Functions logs may contain user IDs and event IDs but never roadbook contents or passwords.

We do not sell, rent, or trade your data. We do not embed third-party advertising tracking. We do not run general-purpose analytics tracking like Google Analytics on rallybook.app.

• Google Firebase / Google Cloud: hosts our Firestore database, Cloud Storage, Cloud Functions, and Auth. Region: europe-west1 (Belgium). Google's data-processing terms govern.
• Apple: when you sign in with Apple, Apple authenticates you and shares your email (or a relay address) and display name with us. Apple also sells Credits and RallyBook Pro on the App Store and passes us the purchase records for them.
• Google: when you sign in with Google, Google shares your email and display name with us. Google Play also sells Credits and RallyBook Pro and passes us the purchase records for them.
• Event organizers: when you join an event, the organizer sees your display name, email, device code, and country flag in their participants list.
• Stripe: processes organizer payments for event plans. Stripe receives the organizer's billing details, not rider data.
• Other RallyBook users: a review you publish is public, and carries your display name. A creator whose roadbook you rented sees that a rental happened and its value, but not your identity.

All storage and processing happens in the European Union (Google Cloud's europe-west1 region, Belgium). If you sign in with Apple or Google from another region, those identity providers may briefly process your authentication request in their own regions per their respective privacy policies.

• Active accounts and their data: for as long as your account exists.
• Entitlements and event history: retained after the event ends as a personal history (shown as "Ended" cards in the library) so you can see what you've done. Destroyed with your account.
• Encrypted roadbook files: deleted when the producer deletes the roadbook or the parent event.
• Your wallet and its ledger: for as long as your account exists. Both are destroyed with it.
• Marketplace sale records, store receipt records, and creator earnings and payout records: kept for as long as accounting and tax law requires, which outlives your account. See the next section.
• Cloud Functions logs: retained for 30 days per Google's defaults.

Deleting your account is not the same thing as erasing every trace of you, and we would rather be plain about that than let you find out later.

Destroyed: your profile, your email and display name, your country flag, your device fingerprints, your entitlements, your event history and roster rows, your ride sessions along with the journals uploaded from them, and your access to anything you hold. Your wallet and its whole ledger go too, so any Credits left in it are lost. They are not refunded and not paid out.

Kept: the record of any Marketplace sale you were a party to; the store receipt records that tie a store transaction to one account, so that a receipt cannot later be redeemed a second time; your creator earnings ledger, flagged as belonging to a deleted account, with the euro amounts intact; and any reviews you published. These survive because they are accounting, anti-fraud and legal records, not because they are useful to us. They are no longer attached to a live account or to your name and email, and what is left is a record that a transaction happened, for how much, and when. Published reviews stay up under the display name they were published with.

If you are a creator with earnings still owed to you, the app will refuse to delete the account until that money is settled. We would rather stop you than quietly keep it. If you want a review taken down, delete the review before deleting the account, or ask us.

You have the right to access, correct, export, or delete your personal data. Email hello@rallybook.app with your request and we'll respond within 30 days. For account deletion you don't need to email us: tap "Delete Account" on the account screen in the iOS or Android app, or use the account deletion page on this site.

The right to erasure has limits, and financial records are the main one here. Where the law requires us to keep an accounting record, we keep it and pseudonymise it rather than delete it. The section above sets out exactly which records those are.

The rallybook.app website uses a small number of first-party cookies / browser storage entries:

• Authentication: Firebase Auth stores your session token so you don't have to sign in again on every visit. Strictly necessary; not optional.
• Cookie banner choice: your accept / reject choice on the consent banner is stored in localStorage so we don't ask again.

No analytics or advertising cookies are set today.

RallyBook is not aimed at children under 16. If you believe a child has created an account, email us and we'll delete it.

We'll post a revision date at the top whenever we change this policy. Material changes that affect how we use your data will be announced by email and in the app at least 30 days before they take effect.

Privacy questions, deletion requests, or general feedback: hello@rallybook.app.