Privacy policy

Account and player information

We store your authentication email and account identifier, name, and the profile information you provide: skill level, playing preferences, time zone, city, favorite courts, and optional scheduling link, contact email and phone number. If you sign in through Apple or Google, our authentication provider receives the identity information returned by that provider, which may include your email, name and profile-photo URL. RallyUp does not currently offer photo uploads.

Player names and skill information help people judge games and identify participants. Optional contact email and phone number are shown to other players only when you enable their sharing settings. Your authentication email is separate from your public contact email.

Games, groups and messages

We store games, courts, schedules, availability and join responses, invitations, group names and descriptions, memberships, chat and player announcements, match results and ladder history. Public games are discoverable by other players; group and game content is shared with people who have access. Information you put into messages or game notes is visible to those readers.

For guest game invitations, we store the guest name, optional email address, invitation status and availability. A guest name and chat are shared with people who can access that game. Invitation emails include the organizer name, game details and invitation link; a guest email address is not shown as public game information.

If you block or report someone, we store the account IDs involved, the report reason and any details you choose to provide so we can apply blocks and review reports.

Location and place searches

You can choose a city manually. With your permission, your browser or device can supply precise coordinates to help find your city and nearby courts or games. Coordinates can be sent to RallyUp and Geoapify to resolve places and search for courts. Search text, place identifiers and language may also be sent to Geoapify. We store selected city coordinates and favorite or game courts; this is not continuous background location tracking. Hosting infrastructure can infer a country from your IP address.

Notifications and local storage

We store notification preferences, delivery records and, when you enable mobile push, device tokens and installation identifiers. Google Firebase and Apple's push service deliver mobile notifications. You can change notification preferences in RallyUp or disable push in your device settings. Your device also stores sign-in cookies and application caches. Signing out clears account-scoped application caches.

Diagnostics and performance

When enabled, Sentry and Google Firebase help identify errors, crashes and performance problems. Vercel Speed Insights measures browser performance. Application-generated diagnostic payloads are limited to technical details such as platform, app version, generalized routes, error categories and timings; application filters exclude chat content, account identifiers, credentials and tennis records from those payloads. These providers may also collect technical information through their software. Session replay is disabled.

Service infrastructure may separately process IP addresses, request metadata, authentication events and security logs. Those operational records are distinct from filtered app diagnostics.

How we use data and service providers

We use information to run accounts, find suitable games, coordinate play, maintain groups and rankings, send service messages, secure the service and diagnose problems. We do not sell personal information or use it for advertising.

Providers include Supabase for authentication, database and realtime services; Vercel for hosting and browser performance; Geoapify for place services; Sentry and Google Firebase for diagnostics and mobile push; Apple for sign-in and push; and Resend for service email delivery. Google also processes information when you choose Google sign-in. Providers process information needed for their services and may operate outside your country.

When automated-abuse checks are enabled, Cloudflare Turnstile processes browser and network signals to verify a request. RallyUp evaluates hosting-provided country and IP information against security rules. We keep short-lived verification and action records tied to your account and session, and rolling join counts to limit misuse. Our application logs do not include verification tokens or raw IP addresses. A country signal alone does not suspend your account. Contact us if you need help with a restriction.

Deleting your account and retention

Delete your RallyUp account on the web, or choose Delete account in the app's profile menu. A recent sign-in and confirmation are required. You do not need to send an email or reinstall the app.

Successful deletion removes your account, profile, contact details, preferences, memberships, authored messages, account invitations and push registrations from the live service. It also removes guest invitation records claimed by your account, including their stored guest names, email addresses, availability and plan confirmations. Games and matches you created and their associated content are deleted. Guest invitation records that have not been claimed by an account can remain with the game after their link expires; contact us for assistance with those records. Other members' groups remain: ownership passes to another member where possible, your authorship is removed, and names and descriptions of groups you created are cleared. Empty owned groups are archived. Apple authorization is revoked before deleting Apple-linked accounts.

Blocks are removed when you unblock someone or either account is deleted. Reports you submitted are removed when your account is deleted; reports about a deleted account may remain without that account ID.

Other players' games, results and messages may remain without your account participation; games and matches already underway that you are playing in are canceled. Deletion cannot recall content already copied by others or delivered by email or push. Unlinked installation records remain to prevent stale push registrations. Backups and provider security or diagnostic logs are not immediately erased by account deletion; retention depends on the provider and its configured settings. Contact us for details about retained information.

Live account deletion completes when the app confirms success. If confirmation does not appear, sign in again to check your account before retrying. We do not promise immediate deletion from backups or third-party systems.

Your choices and contact

You can edit your profile, change contact sharing, select a city without device location, change notification preferences, or delete your account. For access, correction, deletion assistance or privacy questions, contact hello@rallyup.gg.