Privacy at Rally.

Who looks after your information

Ask your coach for the business’s privacy contact while this notice is being completed.

What Rally keeps

Player names, ages, coaching groups, a parent contact email, optional profile photos, lesson notes, ratings, progress, achievements and term reports. We use these records to provide coaching updates and manage access. Keep health, safeguarding and other sensitive details out of routine lesson notes and voice recaps.

Parent accounts can see only linked children. The owner and invited coaches can see all club players. Coaches review AI drafts before anything is shared with parents.

Voice notes and service providers

Recording and offline drafts are saved on the coach’s iPhone. When the coach requests cloud transcription or sorting, the recording or recap and attending player names go through Cloudflare to the OpenAI API. Cloudflare does not store uploaded audio; temporary processing results are removed after approximately 24–25 hours. OpenAI’s endpoint-specific retention and any international transfers must be covered by the club’s processor arrangements.

Rally requests that generated responses are not stored as application state by OpenAI. This does not disable all provider security or abuse-monitoring retention. The API provider does not use API inputs for training by default.

Security and sign-in

Connections use HTTPS. Cloudflare encrypts database and photo storage at rest. Passkey private keys remain with your device or password manager. Rally receives a public key and sign-in proof, never your fingerprint or face scan. Essential session cookies keep you signed in; Rally does not add advertising or analytics cookies.

Coaching records are not end-to-end encrypted: authorised services must read them to show progress and process requested feedback.

Why we use your information

The club owner must document the applicable lawful basis and explain it here before publishing the notice.

How long records are kept

The club’s retention policy is awaiting confirmation. Coaching records are not currently removed automatically after a term ends.

Security audit entries are kept for 180 days. Closed privacy requests are retained for 12 months. Device copies, downloaded exports and historical backups need separate review when handling deletion requests.

International transfers

The club owner must verify processor contracts and any international-transfer safeguards. The current service does not promise UK-only or EU-only processing.

Your choices and rights

You can ask for access, corrections, deletion, restriction of processing or object to the use of your information. These rights depend on the circumstances and applicable lawful basis. Parents can download their portal records and submit a request from Privacy & records. The club must consider a child’s own rights when handling a parent’s request.

You can also raise a concern with the Information Commissioner’s Office.