Legal

Privacy Policy

Effective date: September 23, 2026

Address: Tagbilaran City, Bohol

Privacy contact or Data Protection Officer: privacypolicy@rallyque.com

1. What this policy covers

This policy explains how RallyQ handles personal information when you browse courts, create an account, connect with players, join or organize games, submit venue information, or contact us.

The legal operator identified above is responsible for the information it controls. Venues and other services may separately control information you give them for their own activities. Their privacy notices apply to those separate uses.

2. Information we handle

Depending on the features you use, we handle:

Account information: name, email address, account identifier, authentication records, and any phone number or profile image you provide. If you use a supported Google sign-in flow, we receive the profile and account information authorized through that flow; we do not receive your Google password.

Player information: skill level, optional DUPR rating, city or province, playing preferences, availability, travel radius, budget preferences, saved venues, and privacy settings.

Games and bookings: invitations, participant or guest entries, game and court details, booking references, booking status, attendance records, cancellations, and recorded payment status or method.

Communications: game messages, support requests, issue reports, and related correspondence. Messages are stored to provide the conversation feature; do not assume they are end-to-end encrypted.

Venue information: representative contact details, application information, venue address or coordinates, court photos, hours, amenities, and information needed to manage listings and bookings.

Device location: coordinates supplied when you choose a location feature and grant device or browser permission. You can decline this permission and use available manual browsing tools.

Notifications: notification preferences and, if you enable push notifications, a device/browser subscription endpoint and related technical identifiers or delivery records.

Technical information: IP address, browser and device information, page or feature interactions, error information, and service logs, depending on the services enabled. If session replay is enabled, this may include a reconstruction of interactions with the website, subject to the implemented masking and exclusions.

We obtain information from you, your use of the service, supported sign-in providers, and other users such as an organizer who invites you or records attendance. If you add someone as a guest, tell them about RallyQ and this policy, provide only necessary information, and have a valid basis to share it.

Do not send us unnecessary government identifiers, medical records, or complete payment credentials. If a future feature requires sensitive information, we will explain its purpose and applicable basis before collecting it.

3. Why we use information

We use relevant information to create and secure accounts; provide player and court discovery; coordinate invitations, games, bookings, and conversations; send service updates; assist venues; respond to support requests; investigate abuse; and maintain service performance.

For ordinary personal information, the relevant basis may be performance of our agreement with you, compliance with a legal obligation, consent, or a legitimate interest such as security and service reliability, after considering its impact on you. Optional uses require their own valid basis; acceptance of the Terms does not authorize every kind of processing. Sensitive personal information, if collected, requires an applicable basis under the stricter rules governing it.

Confirm and document the actual basis for discovery, attendance-based scoring, analytics, session replay, and any marketing before publishing.

4. Profiles, discovery, and game participation

Your profile settings affect what other users can see. The available controls include profile visibility and whether to show certain skill, rating, reliability, and location information. Review the choices shown in your account.

Information you make public may be seen and copied by others. Joining a game or booking a court can require sharing relevant participant and booking information with the organizer, other participants, or the venue, even if your general profile is not publicly discoverable.

Visibility controls do not hide records from personnel who require authorized access for support, security, or legal obligations. Turning off discovery does not remove messages or participation records already shared with a group.

Verify these controls across public pages, authenticated pages, APIs, exports, and database policies. Describe any exceptions before publication.

5. Suggestions, ratings, and attendance information

Discovery and team-planning features may use supplied skill levels, preferences, availability, location information, and participation records to suggest relevant players, games, or groups. These indicators can be incomplete or inaccurate and do not guarantee a good match or a fair game.

If information about your rating or attendance is wrong, contact [PRIVACY OR SUPPORT EMAIL] to request correction or review. Confirm whether any automated score affects joining, visibility, penalties, or account access, and disclose its actual consequences and review process here.

6. Who receives information

We share information where necessary with:

Players and organizers: the information needed for the discovery settings and game interactions you choose.

Venues: the information needed to handle a booking or session, subject to the applicable arrangements.

Service providers: providers of authentication, databases, hosting, image storage, maps, monitoring, email delivery, and browser or device push delivery.

Authorized personnel: people handling support, operations, security, or compliance, with access appropriate to their responsibilities.

Authorities and professional advisers: where required by law or reasonably necessary for a lawful investigation, legal claim, or protection of rights, with appropriate limits.

If the business is reorganized or transferred, personal information may be transferred only with an applicable legal basis and safeguards, and with notice or consent where required.

The supplied implementation references Supabase for authentication and data services, Cloudinary for media, Mapbox for maps, Datadog for monitoring, and Google for supported sign-in. Verify active providers, their roles, hosting/email/push providers, processing locations, and contractual safeguards; remove unused services and add missing ones.

State the verified position on sale of data and advertising sharing before publication.

7. Cookies, local storage, analytics, and session replay

RallyQ and its providers use browser storage and similar technologies to maintain sign-in sessions, support service functions, and remember relevant settings. Blocking necessary storage may prevent some features from working.

If enabled, analytics and session replay help diagnose problems and understand how features are used. Session replay reconstructs website interactions; it is not a camera or microphone recording. Masking settings reduce some collection but must not be treated as a guarantee that every displayed personal detail is excluded.

Before publication: specify active technologies, providers, purposes, identifiers, storage lifetimes, and the exact choice mechanism. The inspected Datadog initializer does not demonstrate a tracking-consent gate.

Where we rely on consent for optional tracking, we will not activate it before that consent and will provide a way to withdraw it through [ACTUAL PRIVACY-CHOICE CONTROL].

8. Location and notifications

Location permission is separate from your general account settings. You can revoke it through your browser or device. The reviewed location hook requests a current position; this does not by itself establish the retention or downstream sharing of coordinates.

State the confirmed retention and recipients for player device coordinates; distinguish them from published venue coordinates.

Push permission is optional and can be withdrawn in browser/device settings or through the available app controls. Notification previews may appear on your lock screen according to your device settings. Service messages such as account or booking updates are separate from promotional marketing.

9. International processing

Some providers may process information outside the Philippines. We remain accountable for transfers we control and use appropriate contractual and other safeguards required by applicable law.

Insert the verified countries or regions and relevant safeguards; do not infer them solely from default source-code settings.

10. How long we keep information

We keep information only for the purposes explained here and for justified legal, accounting, security, or dispute-handling needs. When those needs end, we delete or appropriately de-identify it. Account closure does not necessarily remove every record immediately.

CategoryRetention rule to publish

Account and player profileWhile the account is active, then [PERIOD] after closure, subject to specified lawful exceptions.

Invitations, games, bookings, and attendance[PERIOD OR CLEAR END CONDITION], with any legally required transaction records handled separately.

Messages and support reports[PERIOD OR END CONDITION], including rules for shared conversation history.

Financial or tax records, where applicable[APPLICABLE REQUIREMENT AND PERIOD CONFIRMED WITH ADVISER].

Security and operational logs[PERIOD].

Analytics and session replay[ACTUAL PROVIDER RETENTION].

Push subscriptions and delivery records[PERIOD/EXPIRY RULE]; confirm active cleanup jobs.

Player device coordinates[SESSION-ONLY OR ACTUAL RETENTION AND PURPOSE].

Backups and media copies[ROTATION/DELETION PERIOD AND ACCESS RESTRICTIONS].

If a legal hold applies, we retain the necessary records for that hold and limit their use accordingly.

11. Your rights and choices

Subject to applicable conditions, you may request information about our processing, access to your information, correction of inaccurate records, objection to processing, blocking or deletion, and portability of eligible electronic data. You may withdraw consent for consent-based processing without affecting the lawfulness of earlier processing. You may also seek remedies available under law.

Send requests to privacypolicy@rallyque.com.

You can request account closure through privacypolicy@rallyque.com. Deleting an app shortcut or signing out does not delete your account.

You may complain to the Philippine National Privacy Commission. Information about your rights and complaint options is available on the National Privacy Commission website.

12. Security

We apply safeguards appropriate to the information and risks involved.

No online service can promise absolute security. Report suspected misuse to support@rallyque.com. If an incident requires notification under applicable law, we will notify the relevant authority and affected people as required.

13. Children and young people

This section assumes the proposed 18+ account policy has been adopted and enforced.

RallyQ accounts are intended for adults aged 18 and over. We do not intentionally invite children to create accounts. If you believe a child's information has been provided, contact [PRIVACY EMAIL] so we can assess the situation and take appropriate action.

If youth participation or guest entries for minors will be supported, a separate, reviewed notice and lawful participation process are required before this draft can describe that feature accurately.

14. Changes and contact

We will update this policy when our practices change, show a new effective date, and give appropriate notice of material changes. We will obtain additional consent where required before starting a new consent-based use.

For questions or privacy requests, contact privacypolicy@rallyque.com.