Privacy Policy

Rally is a padel tournament app run by Peak IT, based in South Australia, Australia. In this policy “Rally”, “we” and “us” mean Peak IT. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Questions or requests about your information go to hello@peakit.au.

• You sign in with your email and a six-digit code. There are no passwords.
• We collect what Rally needs to run tournaments: your name, your email, the events you join and your results.
• No advertising, no analytics or tracking tools, and we never sell your information.
• Your profile and rating are public unless you hide them on You. Your email is never shown to other players.
• Card payments are handled by Stripe. Card details never reach Rally.

Your account

• Your email address, to send you sign-in codes and to recognise you on any device you sign in on.
• Your name, as you type it, so other players know who they're playing. You can change it on You.
• An avatar colour, picked from your name, and a random profile address (like /p/3f9c…) for your public profile.
• Sign-in codes, stored scrambled (hashed). Each works once, for 10 minutes.

Signed-in devices

Each device you sign in on gets a session. For each one we keep when it started and was last used, its IP address and its browser's user agent (which says, for example, “iPhone, Safari”). We use this to keep you signed in, to show you your devices on You so you can sign them out, and to protect your account.

Passkeys

If you add a passkey (Face ID, a fingerprint or a security key), we store its public key, an identifier for it, a name for it and the kind of device it's on. Your fingerprint or face never leaves your device and we never see it.

Notifications

If you turn on notifications on a device, we store the address your browser gives us for delivering them, the keys that encrypt them for your browser, and its user agent. They belong to that signed-in device: signing it out removes them. We also keep a record of what we notified you about, so you never get the same news twice, and of the tournaments and ladders you muted.

Playing and organising

The tournaments, leagues and ladders you create or join, your registrations, teams and roles, the scores you enter or confirm (and any reason given for a disputed score or a walkover), your Rally rating and how each rated match changed it, and the matches you agree to play on a ladder. This is what Rally is for: making schedules, keeping standings and showing you when and where to play.

Names that organisers add

Organisers can add players by name, one at a time or from a pasted list or spreadsheet. We keep only the names: any other columns in a list, such as emails or phone numbers, are ignored, and Rally never contacts people added this way. If an organiser allows it, a player can also join with just their name. A player added or joined by name can later claim their place with a claim link and their email, which links those results to their account.

Clubs

When you create or edit a club, we store the details you give for its public page: its name, address, courts, and its contact email, phone and website if you add them. We also record who its owners and staff are and every change made to it. To verify a club, Rally admins see its owners' names and sign-in emails so they can contact them. If you report a club, we keep your report and who made it; only Rally admins see it.

“Clubs near me”

Only when you tap “Clubs near me”, your browser asks whether to share your location. If you agree, your device rounds it to about a kilometre and sends that to our server in the page address, only to sort clubs by distance. We don't save it to your account or our database, and we don't send it to our maps provider. Like any page address, it can appear in your browser history and briefly in our web server's logs.

Entry fees and payments

• When you pay an entry fee online, you enter your card details on Stripe's secure page. They go straight to Stripe and never reach Rally. We give Stripe your email for the receipt.
• We keep payment records: the amount, currency and how it was paid (cash, bank transfer, card or credit), who recorded it, Stripe's reference numbers, and any refund with its reason. These records are never edited afterwards, so the money always adds up.
• Organisers and clubs who take payments online connect their own Stripe account and give their details to Stripe directly. We store only the Stripe account's reference and whether it's ready to take payments.
• Credit that an organiser gives you is kept as a history of what was given, spent, given back or taken back, with the organiser's note.

Activity history

Each tournament, league, ladder and club keeps a log of what changed and who changed it (for example “Priya marked Sam paid”), so organisers can see what happened and sort out disagreements. We also keep a log of changes to your account, such as claiming a place or hiding your profile.

Protecting Rally from abuse

To stop floods of sign-in attempts, we count requests to the sign-in service by IP address and store those counts in our database. Some other limits (such as how many codes one email address can ask for) are counted briefly in our server's memory and not stored.

• Public tournaments, leagues and ladders are listed on Discover. Anyone can see their details, the players' names, the schedule, scores and standings.
• Private ones are never listed. Anyone who has their link, an invitation or the QR code can see them, so share the link only with the people you mean to.
• Your profile shows your name, avatar colour, Rally rating, record and the public tournaments you played. A private tournament only ever adds to a count there, never its name. You can hide your profile on You: then nobody else can open it, you leave every leaderboard, and tournament pages show your name without a rating.
• Club pages are public, with the details the club gave, and list only the club's public events.
• Your email is never shown to other players or to organisers in Rally. The exceptions: Rally admins see club owners' emails to verify clubs, and when you pay online, the organiser or club receives your payment (including the email given for the receipt) in their own Stripe account.
• Payments. Organisers see who has paid in their own tournaments. Players see only their own payment status.
• At the venue. Organisers can show the schedule and scores on a screen, print court sheets and standings, and download results as a spreadsheet. These show players' names and results, never emails or payments.

We use a few service providers to run Rally. They handle your information only to provide their service to us. We never sell your information, and we don't share it with advertisers.

• BinaryLane (Australia) hosts Rally's servers and database.
• Resend (a US company, sending from its Tokyo, Japan region) delivers our emails: your sign-in codes, and notices to club owners about their club. It receives your email address and the message.
• Stripe processes online payments and the organisers' and clubs' payment accounts. Stripe may process information in Australia, the United States and other countries.
• Geoapify (Germany) places club addresses on a map and draws the club page's map. It receives a club's address and its map position, and nothing about you or other visitors. “Directions” on a club page opens your own maps app, only when you tap it.
• Your browser's push service (run by Google, Apple, Mozilla or Microsoft, depending on your browser) delivers notifications if you turn them on. Notifications are encrypted so that only your browser can read them.
• Better Stack checks that Rally is up by visiting a public page. It sees no personal information.

This means some of your information is sent overseas, including to the United States, Japan and Germany, and wherever Stripe and the push services operate. We choose providers that protect information to a standard similar to Australian law.

Beyond that, we share information only as this policy describes (for example, with the organisers of events you join), when you ask us to, or when the law requires it.

Rally uses only what it needs to work:

• A sign-in cookie that keeps this device signed in. It lasts until you sign out, or six months after you last used Rally.
• A short-lived cookie while you use a passkey, to check the sign-in really came from your device.
• A “joined by name” cookie, only if you join a tournament with just your name, so this device can claim that place later. It lasts 30 days.
• Your light or dark theme, and whether you said “Not now” to notifications, are kept in your browser's storage and never sent to us.

Rally has no analytics, advertising or tracking cookies, and loads no third-party tracking scripts.

• Your account and what's linked to it are kept while you have an account.
• Sign-in codes work for 10 minutes and only once.
• A signed-in device is kept until you sign it out, or until it hasn't been used for six months.
• Notification subscriptions are kept until you turn notifications off, sign that device out, or your browser's push service tells us the subscription has ended.
• Tournaments, results, ratings and activity logs are kept so standings, ratings and history stay correct for everyone who played.
• Payment and credit records are kept so the money always adds up, and for as long as the law requires us to keep financial records.
• Sign-in request counts by IP address are not linked to your account. They aren't yet cleared automatically.

You can do these yourself on You:

• change your name
• hide or share your profile and rating
• see your signed-in devices and sign them out, and remove passkeys
• turn notifications on or off for a device, and mute a tournament or ladder

You can also withdraw from a tournament, and club staff can leave a club. To see the personal information we hold about you, correct it, or have your account deleted, email hello@peakit.au from the address you sign in with. There's no “delete my account” button yet, so we handle deletion by email. We'll reply within 30 days.

When we delete an account, results in tournaments you played stay under the name you played with, so other players' standings stay correct, but they're no longer linked to you. We may need to keep payment records, and we'll tell you what we keep and why.

Rally accounts are for people aged 16 and over. Younger players can still play: an organiser can add them by name, without an account or email.

Organisers who add players under 18 should have a parent's or guardian's agreement, use only as much of the name as they need (a first name and initial is often enough), and keep junior events private. If we learn that someone under 16 has an account, we'll delete it. Parents and guardians can ask us to remove a child's name at hello@peakit.au.

Rally is served only over encrypted connections. There are no passwords to leak: sign-in codes are stored hashed and expire quickly, and you can sign out any device at once. Card details are handled by Stripe, never by Rally. No system is perfectly secure, but if a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the law requires.

If you have a question or a complaint about how we handle your information, email hello@peakit.au. We'll reply within 30 days.

If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

If Rally starts collecting or sharing something new, we'll update this policy and the date at the top. If a change matters to how your information is used, we'll let you know before it takes effect, for example by email. Our Terms of Use explain the rules for using Rally.