Privacy notice

Last updated October 5, 2026. This notice explains what Rally collects when you use it, why, who can see it, and the choices you have.

Who we are

Rally, operated by Daniel Xavier B. Legaspi is a community website for finding and hosting recreational sports games in Metro Manila, Philippines. For this notice, we are the personal information controller for the data described below. Questions and requests go to daxalegaspi@gmail.com.

What we collect

Sign-in details. When you sign in with Google, we receive your name, email address, and account ID from Google. Your email is used for sign-in and, once email updates are on, to send you game updates. It is never shown to other players.
Your profile. Display name, a photo if you add one, home area (city level only), short bio, avatar color, sports and self-reported levels, and when you agreed to the Terms.
What you do on Rally. Games you host or join, waitlist positions, check-ins, attendance and late cancels, fees a host marks as paid, match scores and corrections, chat messages, reports you file, and players you block.
Counts shown on profiles. Games played, games hosted, no-shows, match record, and show rate, worked out from the activity above.
Technical data. Cloudflare Turnstile checks that a real person is signing up or publishing; it looks at browser signals and does not use cookies to track you across sites. Our hosting provider keeps short-lived server logs, such as IP addresses, for security and troubleshooting.
On your device. We store your sign-in session and your theme choice in your browser. If ads from Google are switched on, Google may use cookies; see Ads below.

We don't collect your exact location, phone contacts, payment details, or government ID. Rally never handles money.

Why we use it

To run your account and show your profile (needed to provide the service you signed up for).
To run games: rosters, waitlists, reminders, chat, scores, and attendance (same reason).
To keep Rally safe: bot checks, rate limits, reports, blocks, and suspensions (our legitimate interest in a safe community, and to meet legal obligations).
To send you notifications about games you joined or host. You can turn email updates off.
To understand, in aggregate, whether Rally is working, for example how many games are published each week. We do not put names, emails, or message text into analytics.

Who can see it

Everyone, including visitors: your name, avatar, area, bio, sports and levels, games you host publicly, and the counts on your profile.
Players in the same game: the roster with names and levels. Chat is visible only to the host and to confirmed and waitlisted players of that game.
The host of a game you join: check-in, attendance, and whether you paid.
Rally moderators: reports and the content they point to.

Service providers

These companies process data for us under their own security and privacy terms. Some of them store data outside the Philippines, which the Data Privacy Act allows when the data stays protected.

Google Firebase for sign-in and the database (data stored in Singapore).
Vercel to host and serve the website.
Cloudflare for the bot check, network protection, and, once photo uploads are on, storing profile photos and club logos.
Google (Gmail) to send email updates, once they are switched on.
Google AdSense for the banner ad, once it is switched on.

We don't sell personal data, and we don't share it with anyone else unless the law requires it.

Rally is free because of one banner at the top of the page. Today it shows sponsors we place directly, without tracking. If we switch to Google AdSense, Google may use cookies to show and measure ads; you can manage this at Google Ad Settings. We will update this notice before that happens.

How long we keep it

Your profile stays until you delete it.
Games, rosters, scores, and chat stay with the game so its history makes sense to the other players. Chats close to new messages 7 days after a game ends.
When you delete your profile, you leave your upcoming games, your profile is removed, and your past messages show as from a former player. Your Google sign-in link stays so you can come back; email us to have it removed too.
Reports are kept as long as needed to handle them and to deal with repeat abuse.

Your rights

Under the Data Privacy Act you have the right to be informed, to access your data, to object, to have it corrected, to have it erased or blocked, to get a copy in a portable format, and to claim damages. Email daxalegaspi@gmail.com and we will reply within 15 days. You can edit or delete your profile any time from your profile. If you are not satisfied with our answer, you can complain to the National Privacy Commission.

Security

Browsers can only read data; every change goes through our server, which checks who you are and what you are allowed to do. Data is encrypted in transit. No system is perfect, so if we ever learn of a breach that puts you at risk, we will tell you and the National Privacy Commission as the law requires.

Younger players

Rally is open to players of every age. If you are under 18, please use Rally with a parent's or guardian's permission. A parent or guardian can ask us to see, correct, or delete a young player's data by emailing daxalegaspi@gmail.com.

Changes

If we change this notice in a way that matters, we will update the date at the top and tell signed-in players in the app before the change takes effect.

See also the Terms and the Community rules.