Privacy Policy

1. Who we are and what this covers

Keegan Thompson, based in Tennessee, United States, operates Rally at rallyplans.com. This policy explains the personal information we collect through Rally’s website, accounts, planning tools and related services, why we use it, who receives it, and the choices available to you.

It covers Rally’s handling of information. An outside venue, supplier, email provider or tool may also handle information under its own policies. Our contact details appear at the end of this page.

2. Information we collect

Account and sign-in information

Your name, email address, account identifier, verification status, sign-in and session records, and technical metadata such as IP address and browser information. Live Rally accounts sign in through an email link.

Plans and participation

Activity and plan details, options, invitations, membership, proposals, agreed participants and terms, approvals, cancellations, attendance and associated activity records. Other participants or a supplier may provide shared records that relate to you.

Private preferences

The budget, availability and venue limits you submit. These are used to find compatible options. Do not use open text fields to submit health records, government identification numbers, financial credentials or other sensitive information that Rally does not need.

Supplier information

Supplier ownership, offers, availability, booking or cancellation evidence and external references.

Agent access

If API-key access is enabled, we process the agent name, requested and approved permissions, registration proof hash, approval state, and key creation, expiry and revocation records. Rally stores a hash of each API key, not its recoverable secret. An agent can submit the name and email you supply to start account setup; email verification and your separate permission approval are required before it gains access. An existing profile is reused without replacing its details.

Website and technical information

Page analytics, request and error metadata, security counters, and hosting logs. The analytics details and exclusions are explained below.

Communications

The information you provide when you contact us, including your contact details and the contents of your request.

We do not collect payment-card details through Rally or verify payments made outside the Service. Rally does not request precise device location, contacts, microphone or camera access for its current planning features.

3. How we use information

• Create and authenticate accounts, send requested sign-in emails, and manage sessions.
• Coordinate plans, compare submitted preferences, show shared progress and record each participant’s decisions.
• Deliver supplier requests, record outcomes and maintain an accurate history of commitments.
• Prevent abuse, protect accounts, diagnose failures and recover the Service.
• Understand website usage and improve the product.
• Respond to requests, comply with applicable law, and establish, exercise or defend legal claims.

Matching uses the preferences and options supplied to Rally. It does not approve a proposal for you. Every participant must review and approve the exact shared terms independently.

4. Who can see information

Other participants

Plan members can see shared plan details, participant names, proposals and terms, approval and attendance information, and aggregate readiness. Rally does not expose your private budget, availability or venue limits to other participants. Shared outcomes may still allow someone to infer a preference.

Suppliers

For supplier-backed plans, the supplier receives the accepted booking details and relevant operational records. Rally’s supplier payloads do not include your private limits or participant email addresses. Information you independently send or pay to a supplier is outside this boundary.

Service providers

Railway hosts Rally’s application, databases, backups, logs and self-hosted analytics. Resend processes recipient email addresses, sign-in email content and delivery information to send requested account emails. Our support email provider processes correspondence you send to the contact address below. Providers process information as needed to deliver their services and meet their own legal and security obligations.

Authorized tools

An agent with your API key can receive your profile, plans and your own private preferences within the permissions you approve. Additional permissions can allow drafting, confirmation after independent participant approval, or cancellation. Each participant must approve their own participation in Rally’s signed-in browser flow; an API key cannot give that approval. Store it in your agent’s secure credential store, not chat. The agent provider’s handling of information and copies is subject to its own practices. Revoke a key from Rally’s API keys page to stop future access; signing out of the dashboard leaves keys active.

Legal and business circumstances

We may disclose information when reasonably necessary to comply with law or valid legal process, protect people and the Service, or resolve a dispute. If Rally is involved in a business transfer, relevant information may transfer subject to applicable law and notice requirements.

We do not sell personal information, share it for cross-context behavioral advertising, or run targeted advertising on Rally. We do not use advertising pixels or session replay.

5. Cookies and page analytics

Rally uses first-party cookies needed to authenticate you and maintain your session. Blocking these cookies may prevent sign-in or account features from working. Sessions normally expire after seven days and can renew while you use Rally. Sign out to end your current session.

We use self-hosted Umami for page analytics. Rally sends a generic page category, the site hostname, an external referring site’s origin, browser language and screen size. The network request also exposes your IP address and browser metadata to the analytics host. Umami uses request metadata to estimate visits, devices and approximate geography. It does not identify those visits by your Rally account.

We exclude names, email addresses, account identifiers, plan names, private preferences, form values, sign-in and invitation tokens, URL query strings and fragments. Plan pages use generic categories rather than plan identifiers. Verification and connection pages are excluded. We do not track individual clicks or load a third-party analytics script.

The analytics collector does not set analytics cookies or store an analytics identifier in your browser. Cookie-free does not mean the network request contains no personal information. Rally suppresses page analytics when your browser sends Do Not Track with the value “1” or “yes.” We do not enable third-party advertising trackers to follow you across websites.

6. How long information stays

Retention depends on the information and its purpose. These are the current product rules, not a promise that every provider or backup copy disappears on the same date.

Account information

We keep your direct profile and sign-in records while your account remains open. Account closure removes or replaces direct profile identifiers and revokes sessions and credentials as described below.

Expired access records

Expired sessions, verification records, invitations, approval challenges and temporary abuse counters become eligible for routine cleanup after expiry.

Agent registrations and keys

Registrations expire after ten minutes. Keys expire after one hour, one day or seven days, as selected. New registrations and dashboard key creation trigger bounded cleanup of expired registrations and key records whose expiry was more than 30 days ago. Expired or revoked keys cannot access Rally even while their records remain. Account closure removes owned key and registration records.

Saved action responses

Copies of responses saved to make retries safe become eligible for erasure after seven days. Request fingerprints remain so an old action cannot be replayed as new.

Private planning preferences

Private limits become eligible for deletion 30 days after the plan is completed or cancelled, or are deleted when their owner’s account closes.

Shared plan and safety records

Membership, agreed terms and participant rosters, approvals, attendance, booking evidence, audit history and request fingerprints currently have no automatic expiry. They remain after closure to preserve shared commitments, resolve disputes and prevent replay. This can include names previously recorded in shared terms. Requests concerning these records are reviewed under applicable law.

Analytics

Analytics records currently have no automatic expiry and remain until deleted by an operator. They are not linked to Rally account identifiers, so closing an account does not remove corresponding analytics records.

Provider records and backups

Hosting logs, email delivery records and backups follow separate provider retention and recovery processes. They are not erased by the account-closure operation and can outlast the live records. Access is restricted; backups are used for recovery.

Support and legal records

We retain correspondence as needed to resolve your request, maintain a record of its handling, meet applicable obligations or handle a dispute.

Automatic cleanup runs in batches. Backlogs, outages or locked records can delay deletion beyond the eligibility periods above. Information may also be preserved where required by law. We do not describe retained shared history or backups as fully anonymous.

7. Closing your account

In Account settings, you can review closure blockers and request closure after a recent sign-in. Active plans and unresolved supplier commitments must be resolved before the self-service flow can proceed. Contact us if you need help or want to make a privacy request outside that flow.

Closure replaces your direct account name and email, deletes sign-in credentials and sessions, removes your private limits and approval challenges, and erases saved action responses owned by your account. It also revokes your Rally connections. It does not erase shared historical records, other participants’ copies, outside supplier or email records, analytics, logs or backups.

Registering again creates a new account and does not restore access to the closed account’s plans. Resolving an existing commitment or closing an account is separate from exercising any deletion right you have under applicable law.

8. Your choices and privacy requests

Depending on where you live and which laws apply, you may have rights to access or receive a copy of your personal information; correct it; request deletion; restrict or object to particular processing; withdraw consent where consent is the basis for processing; or appeal a refusal. These rights can have exceptions, including protection of other people’s rights and legally required records.

Contact us using the details below to make a request. Tell us what you need and the email associated with your account, but do not send a password, API key or sign-in link. We may ask for information reasonably needed to verify your identity or an authorized agent’s authority. We will respond within the time required by applicable law and explain any restriction or refusal and available appeal process. We do not discriminate against you for exercising applicable privacy rights.

If you disagree with our response, reply to request a review. You may also complain to the privacy regulator or other competent authority where you live. The analytics choice above is available whether or not a specific privacy law gives you an opt-out right.

9. Security and international processing

We use encrypted connections, access restrictions and other technical and organizational measures intended to protect information. No online service can guarantee absolute security. Protect your email account, API keys and sign-in links, and contact us if you suspect unauthorized access.

Rally uses hosting in the United States. Our providers may also process information in other countries where they operate. Laws there may differ from those where you live. Applicable legal requirements still govern our handling of personal information; using Rally is not a waiver of your privacy rights.

10. Children

Rally is intended for adults 18 and older. People under 18 may not create an account or use the Service. Rally is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information in violation of this policy, contact us so we can investigate and take appropriate action.

11. Changes to this policy

We will post changes here and update the effective date. For material changes, we will provide additional notice through the Service or your account email as appropriate and obtain consent where applicable law requires it. A revised policy does not retroactively authorize a new use that requires your consent.

12. Contact us

Use this contact for privacy questions, requests and complaints.