Privacy Policy

• Rally does not sell student, participant, or donor personal information.
• We do not use advertising networks, and we show no third-party ads.
• We use no third-party analytics, tag managers, session recorders, or tracking pixels. Share and visit counts are counted by us, in our own database.
• We never see or store card numbers.
• Participant pages are not indexed by search engines.
• A participant's public page can be taken down at any time.

Organizers

• Name, email address, and the role or title you give.
• The organization you say the fundraiser benefits, and your confirmation that you are 18 or older and authorized to act for it — including the wording you agreed to and the time you agreed.
• Campaign content: title, description, goal, photographs, updates.

Participants

Rally deliberately collects as little about participants as it can. We ask for a name and a fundraising goal. Optionally, an organizer may add a grade, position, jersey number, short biography and photograph, all of which appear on the participant's public page.

We do not collect exact dates of birth, home addresses, school identification numbers, or academic records. Where age matters, we record only a bracket — under 13, 13 to 17, or 18 and over — because the only question the product ever needs to answer is which of those applies.

An organizer may add a contact email or phone number for a participant so an invitation can be sent. Contact details are never shown publicly.

Guardians

Where a participant's page is guardian-managed, we hold the guardian's name and email address and the account they sign in with. Guardian information is never shown publicly.

Donors

• Name, email address, contribution amount, and any message you write.
• Payment details go directly to Stripe. Rally stores only a Stripe reference, never a card number.
• If you choose to give anonymously, your name is hidden from the public page. It remains visible to the organizer for their records.

Usage

We count how often a campaign or participant link is shared and visited, and by which channel. These counts are aggregate and stored in our own database. We do not build profiles of visitors.

Public on a fundraiser page

Campaign details; the organization name; the organizer's name and role; participant names, photographs, grade, position, jersey number and biography; amounts raised; donor display names and approved messages.

Never public

Participant contact details; guardian information; invitation links; donor email addresses; account identifiers; and the organizer's email address unless they have explicitly chosen to show it.

Fundraiser and participant pages are marked so that search engines do not index them. They remain reachable by anyone with the link, which is the point — a page exists to be shared.

• Organizer information — to operate the fundraiser, and to keep a record of who claimed authority to run it.
• Participant information — to build the public page that is the product.
• Guardian information — so an adult can manage a young participant's page.
• Donor information — to process the payment, send a receipt, and let the organizer thank and account for contributions.
• Usage counts — to show organizers which sharing methods work.

We use a small number of service providers. Each receives only what it needs, and none of them receive information for their own marketing purposes:

Stripe — payments

Processes contributions and runs the organization's payout onboarding directly. Receives donor payment details and the organization's banking and identity information. Rally never sees card numbers or banking details.

Supabase — database, accounts and file storage

Hosts the database, sign-in system, and uploaded images.

Resend — email

Delivers donation receipts, organizer notifications, invitations and campaign updates. Receives recipient email addresses and message content.

Vercel — hosting

Serves the website and processes requests.

We may also disclose information where legally required, or to investigate a fundraiser we believe is fraudulent.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Participants under 13 cannot create or hold a Rally account. Their page must be managed by an organizer or by a parent or guardian, and the software refuses to bind an account to an under-13 participant.

Where a young person appears on a fundraiser, the organizer is responsible for having permission to publish their name and photograph. A parent or guardian can ask us at any time to remove a participant's public information — see below — and we will act on it without requiring a reason.

COPPA applicability, and whether any additional verifiable parental consent mechanism is required given that under-13s appear on public pages without holding accounts, needs review by counsel.

Organizers can view and correct participant details from their dashboard, and can take a participant's public page down at any time. Participants and guardians who hold an account can edit their own page.

For anything else — a copy of the information we hold, a correction, or deletion — use the request form, which needs no Rally account, or email privacy@rallyforteams.com. Parents, guardians, and schools may make a request on a participant's behalf.

We acknowledge every request within 3 business days and complete it within 30 days. If a participant's page needs to come down straight away, we do that within 1 business day — an organizer can also do it themselves immediately.

What deletion does and does not remove

We remove public profile information, contact details, and account information. We keep records of payments — amounts, dates, and processor references — because we are required to retain financial records and because deleting them would corrupt an organization's accounts.

In practice that means a participant can be removed from public view entirely while the contributions made through their link continue to count toward the team's total.

Campaign and participant information is kept while the fundraiser is active and afterwards so organizers can refer back to it, until deletion is requested. Financial records are kept as long as required for tax and accounting purposes.

Specific retention periods need to be set, and confirmed against the record-keeping rules that apply once Rally has a legal entity and tax obligations.

Information is encrypted in transit and at rest by our infrastructure providers. Access to campaign data is enforced in the database itself, so an organizer can only reach their own campaign's records, and public pages read through restricted views that cannot expose contact details or invitation links.

Card and bank details never reach Rally's systems. More detail is in our privacy and security overview for schools.

To report a vulnerability or a suspected incident, email security@rallyforteams.com.

State-specific rights — California, and other states with comprehensive privacy laws — need to be enumerated once counsel confirms which apply to Rally given its size and where it operates. The access, correction and deletion mechanism in section 7 is available to everyone regardless.

We will update this policy as the product changes. The version and date at the top change with it, and we will tell account holders about material changes by email.

Privacy: privacy@rallyforteams.com
Security: security@rallyforteams.com
Everything else: support@rallyforteams.com