Privacy & security for schools

Rally is fundraising software for school teams, booster clubs, PTAs and clubs. An organizer creates a campaign, each participant gets a page they can share, and supporters contribute by card. Money is processed by Stripe and paid to the organization's own account.

Rally is not a student information system. It holds no grades, attendance, discipline records, health information, or academic history, and it does not connect to a district SIS or roster sync.

Supporters pay by card through Stripe. The organization completes Stripe's own onboarding, which is where bank details and identity information are collected — Rally never sees or stores them. Funds are transferred to the organization's Stripe account and paid out to its bank on Stripe's schedule.

Rally charges a platform fee of 15% of each contribution. The organization receives the remaining 85%.

Stripe's card processing costs come out of Rally's fee, not your share. Your team receives the same percentage whichever card a supporter uses.

There is no setup cost, no subscription, and no minimum. Rally is paid only when a fundraiser raises money. Rally does not hold funds between the contribution and the payout, and is not the recipient of the donation.

Supporters are told all of this before they pay: the amount reaching the organization, Rally's fee, that contributions are not necessarily tax-deductible, and what the charge will look like on their statement.

The complete list of what Rally can hold about a participant:

Shown publicly on their page

Name; optionally grade, position, jersey number, a short biography, and a photograph; their fundraising goal and the amount raised.

Held privately

A contact email address or phone number, supplied by the organizer so an invitation can be sent; an age bracket; and, where applicable, a guardian's name and email address.

Never collected

Date of birth, home address, student identification number, academic records, health information, disciplinary records, free-and-reduced-lunch status, IEP or 504 information, or any government identifier.

Age is recorded as a bracket — under 13, 13 to 17, or 18 and over — rather than a date of birth, because those three cases are the only ones the software acts on.

Source of the data: everything about a participant is entered by the organizer, or by the participant or guardian once they hold an account. Rally imports nothing from a district and buys nothing from anyone.

Every participant is in exactly one of three modes, chosen by the organizer:

• Organizer-managed — no participant account exists. This is the default for a newly added roster entry.
• Guardian-managed — a parent or guardian holds the account and edits the page.
• Participant-managed — the participant holds their own account.

A participant under 13 cannot hold an account. This is enforced by a database constraint and by the account-claiming function, not only by policy — an under-13 participant marked as self-managing is rejected by the database itself.

Any participant's public page can be switched off immediately, by the organizer, the participant, or their guardian. Doing so removes them from every public surface while leaving the contributions raised through their link intact and correctly counted for the team.

Access is enforced in the database with row-level security, not only in the application. In practice:

• The public reads through restricted views that expose only publishable columns. Contact details, invitation links, guardian information and account identifiers are not in those views at all, so no API call can return them.
• An organizer can reach only their own campaign's records.
• A participant or guardian can edit only the single participant row they hold.
• An organization administrator can see the campaigns run in their organization's name and control participant visibility, but cannot rewrite campaign content or touch payment records.
• Donation records can only be written by the payment webhook. No user account can create or alter one.

These boundaries are covered by an automated test suite that runs as real signed-in users and asserts that cross-tenant reads and writes fail.

Fundraiser pages, participant pages, invitation links, the participant editor and the embed view are all marked so search engines do not index them. They stay reachable by direct link, which is how a fundraiser is meant to work, but a student's name and photograph will not surface in a web search of their name.

The complete list of third parties that receive any information, verified against the application's code:

Stripe — payment processing

Donor payment details and the organization's banking and identity information for payout onboarding. Rally never receives card or bank numbers.

Supabase — database, authentication, file storage

All application data and uploaded images. Hosted in the United States.

Resend — transactional email

Recipient addresses and message content for receipts and notifications.

Vercel — application hosting

Serves the site and processes requests.

There are no others. Rally uses no third-party analytics, tag manager, session recorder, advertising network, or tracking pixel. Share and visit counts are recorded in Rally's own database.

Automated text messaging is not implemented. If it is added, Twilio would become a subprocessor and this list will be updated before any message is sent.

Rally does not sell student, participant, or donor personal information. It does not share personal information for cross-context behavioural advertising, does not serve advertising, and does not use participant information to train machine-learning models.

Rally's only revenue is its platform fee on contributions.

• Encrypted in transit (TLS) and at rest, by our infrastructure providers.
• Sign-in is passwordless — a one-time code or link by email. Rally stores no user passwords.
• Payment credentials never touch Rally's systems. Card entry happens on Stripe's hosted checkout; bank and identity details are collected by Stripe's hosted onboarding.
• Authorization is enforced at the database layer, as described above.
• Sensitive actions — authorization, beneficiary approval, participant claims, role changes, refunds, deactivation, and privacy requests — are written to an append-only audit log.

Report a vulnerability or suspected incident to security@rallyforteams.com.

Organizers can view and correct participant information and remove a public page from their dashboard. Participants and guardians with accounts can edit their own page.

Schools, parents and guardians can request a copy, a correction, or deletion through the request form — no Rally account is needed — or by emailing privacy@rallyforteams.com. We remove public profile information, contact details and account information; we retain payment records, because deleting them would corrupt an organization's financial accounts and we are required to keep them.

Turnaround. We acknowledge every request within 3 business days and complete it within 30 days. If a participant's page needs to come down straight away, we do that within 1 business day — an organizer can also do it themselves immediately.

An organizer can also remove a participant's details themselves, from the roster, without waiting for us.

The following are commonly asked about. Rally has not done them, and does not claim otherwise:

• No SOC 2 audit, and no other third-party security certification.
• No PCI DSS certification. Card data is handled entirely by Stripe.
• No formal FERPA, COPPA, SOPIPA or state student-privacy compliance assessment by counsel.
• No signed district data privacy agreement, and no National DPA membership.
• No completed VPAT or accessibility conformance report.
• No penetration test by an external firm.
• These policies have not yet been reviewed by an attorney.

If your district requires any of these before approving a vendor, tell us what you need at privacy@rallyforteams.com and we will give you a straight answer about whether and when we can meet it.

A district sending a standard Student Data Privacy Agreement should expect Rally to need negotiation on breach-notification deadlines, audit rights, data-return obligations at termination, and subprocessor change notice. None of these are currently committed to contractually.

Privacy and district questions: privacy@rallyforteams.com
Security: security@rallyforteams.com
General support: support@rallyforteams.com

See also our Privacy Policy, Terms of Service, and Refund Policy.