This policy explains what personal information Rally & Roam collects, why, who we share it with, how long we keep it and the rights you have. It applies to our website, our apps and the emails we send. We have written it to be read, not skimmed past, so it is in plain English and organised by topic.

Who we are

Rally & Roam is a platform for planning padel trips, booking courts, coaches and events, meeting other players and buying padel kit. For the personal information described here, we are the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can also reach us through the Help centre once you are signed in. Privacy questions go to the person responsible for data protection at Rally & Roam.

The short version

We collect what we need to run your account, your bookings and your orders, and to keep the platform safe.
Analytics and advertising partners only run if you say yes in the cookie choices, and you can change your mind at any time.
We share details with the club, coach, operator or supplier you book or buy from, with our payment processor and with the service providers that help us run the platform. We do not sell your personal information.
You can download your data or delete your account yourself from Settings.

What we collect

When you create an account

Your name, username, email address and password (stored only as a one-way hash), your country, language, currency and colour theme, and your role on the platform (player, coach, club or place owner). If you sign in with Google or Apple, we receive your name, email address and an account identifier from them; we never see your Google or Apple password. If you add a passkey or two-factor authentication, we store the public key or the secret needed to check your codes.

Your player profile

The details you choose to add, such as your playing level, preferred side, languages, home airport, photo and bio, and the reliability score that games use to show whether players turn up.

Bookings, orders and payments

The courts, lessons, events, trips and products you book or buy, who you play with, delivery addresses for shop orders, and the payments, refunds, wallet credit, gift cards and Rally Points on your account. Card details are entered with and held by Stripe, our payment processor; we only receive the card brand, the last four digits and the expiry date. For fraud prevention we record the IP address of a payment attempt and a coded fingerprint of the card that cannot be turned back into the card number.

Travel bookings

When you book a flight, stay or transfer through us, we collect what the airline, hotel or transfer company needs: each traveller's full name, date of birth, gender as shown on their passport, and contact email and phone number. You must have permission from any other traveller whose details you give us.

Messages, reviews and community activity

Messages you send to other members, coaches, clubs or our support team, reviews and replies you post, games, groups and competitions you join, reports you make about other members, and the files you upload (for example a photo, a certificate or a match video you ask us to analyse).

Coaches, clubs and place owners

If you list a business or offer coaching, we also collect what is needed to verify you and pay you: business details, registration numbers, proof of address or a licence, coaching certificates, any safeguarding declaration (such as a DBS check number and issue date), and the payout details you give Stripe. Stripe, not us, holds your bank details and identity documents for payouts.

Your approximate location

We never show your exact location to other members. When you search near you, coordinates are rounded to about one kilometre and are not stored. When you sign in, we work out your town from your IP address so we can suggest airports and clubs near you. We look your address up in a city database that runs on our own servers (DB-IP's IP to City Lite, or MaxMind GeoLite2), so your IP address is not sent to anyone else for this. IP geolocation by DB-IP. We keep only the town, the country and a point rounded to about a kilometre, never the IP address itself, and we delete it after 90 days. If we cannot tell where you are, we use your home airport instead.

Technical information

Like every website, our servers receive your IP address, browser type and the pages you request. Your signed-in session records your IP address and browser so you can see and end your active sessions, and it expires after a period of inactivity. Errors in the app are reported to Sentry without your name, email or IP address.

Analytics and how we measure the site

We measure how the site is used in three ways. Only the first runs without your consent, because it does not use cookies or identify you.

First-party page counts, without cookies

Our own servers count page views to see which pages are useful. For each view we record the page address, the site you came from, your country, your device type (phone, tablet or computer) and an anonymous visitor code. The visitor code is a one-way hash that changes every day, so it lets us count unique visitors for a single day but cannot follow you from one day to the next or be linked back to you. We do not store your IP address and we set no cookies for this. We keep these counts for 13 months. Our lawful basis is our legitimate interest in understanding which pages work.

Google Analytics

If you allow analytics, Google Analytics 4 measures visits and sets the _ga cookies. Until you allow analytics, Google consent mode means Google receives only signals without cookies or identifiers, which Google uses to model overall traffic. We have turned off advertising features and personalisation in our analytics.

PostHog

If you allow analytics, PostHog, hosted in the European Union, measures which features are used and runs small tests of changes to the site. Members are identified to PostHog by account number and role, never by name or email. Session recording is switched off.

Why we use your information and our lawful bases

Purpose	Lawful basis
Running your account, signing you in and keeping it secure	Contract
Taking bookings and orders, passing them to the club, coach, operator or supplier, taking payment and handling refunds	Contract
Booking flights, stays and transfers with travel providers	Contract
Sending booking confirmations, receipts, reminders and account messages	Contract
Matching you with players, games, coaches and clubs, and suggesting airports and trips near you	Legitimate interests (providing the service you signed up for)
Checking coaches, clubs and places before they are listed, including safeguarding declarations	Legitimate interests (keeping members safe); for coaches of under-18s, also our safeguarding duties
Preventing fraud, payment abuse, spam and harassment, and moderating reviews and messages	Legitimate interests (keeping the platform safe)
Cookieless first-party page counts	Legitimate interests (improving the site)
Google Analytics and PostHog	Consent
Travel partner tracking (Travelpayouts Drive) and Google advertising signals	Consent
The weekly newsletter and marketing emails	Consent, which you can withdraw with the link in every email
Keeping accounting and tax records	Legal obligation
Responding to legal claims and requests from authorities	Legal obligation or legitimate interests

Where we rely on legitimate interests, we have weighed our interests against yours. You can object at any time, and we will stop unless we have a compelling reason to continue.

We share personal information only where it is needed for the purposes above. We do not sell it.

The people you book or buy from

When you book a court, lesson or event, the club, coach or event operator receives your name, contact details and booking details so they can host you. They are responsible for how they use that information under their own privacy notice. Other players in a booking or game see your name, photo, level and reliability score.

Service providers who work for us

Provider	What they do
Stripe	Card payments, refunds, memberships, payouts to clubs, coaches and operators, and fraud checks
Resend	Sending our emails
Laravel Cloud and our storage provider	Hosting the platform, its database, uploaded files and backups
Cloudflare	Delivering the site securely and quickly, and blocking attacks
Meilisearch Cloud	Search across clubs, coaches, places and guides
Sentry	Error reports, without names, emails or IP addresses
Anthropic	The AI concierge, the help assistant and message translation: the text you type into these features is sent to Anthropic's Claude models to produce a reply or translation
Modal	Processing match videos you ask us to analyse
Expo	Push notifications to our mobile app
Google and Apple	Sign in with Google or Apple if you choose it, wallet passes, and app store subscriptions if you subscribe in an app
PostHog and Google Analytics	Analytics, only with your consent

Travel providers

Flights and stays you book through us go to Duffel and to the airline or hotel; hotel bookings may also go through LiteAPI, and transfers through Mozio. They receive the traveller details listed above and use them under their own terms and privacy policies.

Shop suppliers

To make and deliver shop orders we share your name, delivery address, phone number and order with the supplier that fulfils the item: Gelato or Printful for print-on-demand items, CJ Dropshipping for dropshipped items, or our UK distributor for warehouse stock, and with their delivery companies.

Affiliate and travel partners

When you follow a link to a partner such as a flight search, hotel, activity, car hire or eSIM site, the partner knows you arrived from Rally & Roam so they can pay us a commission. These links are run through Travelpayouts and its programmes (for example Aviasales, Booking.com, Expedia, GetYourGuide, Viator, Rentalcars.com, SafetyWing and Airalo), Awin, and partners such as TheFork, OpenTable and Tiqets. We pass no personal information in these links. If you allow travel partners and advertising in the cookie choices, Travelpayouts Drive also runs on our pages to add partner tracking to travel links. See our affiliate disclosure.

Maps, images, fonts and videos

Our maps load tiles from OpenFreeMap and some street-level photos from Mapillary. Your browser connects to these services directly, so they receive your IP address. Our typefaces are served from our own servers. Guides may include YouTube videos (in privacy-enhanced mode) or Vimeo videos (with tracking turned off), which load from those services when you play them.

Other members and the public

Your public profile, reviews and replies, and anything you post in public groups or games can be seen by other members, and reviews of clubs, coaches and places can be seen by anyone.

When the law requires it, or if the business changes hands

We may share information with the police, regulators or courts where the law requires it or to protect someone from harm, and with a buyer if Rally & Roam or its assets are sold, who must then protect it as this policy describes.

Where your data is stored and international transfers

Our platform, database and backups are hosted in the United Kingdom or the European Economic Area. Some of our providers are based in, or have support teams in, other countries, including the United States (for example Stripe, Google, Apple, Anthropic, Resend, Sentry and Cloudflare) and China (CJ Dropshipping, for dropshipped orders). When personal information leaves the UK, we make sure it is protected: either the country has UK adequacy regulations (such as the EEA, or US companies certified under the UK extension to the EU-US Data Privacy Framework), or we use the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses, with extra safeguards where needed.

How long we keep it

Information	How long
Your account and profile	Until you delete your account
Bookings, orders, payments and refunds	Six years after the end of the financial year they relate to, as UK tax law requires
Your town worked out from your IP address	90 days
Fraud prevention records of payment attempts	Up to two years
Messages and support conversations	Until you delete your account, or longer if needed for a report or dispute that is still open
Cookieless page counts	13 months
Backups	Daily backups are kept for up to 16 days, weekly for 8 weeks, monthly for 4 months and yearly for 2 years, then deleted

When you delete your account, we delete your profile, messages, games, follows and other personal content straight away, cancel any memberships and newsletter subscription, and anonymise your account record. Booking, payment and order records are kept for the period above with your delivery address removed. Deleted information can remain in backups until they expire, and is not restored from them except to recover from a fault.

Your rights

Under UK GDPR you have the right to:

get a copy of the personal information we hold about you;
have inaccurate information corrected;
have your information deleted;
restrict how we use it, or object to our use of it based on legitimate interests;
receive the information you gave us in a portable format;
withdraw your consent at any time, for analytics and partners through Cookie settings at the foot of every page, and for emails through the unsubscribe link;
not be subject to decisions with legal or similarly significant effects made solely by automated means. We do not make decisions like that about you.

Children

You must be 16 or over to create an account. Juniors can take part in lessons and events when a parent or guardian books for them, and that adult is responsible for the details they share. If you think a child under 16 has created an account, tell us and we will delete it. See our safeguarding policy.

Security

We protect your information with encrypted connections, hashed passwords, two-factor authentication for coaches, owners, staff and administrators, restricted staff access and regular tested backups. No system is perfectly secure, so if you think your account has been compromised, change your password and contact us straight away.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We update this policy when we change what we do with personal information. The date at the top shows when it last changed. If a change matters to you, we will tell you by email or in the app before it takes effect.

Tietosuojakäytäntö