Privacy Policy

1. What Information Do We Collect?

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• Names
• Email addresses
• Usernames and display names
• Trip destinations and travel preferences
• Availability and date information you submit
• Expense and budget data you log
• Push notification subscription tokens (when you enable browser notifications)

Sensitive Information. We do not process sensitive information such as health data, racial or ethnic origin, or financial account numbers.

Social Media Login Data. We may provide you with the option to register with us using your existing Google account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section called "How Do We Handle Your Social Logins?" below.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

• Log and Usage Data — service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services
• Device Data — information about your computer, phone, tablet, or other device you use to access the Services

2. How Do We Process Your Information?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication. We may process your information so you can create and log in to your account.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service — including creating trips, inviting members, managing votes, and coordinating group travel.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time by clicking "Unsubscribe" in any email we send.
• To send push notifications. If you enable browser push notifications, we use your subscription token to deliver trip reminders and updates. You can disable notifications at any time through your browser or device settings.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

3. What Legal Bases Do We Rely On to Process Your Information?

We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, the GDPR and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information:

• Consent. We may process your information if you have given us permission to use your personal information for a specific purpose.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests.
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party.

4. When and With Whom Do We Share Your Personal Information?

We may share information in specific situations described in this section and/or with the following categories of third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. The third parties we may share personal information with are as follows:

• Cloud Computing Services — Supabase (database and authentication), Netlify (hosting and edge delivery)
• Email Delivery Services — Resend (transactional email delivery)
• Analytics Services — Google Analytics 4 (usage analytics, loaded only with your consent)
• Mapping Services — Google Maps (destination map embeds, loaded only with your consent)
• Error Monitoring — Sentry (application error tracking; may include anonymized technical context such as user IDs in stack traces)
• Push Notification Delivery — Browser push services including Google Firebase Cloud Messaging and Apple Push Notification Service (used to deliver notifications when you opt in; processes your push subscription token)

We also may need to share your personal information in the following situations:

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Other Users. When you share personal information (for example, by posting content such as trip details, comments, or availability) or otherwise interact with public areas of the Services, such personal information may be viewed by all members of the trip you belong to.

5. Do We Use Cookies and Other Tracking Technologies?

We use cookies and similar tracking technologies to maintain your session, remember your preferences, and understand how the Services are used. We do not use advertising cookies, retargeting cookies, or cross-site tracking, and we do not sell your data.

For full details — including the specific cookies set, their duration, and how to manage your preferences — please refer to our Cookie Policy.

6. How Do We Handle Your Social Logins?

Our Services offer you the ability to register and log in using your third-party social media account details (like your Google login). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name and email address.

We will use the information we receive only for the purposes that are described in this privacy notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider.

7. How Long Do We Keep Your Information?

We retain your personal information only for as long as necessary to provide the Services or as required by law.

When you delete your account, your personally identifiable information — including your name and email address — is permanently removed and your account is anonymized. However, certain non-identifiable contributions you made to shared group trips (such as vote responses, expense records, availability data, and comments) are retained in anonymized form to preserve the integrity of other members' records. This data is fully disassociated from your identity and cannot be used to identify you.

Anonymized retained data exists only as long as the associated trip data exists and is subject to normal retention periods.

8. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.

Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

9. Do We Collect Information from Minors?

We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at support@rallyd.co.

10. What Are Your Privacy Rights?

In some regions (like the EEA, UK, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; and (iv) if applicable, to data portability. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us at support@rallyd.co.

We will consider and act upon any request in accordance with applicable data protection laws.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us at support@rallyd.co.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the Contact Us section below.

Account Information: You can review or update your account information at any time by logging in to your account settings. If you request account deletion, your personally identifiable information (name, email address) will be permanently removed and your account will be anonymized. Certain anonymized records you contributed to shared group trips may be retained to preserve the integrity of other members' data, but will be fully disassociated from your identity. See Section 7 for full details on data retention.

If you have questions or comments about your privacy rights, you may email us at support@rallyd.co.

11. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.

12. Do United States Residents Have Specific Privacy Rights?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have shared it, as well as to request that we correct inaccurate personal information, delete your personal information, or opt out of the sale or sharing of your personal information. These rights may be limited in some circumstances by applicable law.

To exercise these rights, please submit a request by emailing support@rallyd.co or visiting our Contact page.

We do not sell or share personal information with third parties for their direct marketing purposes, and we do not use or disclose sensitive personal information for purposes beyond those permitted under applicable California law.

13. Categories of Personal Information We Collect

The following table summarizes the categories of personal information we collect, how we use them, and whether they are shared with third parties:

14. Do We Make Updates to This Notice?

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last Updated" date at the top of this privacy notice. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

15. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, please contact us at:

16. How Can You Review, Update, or Delete the Data We Collect?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it. To submit a request, please contact us at: