privacy
policy.

This Privacy Policy describes how RAEMAR, LLC, a California limited liability company with a registered address at 4th Ave, Venice, CA 90291 ("Rally," "we," "our," or "us"), collects, uses, and discloses information when you use the Rally mobile application (the "App") and related services (collectively, the "Service").

The Service is offered solely to residents of, and users physically located in, the United States. We do not target, market to, or knowingly accept users from outside the United States. If you are not a U.S. resident or are not physically located in the United States, do not use the Service. See Section 12.

01information we collect

what we collect, by category.

We collect the following categories of personal information. Categories are mapped to the statutory categories under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), where applicable.

1.1 Information You Provide

We do not receive or store your Apple ID or Google account password.

1.2 Information Collected Automatically

1.3 Information We Do Not Collect

We do not collect: precise location (except as described above and only while the court map is active); contacts; call logs; browsing history outside the App; financial or payment information (handled entirely by Apple App Store, Google Play, and RevenueCat); health information; or biometric information as defined under the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, the Washington biometric law, or any other applicable state biometric law.

We do not accept user-uploaded files of any kind, including photos, images, audio, video, or attachments. Profile photos are sourced exclusively from your Apple or Google account at sign-in and are not stored as user uploads.

We do not use third-party advertising trackers, advertising SDKs, cross-site tracking technologies, or browser cookies for advertising. We do not engage in "cross-context behavioral advertising" as defined under CPRA.

1.4 Sensitive Personal Information

We do not collect, use, or disclose sensitive personal information as defined under CCPA/CPRA for purposes that would trigger your right to limit such use.

1.5 Children

The Service is not directed to and is not intended for use by children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it. Parents or guardians who believe their child has provided personal information to us should contact our contact form.

02how we use information

we use personal information to:

• Create, maintain, and operate your account.
• Display your profile, match results, and leaderboard standing within clubs you join.
• Compute leaderboards, head-to-head records, achievements, and statistics.
• Send transactional notifications (match results, friend requests, challenges, account notices) by push or email.
• Send marketing or promotional communications, only if you separately opt in, and which you may disable at any time.
• Process Rally+ purchases and verify entitlements via RevenueCat.
• Maintain security, prevent fraud, investigate abuse, and enforce our Terms of Use.
• Verify that users are located in and are residents of the United States.
• Improve the Service through aggregated and de-identified analytics.
• Comply with legal obligations and respond to lawful requests.

We do not engage in automated decision-making producing legal or similarly significant effects about you. Leaderboard rankings, achievement unlocks, and statistics are computed algorithmically but do not produce legal effects.

03how we disclose information

we don't sell. we don't share for ads.

Rally does not sell your personal information for monetary consideration, and Rally does not "share" your personal information for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA. We have not done either in the preceding 12 months. We do not have actual knowledge of selling or sharing the personal information of consumers under 16.

3.1 To Other Users

• Club members. Your display name, handle, profile photo, match results within the club, and leaderboard standing are visible to other members of clubs you have joined.
• Search. Other users who search for you by exact handle can see your display name, handle, and profile photo. They cannot see your match history, statistics, or club memberships unless they share a club with you.

3.2 To Service Providers

We engage the following service providers under written contracts that limit their use of your information to providing services to us:

We may engage additional service providers and will update this list.

3.3 To Legal and Public Authorities

We may disclose information when we have a good-faith belief that disclosure is necessary to: comply with applicable U.S. federal, state, or local law, court order, subpoena, or regulatory request; enforce our Terms of Use; protect our or others' rights, property, or safety; or detect, prevent, or address fraud, security, or technical issues.

3.4 In Connection With a Business Transaction

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you (e.g., by email or in-app notice) of any such transfer that materially changes how your personal information is processed.

3.5 With Your Consent or at Your Direction

We may disclose information for purposes you direct or authorize.

04retention

how long we keep things.

When you delete your account (Settings → Account → Delete Account, or by contacting our contact form), we permanently delete or de-identify your personal information within 30 days, subject to limited exceptions for: backups overwritten on a rolling basis not to exceed 60 days; legal hold or pending claims; and statutory record-keeping obligations.

We use "de-identified" in its CCPA/CPRA sense: information that cannot reasonably be linked to a particular consumer or household. We do not attempt to re-identify de-identified information and we contractually prohibit recipients from doing so.

05security

safeguards in place.

We implement administrative, technical, and physical safeguards designed to protect personal information, including: TLS encryption in transit; encryption at rest for the production database; OAuth-based authentication via Apple and Google; principle-of-least-privilege access controls for personnel; and logging of access to production data.

No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you and, where required, regulators without undue delay and in accordance with applicable law, including U.S. state breach-notification laws (e.g., California Civil Code § 1798.82, the New York SHIELD Act, and analogous statutes in all other states).

06your choices

controls available to you.

• Push notifications. Disable any time in your device settings or in-app. Marketing notifications can be disabled separately from transactional notifications.
• Profile visibility. Information visible to club members is necessary for the Service; you can leave any club from Settings.
• Court map / location. The court map only requests location while in use. You can deny or revoke this permission at the OS level at any time.
• Account deletion. Settings → Account → Delete Account.

07third-party services

governed by their own policies.

The Service integrates with the third-party services identified in Section 3.2. Their processing of your information is governed by their own privacy policies:

• Apple: https://www.apple.com/legal/privacy/
• Google: https://policies.google.com/privacy
• Expo: https://expo.dev/privacy
• RevenueCat: https://www.revenuecat.com/privacy
• Railway: https://railway.com/legal/privacy

We are not responsible for the privacy practices of these third parties.

08u.s. state privacy rights

rights under state comprehensive privacy laws.

This section describes rights available to U.S. residents under state comprehensive privacy laws, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Jersey, New Hampshire, Minnesota, Maryland, Rhode Island, Kentucky, and other states with comparable laws (collectively, "State Privacy Laws"). Some rights apply only in certain states. We extend most rights to all U.S. users regardless of residency.

8.1 Categories Collected, Sold, Shared, and Disclosed (CCPA/CPRA 12-Month Look-Back)

In the preceding 12 months, we have collected the categories of personal information identified in Section 1. We have disclosed for a business purpose the categories identified in Section 3 (specifically, to the service providers listed in Section 3.2 and as otherwise described in Section 3). We have not sold and have not shared (as defined under CCPA/CPRA) any category of personal information.

8.2 Sources of Personal Information

We collect personal information from: (a) you directly; (b) Apple and Google (authentication); (c) other users (e.g., when an opponent logs a match including your handle); and (d) automatic collection from your device.

8.3 Business or Commercial Purposes

We process personal information for the purposes set out in Section 2, including: providing and improving the Service; processing transactions; user authentication; preventing fraud and abuse; debugging; verifying U.S. eligibility; and complying with law.

8.4 Your Rights

Depending on your state, you may have rights to:

• Know / Access the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of recipients.
• Correct inaccurate personal information.
• Delete personal information we have collected from you.
• Portability — receive a copy of your personal information in a portable, machine-readable format. Free of charge.
• Opt out of sale or sharing — although we do not sell or share, you may submit a request to confirm.
• Limit use of sensitive personal information — although we do not collect sensitive personal information for purposes that would trigger this right.
• Opt out of profiling in furtherance of decisions producing legal or similarly significant effects (we do not engage in such profiling).
• Non-discrimination. We will not deny service, charge different prices or rates, or provide a different level or quality of service because you exercised a privacy right. All rights, including data export, are provided free of charge.
• Appeal a denial of a privacy request — see Section 10.

8.5 How to Submit a Request

You may submit a request through two methods:

1. In-app: Settings → Privacy → Submit Privacy Request.
2. Email: our contact form with subject "Privacy Request — [State]."

We will verify your identity by matching information you provide to information already in our records. If you submit a request through an authorized agent, the agent must provide written permission signed by you, and we may require you to verify your identity directly with us.

We aim to respond within the time required by applicable law (generally 45 days under CCPA/CPRA, with one 45-day extension where reasonably necessary; comparable timeframes under other State Privacy Laws).

8.6 California "Shine the Light"

California Civil Code § 1798.83 permits California residents to request information regarding our disclosure of personal information to third parties for those parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

8.7 California Notice — Complaints (Civil Code § 1789.3)

The provider of the Service is RAEMAR, LLC, contactable at our contact form and at the address above. Pursuant to California Civil Code § 1789.3, California residents may report complaints to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs by mail at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.

8.8 Global Privacy Control

We honor browser/device-level opt-out preference signals, including the Global Privacy Control ("GPC"), where technically feasible and applicable to mobile contexts.

8.9 Nevada

Nevada residents may opt out of the future sale of certain "covered information" under NRS 603A. We do not sell covered information, but to confirm or to register an opt-out preference, contact our contact form.

09do not sell or share my personal information

no opt-out is required.

Rally does not sell your personal information and does not share your personal information for cross-context behavioral advertising. No opt-out is required because we do not engage in either activity. To confirm, you may submit a request as described in Section 8.5.

10appeals

how to appeal a denial.

If we deny your privacy request in whole or in part, you may appeal by replying to our denial or by emailing our contact form with the subject line "Privacy Request Appeal." We will respond to appeals within 60 days of receipt (or as otherwise required by applicable State Privacy Law). If your appeal is denied, you may contact your state Attorney General or applicable consumer protection authority.

11notice at collection

required disclosures.

This Privacy Policy serves as our notice at collection under CCPA/CPRA § 1798.100(a). At or before the point of collection, we collect the categories of personal information identified in Section 1 for the purposes identified in Section 2, and we retain personal information for the periods identified in Section 4. We do not sell or share personal information.

12united states only

u.s. residents only.

The Service is offered only to U.S. residents physically located in the United States. We use IP-based geographic checks and a residency attestation at signup to enforce this restriction. We make no representation that the Service is appropriate or available for use outside the United States, and access from outside the United States is not authorized. Persons outside the United States who access the Service do so on their own initiative and at their own risk and are not the intended audience of the Service.

13changes to this policy

we'll notify you of material changes.

We may update this Privacy Policy. If we make material changes, we will notify you through the App or by email at least 30 days before the changes take effect, except where a shorter period is required by law. The "Last updated" and "Version" fields above indicate the most recent revision.

If you do not agree to a revised Policy, your remedy is to delete your account before the effective date.

14contact

privacy questions go here.

© 2026 RAEMAR, LLC. Version 2.0 (U.S.) · Last updated May 4, 2026.