Privacy policy

Last updated Nov 8, 2026 · Version 2026-11-08

FairRally is a free app that runs racket-sport sessions for groups of friends. It is run by Trident Software Consulting, Inc. in Canada ("we", "us"). This policy explains what we collect, why, who helps us run the app, how long we keep things, and what you can do about it.

We do not sell your data. We do not show ads. We do not use analytics or tracking tools.

The short version

We keep your sign-in details, the display name you choose, the guilds you belong to, and the games, scores and ratings from your sessions.
Other members of your guild see your display name, your role, your games, scores and ratings. They never see your email address.
You can change your name, download a copy of your data, sign out of every device, and delete your account in the Me page.
Questions or requests: privacy@fairrally.com.

What we collect

With Google (the only sign-in option today): Google tells us your email address, your name and a link to your profile picture, plus a Google account id. We ask Google only for the basic openid, email and profile permissions. We use your email to identify your account and your name to suggest a display name. The app does not show your profile picture. Supabase, our sign-in provider, stores the details Google sends with your account record.
With email and password (switched off today): if we turn this on, we keep your email address and a scrambled (hashed) form of your password. We never see your password itself.
Sign-in records: the time you created your account, when you last signed in, and the session tokens that keep you signed in. Our sign-in provider also keeps security logs of sign-in activity, which can include your IP address.

Your profile

Display name: 1 to 40 characters. Suggested from the first word of your Google name; you can change it at any time.
Theme: light, dark or system.
Consent record: the date and time you agreed to the terms and this policy, and which version you agreed to.

Inside a guild (your group)

Membership: which guilds you belong to, your role (member, admin or owner), when you joined, and when you left or were removed.
Join requests: if you ask to join a guild, we keep the request, a copy of your display name at that time, and the decision.
Sessions: who was on the list, who was present or missing, when they arrived, and requests to be added to a session.
Games and scores: who played on which side, the score, and a log of every point, undo, correction and scorer change, with who made it and when.
Ratings: a skill rating worked out from your game results, and its history. Ratings are only used for your guild's leaderboard and for balanced pairings.
Audit log: a record for guild admins of actions such as removing a member, changing roles, approving requests, correcting a score or deleting a session. It stores ids and the type of action, not names.
Guest players: members can add a guest (a player without an account) by typing a name. That name is shown to the guild and kept with the guild's games.
Places: a guild's usual place and each session's place, picked from location search: the place name, its address and its map position. These describe a venue, not you.
Email invites: if an admin or session organiser invites someone by email, we keep that email address with the invite until it is accepted, declined, cancelled or 30 days old (and for at least one day, because the daily invite limit counts it), and we send one invite email to it through Resend.

Technical records

Rate limiting: when you open an invite link we keep a short record (your internal account id and the time) to stop abuse. It holds no name or email. If you open an invite link before signing in, we keep a one-way scrambled code made from your IP address and the date (never the address itself) for up to an hour. When you use location search we keep your internal account id and the time for up to a day, to limit how many searches one account can make.
Server logs: our hosting and database providers keep short-lived request logs, which can include your IP address and browser details. Our own code is written not to log names or email addresses.

We do not collect your device's location, your contacts, photos, payment details or anything from your device beyond what a normal web request sends. Location search only uses the words you type.

Why we use it

To run the app you asked for: sign you in, show your guilds, build fair rotations, keep live scores, and work out ratings and leaderboards.
To keep it safe: limit abuse, keep an audit trail for guild admins, and investigate problems.
To record your consent: so we can show which version of the terms you agreed to.

We do not use your data for advertising, profiling for marketing, or selling.

Who can see what

Other members of your guild: your display name, your role, the date you joined, your games, scores, ratings and leaderboard position in that guild. Members of other guilds see nothing about you.
Guild admins and the owner: also your join requests and the guild's audit log.
Nobody else in the app sees your email address or account id.
Anyone with a guild's invite link, signed in or not, sees the guild's name, sport, member count, how joining works and its usual place (name and address), not the member list. Signed in, they also see the owner's display name. When the link is pasted into a chat app, the preview shows only the guild's name and sport.

Who helps us run FairRally

These companies process data for us so the app can work. Each one only gets what it needs.

Supabase (database, sign-in and live updates). Your data is stored in Supabase's Canada (Central) region.
Vercel (hosts the website and runs the app's server code). Requests may be processed outside Canada, for example in the United States.
Google (sign-in). Google knows that you used your Google account to sign in to FairRally. Google's own privacy policy applies to your Google account.
Resend (emails): invite emails, which carry the invited address, the guild name and who sent the invite; and sign-in emails, only if email sign-in is switched on (it is switched off today).
Geoapify (location search and small maps). Our server sends Geoapify the words typed into a location field and the place that was picked, and asks it for map pictures of saved places. Requests come from our server, not your device, and carry no name, email or account details. Place data comes from OpenStreetMap.
Cloudflare (domain name service). It points the web address to Vercel and does not see the content of your use of the app.

Some of these providers may store or process data in countries other than Canada, including the United States. When that happens, the laws of those countries may apply to it.

How long we keep it

Your account and profile: until you delete your account.
Your games, scores and ratings: for as long as the guild exists. If you delete your account they stay, but your name is replaced with "Deleted player". See Data retention and deletion for the full details.
Deleted sessions: kept in the guild's trash for 30 days, then removed for good.
Audit log entries: 90 days.
Decided join requests and add requests: 90 days after the decision.
A deleted guild: removed straight away, with everything in it.

Your choices and rights

See your data: most of it is visible in the app (your profile, guilds, games and ratings). Download my data in the Me page gives you a file (JSON) with your account, profile, consent record, memberships, join requests, and your attendance, games and rating changes in the guilds you are in now. For anything else we hold (for example about guilds you have left), email privacy@fairrally.com.
Correct your data: change your display name in the Me page. Ask a guild admin to fix a wrong score (possible until 3 hours after the session ends).
Sign out everywhere: in the Me page.
Delete your account: in the Me page (you type DELETE to confirm). If you own a guild that still has other members with accounts, you must hand ownership to someone first.
Withdraw consent: delete your account.
Complain: email us first. You can also contact your local privacy regulator, for example the Office of the Privacy Commissioner of Canada.

We answer requests within 30 days (sooner where we can).

Children

FairRally is not meant for children under 16. Do not sign up if you are younger. If you think a child has an account, email privacy@fairrally.com and we will delete it.

Security

Data is sent over encrypted connections (HTTPS). Database access rules make sure members only see their own guilds. Only our server can use the administrator key, and it is never sent to your browser. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

Changes to this policy

When we change this policy we update the version and the "last updated" date at the top of this page. If a change is important, we will try to tell you before it applies.

Contact

Privacy questions and requests: privacy@fairrally.com.

Operated by Trident Software Consulting, Inc., Ontario, Canada. We handle privacy matters by email only; the address above is our published contact for privacy questions and requests.