Privacy Policy

This Privacy Policy explains how Vorapure UK Ltd ("we", "us", "our") collects, uses, and protects your personal information when you use Rallykeep (the "Service"), available at rallykeep.app and related applications.

We are the data controller responsible for your personal data. We are committed to protecting your privacy and handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Vorapure UK Ltd

Registered in England and Wales, company number 17138078.

Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom

Contact: hello@vorapure.co.uk

2. Information we collect

We collect only the information needed to run Rallykeep:

Information you give us

• Account details: your name and email address when you create an account.
• Password: stored only in securely hashed form by our authentication provider. We never see or store your password in plain text.
• Profile information: an optional profile photo or avatar if you choose to add one.

Information created through use of the Service

• Match and ranking data: match scores, the players involved, group names, tournament results, and the ratings calculated from them.
• Group data: groups you create or join, your role within a group, and group join codes.

Information collected automatically

• Basic technical data: information your browser or device sends automatically, such as device type and general usage needed to operate and secure the Service.
• Crash and diagnostic data: if the app crashes or errors, we collect anonymised technical diagnostic information (such as error type and device or OS version) to help us find and fix problems. This data is not linked to your identity and is not used for tracking.

We do not collect special category data (such as health, ethnicity, or political views), and we do not knowingly collect data from children under 16.

3. How we use your information

We use your information to:

• Create and manage your account.
• Provide the core features of Rallykeep — recording matches, calculating rankings, running tournaments, and syncing your data across your devices.
• Allow you to join and share groups with other players.
• Send you essential account emails, such as password reset links.
• Maintain the security, integrity, and reliability of the Service.
• Process payments if you choose to subscribe to a premium plan (see Section 5).

Legal bases. Under UK GDPR we rely on: performance of a contract (to provide the Service you signed up for), legitimate interests (to keep the Service secure and working well), and consent where required (which you can withdraw at any time).

We do not sell your personal data, and we do not use it for third-party advertising.

4. How your data is stored and protected

Your data is stored using Supabase, our database and authentication provider, on secure cloud infrastructure (Amazon Web Services, located in Singapore). Access is protected by row-level security so that you and the members of your groups can only access data you are permitted to see.

We take reasonable technical and organisational measures to protect your data against loss, misuse, and unauthorised access. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

5. Payments

Rallykeep may offer optional paid (premium) features. When it does, payments will be processed by Paddle, our authorised reseller and Merchant of Record. Paddle handles your payment details directly and we do not receive or store your full card information. Paddle's handling of your data is governed by their own privacy policy.

6. Sharing your information

We share your information only in limited circumstances:

• With other group members: when you join or create a group, your name and match data are visible to other members of that group. This is a core part of how Rallykeep works.
• With service providers: trusted third parties who help us run the Service — such as Supabase (hosting and authentication), Sentry (crash and error diagnostics), and Paddle (payments) — who may only process data on our instructions.
• For legal reasons: if required by law, regulation, or valid legal process.
• In a business transfer: if Vorapure UK Ltd is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

7. International transfers

Because our infrastructure and some service providers are located outside the UK, your data may be transferred to and stored in countries outside the UK. Where this happens, we take steps to ensure your data receives a level of protection consistent with UK data protection law.

8. How long we keep your data

We keep your personal data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain certain information to comply with legal obligations. Match and ranking data you contributed to a shared group may remain visible to that group as part of its history.

9. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at hello@vorapure.co.uk. We will respond within the timeframes required by law. You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO) at ico.org.uk.

10. Children

Rallykeep is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date above and, where appropriate, notify you within the Service.

12. Contact us

If you have any questions about this Privacy Policy or how we handle your data, contact us at:

Vorapure UK Ltd

167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom

Email: hello@vorapure.co.uk