Privacy Policy

1. Information we collect

When you create a RallyHub account we collect:

• Name, email address, and a hashed password
• Profile information you choose to add: playing level, suburb, profile photo, availability, and bio
• Match records and scores you log within the platform
• Private messages you send to other players (see Storage and security below)
• Optional GPS location data shared during active hit requests and matches, with your explicit consent
• Subscription billing details, processed by Stripe and not stored on our servers
• Invite token used during registration

2. How we use your information

• To operate the RallyHub platform and deliver its features
• To match you with tennis players at your level and location
• To send transactional emails (match confirmations, friend requests, hit invites) via Mailgun
• To calculate XP, leaderboard rankings, and match statistics
• To respond to support requests submitted via the contact form
• To detect and prevent abuse, spam, or fraudulent activity

We do not sell your personal information. We do not use it for third-party advertising.

3. Storage and security

• All data is stored on a dedicated Vultr VPS located in Sydney, Australia
• Private message bodies are encrypted at rest using AES-256 (Laravel's encrypted cast, backed by the application key)
• Passwords are hashed using bcrypt and never stored in plain text
• All connections to RallyHub are encrypted via TLS 1.2 or TLS 1.3 (HTTPS enforced)
• Two-factor authentication is available on all accounts and can be required by club administrators
• GPS location data expires after two hours and is automatically purged

While we take reasonable precautions, no internet transmission or storage system is 100% secure. If you believe your account has been compromised, contact us immediately.

4. Third parties

• Mailgun: transactional email delivery. Email addresses and message content are transmitted to Mailgun's servers to deliver notifications.
• Stripe: payment processing for Starter and Pro subscriptions. We pass your billing details directly to Stripe and do not store card numbers on our servers.
• Google Analytics (GA4): anonymous usage analytics. We collect standard GA4 metrics (page views, session duration, general location by city). IP addresses are anonymised. You can opt out using a browser extension.
• Bunny Fonts: web font delivery. Your browser requests the Figtree font from Bunny's CDN when loading RallyHub pages.

5. Your rights

Under the Australian Privacy Act you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or outdated information
• Request deletion of your account and associated data
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your data

To exercise any of these rights, contact us via the contact form. We will respond within 30 days.

6. Cookies

RallyHub uses a session cookie to keep you logged in, a CSRF token cookie for form security, and Google Analytics cookies for anonymous usage data. No advertising or cross-site tracking cookies are used.

7. Data retention

Your data is retained for as long as your account is active. If you request deletion we will remove your personal information within 30 days, except where retention is required by law or necessary to resolve a dispute. Match records involving other players may be retained in anonymised or aggregated form.

8. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via an in-app notification or email. The date at the top of this page reflects the most recent revision.