Consumer Health
Data Privacy Policy

Effective date: October 23, 2026
Swing-processing consent version: 2026-07-28-public-v1-2
Separate optional analytics disclosure version: 2026-09-30-product-analytics-v3
Policy revision: 2026-10-23-journal-calendar-no-tracking-2.0-77

Rally AI ("Rally," "we," or "us") is operated by Bryce Ranchero, an individual in Illinois. This policy describes the consumer health data Rally may collect, the sources and purposes, the limited processing and disclosures, and how a consumer can exercise applicable rights.

1. Categories collected and processed

Tennis journal in version 2.0, build 77: session dates and times, time zone, session type, court duration, title, notes, practice focus, local record identifiers, manual or timed source, save/update times and derived court-time summaries are entered or calculated on your iPhone. Rally treats this tennis-activity information conservatively as consumer health data where applicable. The tennis journal does not read or write Apple Health data.

Session timer: Start session saves a running Practice session with a local identifier, start time, original time zone and journal date. Closing Rally or locking the phone does not end it; elapsed time is calculated from the saved start. End & save records the duration and end time as one completed journal entry. You can edit it afterward. Discard removes the running timer without adding court time. Delete All Data removes running and completed journal data. Exports include completed entries, not a running timer. No background location, new permission, analytics event or Calendar event is created by timing.

Optional Calendar planning: calendar names, identifiers and provider names, and event titles, identifiers, dates, times and all-day status are used on your iPhone to display plans from selected calendars and open them through Apple’s Calendar interface. Tennis-activity information is treated conservatively as consumer health data where applicable. No event content is sent to Rally’s servers, analytics, Meta or RevenueCat. Planned events do not count as completed journal sessions.

Local video modes: standalone Skeleton Overlay and Wall Practice process your selected video, body movement and derived review information on your iPhone without uploading their footage or pose tracks to Rally's analysis server. Original audio may be used for local playback or export when you choose it. Local files follow the app's deletion controls; exported copies in Photos, Files or another destination must be managed there separately. The server-processing descriptions below apply to uploaded swing analysis.

Previously collected coarse tennis-use information: build 77 disables new product-analytics collection and delivery and hides the analytics choice in setup and Profile. Existing protected deletion requests can still retry. The following describes earlier analytics-enabled versions: with separate affirmative analytics consent, selected tennis level, goal and playing frequency, selected stroke type, valid first/repeat analysis milestones and whether the report appeared may be collected with a random analytics identifier and, with the current analytics permission, an opaque RevenueCat customer identifier for connecting subscription records with permitted app use, together with a random attempt identifier, app version, session and time. Rally treats these limited categories conservatively as consumer health data where the law applies. Scores, mechanics, pose, video, confidence and coaching are excluded from this analytics path.

• Swing video: the audio-free tennis clip selected or recorded for analysis.
• Body landmarks and mechanics: temporary 33-point whole-body pose estimates, including a small set around the face and hands; the compact 13-joint motion track returned to the app; and measured swing mechanics derived from the clip.
• Analysis results: stroke and hitting-hand selection, score, confidence, technique breakdown, contact image, priority fix, drill, and measured motion review.
• Linked request context: the pseudonymous installation, consent, authorization, quota, abuse-control, timing, and coarse outcome records used to provide and secure the requested analysis, only to the extent those records are legally treated as linked consumer health data.

2. Sources

• The consumer: the swing clip, selected stroke and hitting hand, consent, and request.
• The consumer's iPhone: camera or photo-library input and the pseudonymous authorization and service facts needed to make the request.
• Rally's analysis service: the temporary landmarks, mechanics, contact image, score, confidence, technique breakdown, priority fix, drill, and compact motion track derived from the submitted clip.

3. Purposes and manner of processing

Tennis journal: information is used locally to save, edit, organize and summarize the tennis you choose to record. It is not used for advertising, marketing, audience creation, model training or product analytics, and is not sent to Rally's analysis server, subscription provider or Meta. Saving a manual or timed session does not upload a video or request AI analysis.

Earlier analytics-enabled versions used optional coarse product analytics to measure whether consenting players obtained a result, saw it and returned. That optional processing required the applicable analytics choice. Build 77 does not collect or deliver those events; RevenueCat subscription reporting remains separate.

Rally's required swing-analysis processing accepts the adult consumer's requested clip, removes audio on the iPhone, securely transmits the minimized clip, estimates pose landmarks and tennis mechanics, returns the requested analysis and measured motion review, saves trusted results locally on the consumer's iPhone, enforces current consent and the free-use quota, secures the service, and investigates content-free operational failures. The separate optional measurement purpose above applies only after the analytics choice.

Rally does not use consumer health data to identify or authenticate a person from their body, diagnose or treat a medical condition, create an advertising or marketing profile, train an AI model, or make decisions about employment, insurance, credit, housing, health care, or another eligibility determination.

4. Categories disclosed, processors, third parties, and affiliates

Calendar provider: creating or editing a plan uses Apple’s native Calendar interface and requires your Save action. Your chosen calendar provider may store or sync the event with your account under its own settings. Rally does not copy journal notes into a calendar draft or include calendar events in journal exports.

Tennis journal exports: Rally does not automatically disclose journal content to its providers. Export insights produces a visual PDF of completed-session statistics and charts. The secondary Export session data (JSON) option contains all completed entries and notes. Neither includes running timers, saved analyses or native calendar events. The file is passed to the Files, cloud or app destination you choose, whose storage, sharing and privacy settings apply. Later changes in Rally do not update an exported copy.

Operational authorization storage: Rally uses Neon PostgreSQL, operated by Databricks, Inc. with Neon, LLC, in AWS Ohio for private installation authorization, quota, abuse-control, revocation and analytics deletion records. Swing videos, landmarks, scores, coaching, receipts and RevenueCat identities do not enter this database. Durable ownership and deletion authorization do not automatically expire with inactivity or a local phone reset. See the general Privacy Policy for the processor and record-retention schedule.

• Processor disclosure: after the user agrees, the audio-free swing video and request fields are disclosed over encrypted HTTPS to Modal Labs, Inc., Rally's contracted cloud-infrastructure processor, only to run and secure the requested analysis. Rally bundles and runs MediaPipe 0.10.14 inside Rally's server container hosted on Modal. Modal is the processor to which Rally directly routes the request; its applicable infrastructure subprocessors are governed by its Data Processing Addendum. This processor disclosure is necessary to provide the requested service and is not a sale.
• Historical optional analytics processor: in earlier analytics-enabled versions, with separate affirmative analytics consent, Amplitude, Inc. received only the coarse optional tennis-use categories above through Rally's first-party relay on the U.S. service. It receives no swing video, audio, landmarks, mechanics, scores, coaching, confidence, receipts, credentials, contact information or free-text errors. With separate analytics permission, Rally includes the opaque RevenueCat customer identifier to connect subscription records with permitted app use. This product-analytics link is not shared with advertising destinations. Manual and timed journal content, running timers, calendar content and journal Insights are excluded. Replay, autocapture and advertising destinations are not enabled.
• Other third parties or affiliates: beyond the disclosed Modal and optional Amplitude processing, Rally does not disclose consumer health data to advertisers, data brokers, affiliates, or other unrelated third parties. The swing video, landmarks, mechanics, and analysis-request data are not sent to Google, OpenAI, Anthropic, or another external model-inference API.
• Sale: none. Rally does not sell or offer to sell consumer health data.

For personal data processed during swing analysis, Rally's agreement with Modal incorporates Modal's Data Processing Addendum. It limits processing to providing the contracted service, requires confidentiality and appropriate security, requires deletion, and binds applicable subprocessors to written terms at least as protective as the DPA. Rally therefore requires the same or equal protection for the personal data Modal processes. If Rally proposes a new category, purpose, or legally defined sharing that is not necessary to provide the requested service, Rally will disclose it and obtain the separate consent required by applicable law before the new processing begins.

5. Retention and deletion

Calendar choices: Disconnect calendars and Delete All Data clear Rally’s calendar selections, connection/filter preferences and displayed event cache. They do not delete events from your native calendars or revoke the iPhone permission. Manage calendar events through Calendar or its provider and change Rally’s Calendar permission in iPhone Settings. Calendar providers control their own storage, synchronization and deletion.

Tennis journal: entries are stored locally with file protection and remain until you delete them, use Delete All Data or remove the app. Rally requests exclusion of the journal store from device backup; this is not an absolute guarantee against inclusion or restoration. Automatic sync, in-app import and guaranteed reinstall/new-device recovery are not provided. Export a copy if you want to keep one. Exported copies must be deleted separately at their destinations.

Historical optional analytics follows the general Privacy Policy. Build 77 does not collect or deliver product-analytics events and has no analytics enable/disable control; contact Rally through Support to request access or deletion of previously shared information. Protected deletion retries and Delete All Data remain available. The following describes earlier analytics-enabled versions and retention of their data: a local queue limited to seven days and 100 events, local milestone counts until withdrawal/deletion, callback receipts limited to seven days and 1,000 records, and one-month Amplitude event retention from ingestion, subject to scheduled retention processing. Displaying the analytics choice does not begin collection; collection begins only after you confirm the sharing choice under the current in-app disclosure. Superseded permission requires a new current-version choice. Prior permission is not silently upgraded; old queued events are discarded and the old analytics identity is retained only for protected deletion retry. Recorded opt-outs remain off. Turning sharing off or using Delete All Data stops collection, clears the active local analytics identity and queues deletion of the prior Amplitude identity. Protected, narrowly scoped retry records survive local reset until the relay accepts the request. Offline requests retry on later app use; provider acceptance or scheduling is not completed deletion. Rally tracks provider completion, including applicable backups, separately from request acceptance or scheduling. Re-enabling uses a new identity. These choices do not cancel a subscription or delete Apple/RevenueCat records.

• Server video and temporary landmarks: released and destroyed when the request completes or fails. The application removes the temporary upload; if normal removal fails, it truncates the file content to zero, retries, and records a content-free critical privacy event if removal still cannot complete.
• Server results: the contact image, motion payload, score, and coaching result are returned to the app and are not intentionally retained by Rally's server after the response.
• On-device results: a trusted result, contact image, audio-free review video, and compact motion track may remain only on the consumer's iPhone until the consumer deletes the analysis, deletes all Rally data from that iPhone, or uninstalls Rally.
• Limited service records: authorization, quota, abuse-control, and content-free operational records follow the schedules in the general Privacy Policy, unless an authenticated deletion duty applies or a limited legal or security exception permits retention.

6. Consumer rights

Subject to authentication and applicable law, a consumer may ask Rally to:

• confirm whether Rally is collecting, sharing, or selling consumer health data concerning the consumer;
• provide access to the consumer health data Rally can link to the consumer and a list of applicable third parties or affiliates, including a contact method when required;
• correct verifiable consumer health data where a correction right applies;
• withdraw consent and stop future collection or sharing;
• delete consumer health data from Rally's records and network and notify applicable processors, contractors, affiliates, or other recipients; and
• appeal Rally's refusal to act on a request.

Rally will not unlawfully discriminate against a consumer for exercising these rights. Rally will not require a new account. Requests are free at least twice each year; a reasonable fee or refusal may apply only when permitted for a manifestly unfounded, excessive, or repetitive request.

7. Secure request and appeal process

Email ricebboi@gmail.com with the subject Privacy Request. State the right you want to exercise and your state of residence. If the request concerns an anonymous installation, contact Rally before deleting the local installation credential or uninstalling. Include only enough information to help authenticate the request, such as the consent date shown in Profile and the approximate date of a recent analysis. Do not email an installation credential, App Store credentials, payment information, identity documents, a swing video, or pose data unless Rally explains why a narrower method is insufficient.

Rally will use commercially reasonable efforts to authenticate through the existing email channel and limited service records. Rally may request additional information reasonably necessary to authenticate. If authentication is not possible, Rally will explain the limitation rather than disclose or delete data tied to another installation.

The exact Washington and Nevada response, deletion, backup, and appeal periods are listed on Support & Privacy Choices. To appeal a refusal, reply to Rally's decision with the subject Privacy Appeal.

8. Security and access limits

Rally restricts access to consumer health data to the operator and processor access reasonably necessary to provide the requested analysis, secure the service, and fulfill an authenticated request. Rally uses encrypted transport, revocable per-device authorization, temporary server files, content-minimized logs, iOS file protection, and on-device storage. Rally maintains administrative, technical, and physical practices intended to protect confidentiality, integrity, and availability in proportion to the limited volume and nature of the data.

9. Changes and contact

Rally will not collect, use, or share an additional category of consumer health data or use it for an additional purpose not disclosed here without first publishing the change and obtaining any affirmative consent required by applicable law.

Operator: Bryce Ranchero, an individual in Illinois.
Requests, appeals, and questions: ricebboi@gmail.com.
Support & Privacy Choices
General Privacy Policy