Privacy Policy

Effective: September 9, 2026. Policy version: 2026-09-09-ad-measurement.
Swing-processing disclosure: 2026-07-28-public-v1-2.
Advertising measurement: a separate, optional Apple tracking-permission prompt in app version 1.0.2 and later, described in section 9.

This Privacy Policy and biometric retention schedule explain how Rally AI ("Rally," "we," or "us"), operated by Bryce Ranchero, an individual in Illinois, handles information through the Rally AI iPhone app and public-launch website. Privacy questions, rights requests, appeals, and requests for the operator's legal mailing information may be sent to ricebboi@gmail.com.

1. Information and sources

• Optional advertising measurement: if you grant Apple's tracking permission, Meta's Facebook SDK receives installation and app activation/session events, app/device identifiers including the advertising identifier permitted by iOS, and associated technical information such as app/SDK version, device and operating-system information, timestamps, network connection information, permission status, and SDK configuration/status information. This is separate from Rally's swing-analysis data; see section 9.
• Swing video: the clip you record in Rally or choose from your photo library. Rally removes audio on your iPhone before upload.
• Temporary body-landmark and mechanics data: MediaPipe software running inside Rally's hosted service estimates 33 whole-body pose landmarks on each detected frame. The internal track includes a small set around the face and hands. The app receives a compact motion track containing only 13 measured joints—nose, shoulders, elbows, wrists, hips, knees, and ankles—and does not receive the other internal landmarks.
• Analysis inputs and results: selected stroke and hitting hand; measured mechanics; score, confidence, technique breakdown, priority fix, drill, contact image, and compact motion track. Missing or low-confidence joints remain missing rather than being guessed.
• Authorization, consent, and service records: a random installation identifier; hashed or scoped device, credential, key, installation, and network-source references; App Attest public-key and receipt evidence, environment, counters, and timestamps; a scoped installation credential; consent version, signature time, and random consent record identifier sent with a request; weekly quota, rate-limit, short challenge/reservation, abuse-control, request-size, duration, timing, and coarse success/rejection records. These come from the app, device, network request, and Rally's security service.
• Subscription verification: Apple-signed StoreKit transaction and renewal evidence may be sent with an analysis request to verify Rally Pro access. Rally does not receive payment-card details or Apple Account credentials.
• Information on your iPhone: saved results and contact images; for trusted analyses, the processed audio-free review video and compact pose track; profile answers, court nickname, preferences, adult-eligibility result, consent receipt, and reminder state. Review videos use opaque filenames. Rally evaluates the birthdate you enter only on the iPhone and does not save or upload that date.
• Waitlist and support information: the email address and message content you voluntarily submit. Form and email services also receive ordinary request information such as IP address, browser type, access time, and referring page.
• Website delivery information: hosting and font providers receive the technical information needed to deliver and secure the page, such as IP address, browser/device information, requested page, time, referring page, and website hostname.

2. Uses and limits

Rally uses the audio-free clip, temporary landmarks, and mechanics only to provide the tennis-swing analysis and measured motion review you request. The skeleton contains measured body joints; Rally does not add a racket path unless a real racket track was produced. Rally does not use the clip or measurements to recognize a face, identify or authenticate a person from their body, provide medical diagnosis or treatment, advertise, create a marketing profile, or train an AI model. Rally bundles and runs MediaPipe 0.10.14 inside Rally's server container hosted on Modal. The swing video, landmarks, mechanics, and analysis-request data are not sent onward to Google, OpenAI, Anthropic, or another external model-inference API.

Rally uses installation, App Attest, scoped credential, consent, network-source, rate-limit, quota, and request records to authorize the genuine app, enforce current consent, prevent abuse, apply the free-use quota, operate the service, and investigate failures. StoreKit evidence is used only to verify subscription access. Launch-list email is used for launch and related product communication. Website information is used to deliver and secure the site and its fonts.

3. Biometric notice and written release

Illinois and Texas laws define certain scans or records of hand or face geometry as biometric identifiers. Rally does not create a faceprint or voiceprint and does not use its measurements to identify anyone. Whether a particular pose measurement is legally covered can depend on the law and facts; Rally does not rely on an exemption. It instead applies advance notice, written electronic consent, purpose limitation, security, disclosure controls, and the destruction schedule below.

Before capture, photo-library selection, or upload is available, the person shown must choose a date of birth showing they are at least 18, read the specific disclosure on Rally's ONE AGREEMENT screen, and tap Agree & Continue. The screen states that this tap is voluntary consent and the user's electronic signature. It lists what leaves the iPhone, identifies Modal Labs, Inc. as Rally's contracted processor, explains the analysis purpose, describes the 33-landmark internal processing and 13-joint app output, and explains retention and destruction. If the user does not agree, Rally does not make an upload. Rally does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.

4. Service providers and disclosures

• Meta Platforms, Inc.: after you allow Apple's tracking prompt, Meta receives the advertising-measurement information described in sections 1 and 9 to measure Rally's advertising and conversions. Rally enables the SDK setting limiting event/data use to analytics and conversions. Meta handles information under its applicable terms and Privacy Policy. Rally does not send swing video, landmarks, scores, coaching, quiz answers, purchase receipts, or first-party analysis credentials to Meta.
• Modal Labs, Inc.: after the user agrees, the app sends the audio-free video and request fields listed above over encrypted HTTPS to Rally's analysis endpoint hosted on Modal's cloud infrastructure. Modal is Rally's contracted processor and the processor to which Rally directly routes the swing-analysis request. Rally bundles and runs MediaPipe 0.10.14 inside Rally's server container hosted on Modal. Modal's terms incorporate a data-processing addendum that limits processing to the contracted service and addresses security, confidentiality, subprocessors, and deletion. Modal states that web-endpoint request and response payloads are proxied to Rally's container and are not stored at its edge.
• Apple Inc.: Apple handles App Store distribution, App Attest, and StoreKit under its own terms. Rally receives signed evidence needed to verify the genuine app and subscription access. Rally may receive feedback or diagnostics a user chooses to share through Apple.
• Formspree, Inc.: Formspree accepts, screens, stores, and emails launch-list submissions and related request information.
• GitHub, Inc.: GitHub Pages hosts the public-launch and policy pages and processes ordinary website request information.
• Adobe Inc.: Adobe Fonts delivers site typefaces and receives the hostname, font-project information, and visitor IP address. Adobe states that its web-font service does not set cookies to serve fonts and does not store the IP address it receives for delivery.
• Google LLC: Gmail processes waitlist notification copies and messages sent to Rally's privacy contact.

For personal data processed during swing analysis, Rally's agreement with Modal incorporates Modal's Data Processing Addendum. It limits processing to providing the contracted service, requires confidentiality and appropriate security, requires deletion, and binds applicable subprocessors to written terms at least as protective as the DPA. Rally therefore requires the same or equal protection for the personal data Modal processes. Rally does not authorize a provider to use swing video or body-landmark measurements for advertising, identity recognition, data brokerage, or model training. Rally may disclose information when required by applicable law or valid legal process, to protect the service and users, or at the user's direction and with legally sufficient consent.

5. Retention and destruction schedule

• Server video and temporary landmarks: Rally's application releases the in-memory 33-landmark track and removes the temporary upload file when the request completes or fails. If normal file removal fails, the application truncates the file content to zero, retries removal, and records a content-free critical privacy event if removal still cannot complete. Rally does not intentionally retain or reuse the file. The clip and landmarks are not written to a Rally backup, Modal Volume, biometric database, or model-training set.
• Server results: the returned contact image, motion payload, score, and coaching result are not intentionally retained by Rally's server after the response.
• Operational logs: logs exclude video, audio, landmark coordinates, contact image, score, detailed mechanics, and coaching result. They contain the limited request and security facts described above. Rally does not copy them into another log archive. Modal's currently published plan-dependent schedule is one day on Starter, 30 days on Team, and configurable on Enterprise.
• Consent receipt: the app keeps the consent version, signature time, and random record identifier on the iPhone and sends them with an analysis request. The server validates them but does not intentionally retain the full signature time or record identifier; the short-lived operational log records the consent version.
• On-device results and motion review: a trusted analysis may retain its audio-free processed video, compact 13-joint pose track, score, coaching result, and contact image on that iPhone until you delete the analysis, delete all Rally data, or uninstall Rally. Withdrawing consent blocks future uploads but does not delete completed analyses.
• On-device consent and preferences: remain until you withdraw consent, delete all Rally data, reset the relevant preference, or uninstall Rally.
• Authorization, quota, and abuse-control records: hashed or scoped installation/key/network references, App Attest public-key and receipt data, counters and timestamps, weekly quota counts, short reservations, and rate-limit buckets are stored in Modal Dict. Modal states each current Dict entry expires seven days after its last read or write. Active use may refresh some entries. A challenge is valid for five minutes and is deleted when used; an unused challenge can remain inactive for up to seven days. A device credential can be valid locally for up to 90 days, but its server record may expire earlier after inactivity.
• StoreKit evidence: transaction and renewal JWS values are verified in memory. Rally code does not intentionally log or persist them or the verification result.
• Launch list and support: Rally-controlled Formspree and email copies remain only while needed for launch communication, support, legal compliance, security, or an opt-out record. Rally will delete verifiable copies within 30 days after completing a deletion request or ending the launch-list program, subject to limited legal or security preservation. Provider security records may follow longer provider schedules.
• Website delivery records: GitHub, Adobe, and network providers retain delivery/security records under their own schedules. Rally does not maintain a separate website analytics database.

For any covered biometric identifier or information Rally possesses, the permanent-destruction deadline is the earliest applicable deadline: when the collection purpose is satisfied; the Illinois backstop of three years after the person's last interaction; or the Texas backstop of a reasonable time no later than one year after the collection purpose expires. A valid preservation law, warrant, or subpoena may require a limited exception.

6. Your choices, requests, and appeals

Advertising measurement: you can decline Apple's tracking prompt or turn off Rally AI under iPhone Settings → Privacy & Security → Tracking. Declining does not affect Rally Free or Pro. This system permission is separate from the swing-processing agreement and is managed by iOS. Turning it off prevents Rally from initiating further app-activation reporting; it does not retract events already received by Meta. Previously shared information follows Meta's applicable retention practices, which can depend on its purpose, settings and legal obligations. Rally does not promise automatic deletion from Meta when you clear local app data. Contact Rally using the process below for requests concerning previously shared information.

You may decline the electronic release and no clip will be uploaded. In History, delete an analysis and its retained review video and pose track. In Profile → Privacy & Data, review the signature date, withdraw future upload consent, or use Delete all Rally data from this iPhone to remove local analyses, review files, preferences, consent state, and the local installation credential.

The all-data button is local-only. It does not call a remote endpoint or erase provider logs. Limited authorization, quota, abuse-control, and operational records follow the schedule above. Rally does not retain a server swing-history library, so after a request there is normally no remote video, landmark track, score, contact image, or motion review to retrieve or delete. Clearing the local credential can make it impossible to connect a later request to an otherwise anonymous installation; if you plan to make a request, contact Rally before deleting the local credential.

Use the process and exact state-specific response periods on Support & Privacy Choices to request access, correction, withdrawal, deletion, or a third-party list; remove a launch-list submission or manual recovery label; report that a minor used the service; or appeal a refusal.

7. Adults-only service and other people

Rally is not offered to anyone under 18 and is not directed to children. Before recording or choosing a swing, the app requires a neutral birthdate-first eligibility check. The date is evaluated only on the iPhone and is not saved or uploaded. An under-18 result locks the app. Do not upload another person's swing or a clip containing a minor or bystander. The electronic release requires the signer to confirm that they are the adult shown. If Rally learns that a minor submitted information, Rally will disable the relevant credential and delete verifiable information under its control, subject to legal or security preservation.

8. Security and incidents

Rally uses encrypted transport, revocable per-device credentials, temporary server files, minimized logs, opaque local filenames, iOS file protection, and on-device history. Modal states that customer data is encrypted in transit and at rest and that it maintains SOC 2 Type 2 controls. No security measure guarantees absolute protection. Rally will investigate suspected unauthorized access and provide consumer, regulator, processor, or health-data breach notices required by applicable law.

9. Swing-data limits and optional advertising measurement

Rally does not sell, lease, trade, or profit from swing video or body-landmark measurements; use them for advertising or cross-context tracking; or use them to train an AI model.

Rally can ask your permission through Apple's App Tracking Transparency prompt to measure whether its Facebook and Instagram advertising brings people to the app. If you allow it, Rally uses Meta's Facebook SDK to send the app installation, app activation/session, identifier, and technical information described above. These signals may be connected with information Meta holds to measure advertising and conversions. Rally limits the events it requests to installation and app activation/session reporting. Automatic purchase and subscription logging, advanced matching of contact information, and event suggestions are turned off. SDK configuration and technical status requests may still occur after permission is granted.

Your advertising choice is optional and separate from permission to analyze a swing. Declining does not affect Rally Free or Pro, its price, quota, lessons, or coaching. Rally's app does not initialize this measurement connection before the adult agreement, completed setup, and Apple's tracking permission. See section 6 for how to change your choice and make privacy requests.

Browser privacy signals: Rally does not operate advertising analytics on this public-launch website. Browser Do Not Track and Global Privacy Control signals do not control the separate iPhone permission; use Apple's Tracking settings for the app. Rally's delivery, font, form, and email providers may independently process limited technical information under their own policies. Rally does not authorize advertising use of its consumer health or swing data.

10. Changes

Rally may update this policy as the product or law changes. The effective date and version above show the current policy. Rally notifies users of a material change to video, landmarks, purposes, disclosure, or retention by publishing the revised policy and requiring a new in-app notice and electronic consent before another upload. Non-material clarifications may be posted without a new consent.

11. Contact

Operator: Bryce Ranchero, an individual in Illinois.
Privacy questions, rights requests, and appeals: ricebboi@gmail.com.
Support & Privacy Choices
Consumer Health Data Privacy Policy