Confidentiality Agreement

This Confidentiality Agreement ("Agreement") sets forth the obligations of users of the RallyPack platform ("the App") regarding the protection of sensitive information accessed, submitted, or shared through the App. By using RallyPack, you agree to the terms of this Agreement.

"Confidential Information" includes all data submitted to or accessible through the App, including but not limited to:

• Personal identifiable information (names, addresses, contact details)
• Family member details, including medical conditions and emergency contacts
• Pet information, including microchip numbers and health data
• Emergency cache inventories and locations
• Meeting spot coordinates and descriptions
• Emergency plans and preparedness notes
• Any information shared by or about other users linked to your household
• Status alert channel connections — Telegram chat identifiers and Discord webhook URLs you have configured
• Business compliance records, including staff certifications, equipment details, inspection dates, and the contents of any certificate, service report or inspection record you upload
• Organization membership details, including which members belong to an organization and the role each holds
• Contact and feedback messages sent to our team, and business referrals you submit

What is not Confidential Information:

Information you deliberately publish is not confidential. Community drill listings you submit, needs board posts you choose to share with organizations, and the anonymized regional aggregates shown on the readiness map are public or shared by design. Everything else listed above remains confidential.

As a user of RallyPack, you agree to:

• Keep all information about other users, family members, and linked households strictly confidential
• Not share, sell, disclose, or distribute any Confidential Information accessed through the App to unauthorized third parties
• Use Confidential Information solely for personal emergency preparedness purposes
• Take reasonable precautions to prevent unauthorized access to your account and the information accessible through it
• Notify RallyPack immediately if you become aware of any unauthorized disclosure of Confidential Information
• Not screenshot, export, or reproduce other users' personal emergency data without their explicit consent

RallyPack commits to:

• Protecting your Confidential Information using industry-standard security measures (AES-256-GCM encryption, TLS 1.3, SHA-256 hashing)
• Not selling your personal information to third parties
• Limiting access to your data to authorized personnel only, on a need-to-know basis
• Disclosing your information only when required by law, court order, or to protect public safety
• Notifying you of any material data breach affecting your information as required by applicable law
• Maintaining SOC 2 Type I security controls and policies

When you add family members or link household members to your account:

• You represent that you have obtained appropriate consent from adult family members before entering their information
• You are responsible for the accuracy and lawful submission of information about minors in your household
• Linked users will have access to shared emergency plans — you agree to only link individuals you trust
• You understand that linked users may view cache locations, meet spots, and emergency plans associated with your household

Keeping your own plan under your own control:

• Accepting shared access to another person's plan gives you a view of that plan. It does not merge, copy or duplicate it, and it does not take your own plan away from you
• You remain the owner of your own records at all times, and can leave a shared plan without losing anything of your own
• The person who granted access controls what is shared and can withdraw it at any time

Organization affiliations and roles:

• An account may hold a household context and one or more organization affiliations at the same time. Data entered in one context is not automatically visible in another
• Access to an organization's records is scoped by the role granted to each member. Members see only what their role permits
• Who granted access, to whom, and in what role is recorded, so sharing within an organization stays auditable
• The account owner is accountable for the members they invite and the roles they assign, and must remove access when a person no longer needs it
• Compliance records about a named staff member belong to the organization, not to the individual's personal account, and are handled under the organization's instructions

Confidentiality obligations do not apply to information that:

• Is or becomes publicly available through no fault of either party
• Was rightfully known to you prior to disclosure through the App
• Is required to be disclosed by law, regulation, or court order (with prior notice to RallyPack where permitted)
• Is disclosed with the express written consent of the person to whom it relates

Upon account deletion, your personal Confidential Information will be permanently removed within 30 days, subject to the limited exceptions described in our Privacy Policy (pet microchip records and anonymized aggregate statistics). Please refer to our Privacy Policy for full details.

Any breach of this Agreement may result in immediate termination of your account and access to the App. RallyPack reserves the right to seek all available legal remedies for unauthorized disclosure or misuse of Confidential Information.

For questions about this Confidentiality Agreement:

Email: privacy@rallypack.tech
Data Protection Officer: dpo@rallypack.tech