Privacy Policy

RallyPack ("we", "us", "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our emergency preparedness platform.

Age Requirement:

RallyPack is intended for users who are 13 years of age or older. If you are under 13 years of age, you may not use this service. Minors under 13 may be added to family groups by adult users but cannot create their own accounts.

Personal Information:

• Account Information: Email address, full name, display name
• Location Data: Street address, city, state/province, postal code, country, latitude, longitude coordinates
• Profile Data: Notification preferences, alert settings

Sensitive Information:

• Family Member Data: Names, relationships, ages, medical conditions, emergency contacts
• Pet Information: Names, species, breeds, ages, microchip numbers, medical conditions, photos
• Health Data: Medical conditions for family members and pets
• Emergency Resources: Cache locations, inventory items, meet spot coordinates

Usage Information:

• Notifications history and read status
• Emergency cache and supply tracking data
• Weather alert preferences and history
• Readiness quiz answers and the resulting score

Status Alert Channels:

• Channel Connections: If you connect a messaging account to broadcast an "I'm Safe" or "Need Help" status, we store the connection identifier needed to send to it — for example a Telegram chat ID and username, or a Discord webhook URL for a server you choose.
• Status Broadcasts: Your current status (safe, needs assistance, or unknown) and the time it was set, so your household can see it.
• Control: These channels are optional and can be disconnected at any time in Settings.

Business & Organization Data:

• Organization Details: Organization name, country, and the email address of the account owner.
• Membership: Which organization a member belongs to and the role they hold, so access can be scoped correctly.
• Compliance Records: Staff certifications, workplace fire and life-safety equipment, and household safety devices, together with their inspection or expiry dates.
• Uploaded Documents: Certificates, service reports and inspection records you upload are stored in private storage. They are never publicly readable; they are opened through a short-lived signed link that expires, and only for accounts authorized to view them.
• Billing: Subscription tier and billing status. Card details are handled entirely by Stripe and never reach our servers.

Community Submissions:

• Needs Board: When you post a need, or choose to share an individual request with organizations, we store the request, its location area and the contact details you supplied so organizations can respond.
• Drill Listings: Community drills you submit — the title, organizing body, type, date, location, description and the contact email you provide — are shown publicly in the drill directory. Only submit details you are willing to make public.
• Referrals: Business referrals you submit are stored with the referred organization's details, your name and email, and any personal message, and are shared with our team for follow-up.
• Contact & Feedback: Messages sent through the contact and feedback forms, together with the anonymous per-browser identifier used to rate-limit those forms.

Camera & Scanning:

• Camera Access: When you use our barcode scanning feature, the app requests access to your device camera. Camera access is only used for scanning barcodes/QR codes to add items to your emergency caches.
• No Storage or Transmission: Camera images are processed locally on your device and are never stored, uploaded, or transmitted to our servers. Only the decoded barcode text is saved to your cache inventory.
• Optional Feature: Camera access is completely optional. You can manually enter barcode numbers without granting camera permissions.

SOC 2 Type I Compliance:

RallyPack maintains security controls in accordance with SOC 2 Type I standards, addressing Security, Availability, Processing Integrity, Confidentiality, and Privacy criteria. Our infrastructure and processes are designed to protect customer data through comprehensive security policies and procedures.

Primary Database (Base44):

Your data is primarily stored in Base44's secure infrastructure with enterprise-grade security measures including encryption at rest and in transit.

Backup Database (Supabase Integration):

For redundancy and compliance purposes, we sync selected data to a separate Supabase database using the following security measures:

• SHA-256 Hashing: User email addresses are hashed with a unique salt to create anonymized identifiers
• AES-256-GCM Encryption: Highly sensitive data including:
  • Family member names, medical conditions, and emergency contacts
  • Pet names, microchip numbers, and medical information
  • Notification content (titles and messages)
  • Display names and personal identifiers
• Pseudonymization: All record IDs are hashed to prevent direct linkage
• Minimal Data Sync: Only necessary data for backup and compliance is synced

Encryption Standards:

• All data transmissions use HTTPS/TLS 1.3
• Encryption keys are stored separately from encrypted data
• PBKDF2 key derivation with 100,000 iterations
• AES-256-GCM authenticated encryption for sensitive fields

Security Controls (SOC 2 Compliance):

• Access Controls: Multi-factor authentication, role-based access, and least privilege principles
• Monitoring: Continuous security monitoring, logging, and incident response procedures
• Data Protection: Encryption at rest and in transit, secure key management
• System Availability: Regular backups, disaster recovery plans, and uptime monitoring
• Change Management: Controlled deployment processes and code review procedures
• Vendor Management: Third-party security assessments and compliance verification

• Emergency Preparedness: To provide personalized weather alerts, emergency notifications, and disaster planning tools
• Location Services: To deliver location-specific weather data and emergency shelter information
• Resource Management: To help you track emergency supplies, caches, and expiration dates
• Barcode Scanning: To quickly add items to your caches by scanning product barcodes using your device camera (processed locally, not stored or transmitted)
• Family Coordination: To facilitate family emergency planning and communication
• E-Commerce: To process purchases of recommended emergency supplies through our integrated shopping cart and Stripe payment system
• Aggregate Emergency Planning: To create anonymized, regional statistics (shelter demand, preparedness levels, special needs projections, resource availability) that support emergency response coordination and public safety planning. Your personal data is never shared; only aggregate counts by geographic area are used.
• Service Improvement: To analyze usage patterns and improve our platform (using anonymized data)
• Compliance: To maintain backup records for legal and regulatory compliance

For users in the European Union, we comply with the General Data Protection Regulation (GDPR):

• Legal Basis: We process data based on consent, contractual necessity, and legitimate interests
• Right to Access: You can request a copy of your personal data
• Right to Rectification: You can update incorrect information through your profile settings
• Right to Erasure: You can request deletion of your account and data
• Right to Portability: You can export your data in a machine-readable format
• Right to Object: You can object to certain data processing activities
• Data Retention: We retain data only as long as necessary for service provision and compliance

For California residents, we comply with the California Consumer Privacy Act (CCPA):

• Right to Know: You can request information about what data we collect and how it's used
• Right to Delete: You can request deletion of your personal information
• Right to Opt-Out: You can opt-out of the sale of personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
• Categories of Data Collected: Identifiers, location data, health information, usage data
• Business Purpose: Emergency preparedness services, safety alerts, resource management

We do NOT sell your personal information to third parties.

Service Providers:

• Base44: Primary application platform and database
• Supabase (PostgreSQL): Encrypted backup database for compliance
• Stripe: Secure payment processing (receives payment information, email, and transaction details)
• Open-Meteo: Weather data provider (location coordinates only, no personal data)
• OpenStreetMap Nominatim: Address geocoding (address data only, no account information)
• Resend: Email delivery for notifications, reminders and shared plans (recipient address and message content only)
• Telegram: Delivers emergency alerts and status broadcasts you have opted into, to the chat you connected
• Discord: Posts status alerts to a server channel you configured with your own webhook URL

Public Emergency Data Sources:

• Wildfire, weather and emergency-alert information is drawn from public agency sources (for example national fire and weather services, and European and global satellite fire monitoring programmes). These sources supply event data only and receive no personal information about you.

Legal Disclosure:

We may disclose information if required by law, court order, or to protect rights, safety, and property.

Automated Access & AI Agents:

• Bot Detection: We detect and classify automated traffic (search crawlers, AI agents, scrapers) using User-Agent analysis and session behavior. No personal data is collected for this purpose beyond standard request metadata (IP, UA, timestamp).
• AI Agent Access: AI agents and chatbots that access RallyPack must comply with our Terms and this Privacy Policy. We do not share user personal data with AI systems. Any AI agent processing public RallyPack content must respect robots.txt and must not republish user-generated data.
• Training Data: User personal data and user-generated content are never shared with, sold to, or made available to AI model training systems. Using RallyPack content to train AI models without written authorization is prohibited.
• Analytics: Anonymous, aggregate usage statistics (page views, quiz completions, preparedness scores by region) may be collected to improve the service. These statistics cannot be traced back to individual users.

Third-party analytics and advertising measurement load only after you agree. Until you accept, no analytics or advertising script is loaded and no measurement request is sent.

• What runs after consent: aggregate page-view and conversion measurement (for example Google Analytics and Google Ads conversion tracking), used to understand which preparedness pages help people and which campaigns reach them.
• What is never measured: your preparedness data is not shared with analytics or advertising providers. Cache contents, family and pet details, health information, addresses and uploaded documents are never sent to them.
• Anonymous browser identifier: the public contact, feedback and referral forms use a random identifier stored in your browser — not a cookie that identifies you — purely to rate-limit submissions. It carries no personal data.
• Withdrawing consent: you can decline or withdraw at any time; declining does not limit any part of the service.

• Active Accounts: Data retained while account is active
• Deleted Accounts: Personal data permanently deleted within 30 days of account deletion request
• Pet Microchip Records (Special Exception): When you delete your account, we retain:
  • Pet microchip numbers
  • Last known owner name and address
  • Pet species and breed
  This information is retained indefinitely in an anonymized format to assist with emergency pet recovery and reunification during disasters. This practice complies with animal welfare laws and helps protect pets when traditional contact methods fail. Retained data is only accessible to authorized microchip registry partners and emergency response organizations. If you require complete pet data removal, contact privacy@rallypack.tech.
• Aggregated Emergency Statistics (Permanent Retention): We maintain anonymized, aggregate statistics to support emergency response planning. These statistics are calculated from active user data and include:
  • Shelter Demand Estimates: Aggregated counts of people and pets by geographic area (postal code or city level), used to project shelter capacity needs during emergencies
  • Regional Preparedness Index: Anonymous preparedness scores by region showing the percentage of households with emergency plans, supplies, or meet spots
  • Special Needs Projections: Aggregate counts (no individual identification) of populations requiring accessibility accommodations, medical support, or pet-friendly sheltering in specific areas
  • Resource Hotspots: General counts of emergency supplies and caches reported in geographic areas to identify resource availability during crises
  These aggregate statistics cannot be traced back to individual users. They are retained indefinitely to support public safety, emergency planning, and disaster response coordination. When you delete your account, your personal data is removed, but you remain counted in these regional aggregates until the next data refresh cycle (typically 30 days).
• Business Compliance Records: Retained while the organization's subscription is active, so inspection and certification history stays auditable. Uploaded documents are deleted with the record. If an organization's subscription ends, records are retained for 90 days to allow export, then removed.
• Backup Data: Encrypted backups retained for 90 days for disaster recovery
• Compliance Records: Anonymized data may be retained longer for legal compliance
• Audit Logs: Security and access logs retained for 12 months for SOC 2 compliance

• Access & Update: You can view and edit your profile and data through Settings
• Delete Data: You can delete specific entries (family members, pets, caches) at any time
• Account Deletion: You can delete your account through Settings → Danger Zone. Personal information will be removed, but pet microchip records are retained for emergency recovery purposes.
• Pet Data Removal: If you need complete pet data removal including microchip information, contact privacy@rallypack.tech with your request
• Notification Controls: Manage alert preferences in Settings
• Data Export: Request a copy of your data by contacting support

If you have questions about this Privacy Policy or wish to exercise your privacy rights:

Email: privacy@rallypack.tech
Data Protection Officer: dpo@rallypack.tech

For GDPR requests: gdpr@rallypack.tech
For CCPA requests: ccpa@rallypack.tech

We may update this Privacy Policy periodically. We will notify you of significant changes by email or through the application. Your continued use of RallyPack after changes constitutes acceptance of the updated policy.