Privacy Policy

Overview

Frequency 42 LLC ("Rally Text," "we," "us," "our") operates the Rally Text SMS communication platform and related web services at rallytext.org. This Privacy Policy applies to all data we collect through our website, platform, API, and SMS messaging system.

By using Rally Text you agree to the collection and use of your information as described in this policy. If you disagree, please do not use the service.

Information We Collect

Account & Team Data

When coaches or administrators create a team account we collect:

• Name, email address, and password (stored as a bcrypt hash — never plaintext)
• Team name, sport, and organization
• Role information (head coach, assistant coach, team manager, etc.)
• Billing address and payment method details (processed by Stripe — we do not store raw card numbers)

Member & Guardian Data

When athletes, parents, and guardians join a team we collect:

• Full name and mobile phone number
• Relationship to athlete (parent, guardian, legal guardian)
• Email address (optional — used for verification and account access)
• Athlete roster data (name, age group) as entered by coaching staff

Message & Activity Data

To operate the service and comply with Safe Sport and A2P 10DLC regulations we log:

• Outbound messages: body, timestamp, recipient count, delivery status
• Inbound messages: body, sender phone number, timestamp
• Keyword commands used by coaching staff
• Opt-in, opt-out, and STOP/START events
• Attendance records submitted via SMS keyword (e.g., ABSENT)
• Practice summaries submitted by coaching staff

Technical & Usage Data

• IP address and approximate geolocation (country/region only)
• Browser type, operating system, device type
• Pages visited, clicks, and session duration on the web dashboard
• API request logs for debugging and security auditing

How We Use Your Information

• Deliver the service — Route SMS messages between coaches and team members, process keyword commands, and maintain attendance and practice records
• Compliance & Safe Sport — Automatically CC verified guardians on messages sent to minors; maintain audit logs for nonprofit board and Safe Sport compliance reviews
• Account management — Send email verification, password reset, and billing notifications
• Support — Diagnose errors, respond to help requests, and investigate abuse reports
• Security — Detect and prevent unauthorized access, fraud, or abuse of the platform
• Content safety & moderation — Inbound messages are analyzed by an automated AI system to detect harmful content including threats, sexual content, bullying, harassment, discrimination, and inappropriate coach–athlete communications. Flagged messages are reviewed by our safety team. This is done to protect athletes, families, and coaches — especially minors — on the platform.
• Product improvement — Analyze aggregate, anonymized usage patterns to improve reliability and add features

We do not use your information for advertising, marketing profiling, or sale to third parties. Email addresses collected through Rally Text are used exclusively for platform administration and support — account verification, password resets, billing notifications, and responses to your support requests. We will never send unsolicited marketing emails or share your email address with third parties for promotional purposes.

Sharing & Disclosure

Within your team

Head coaches and team administrators can see the name, phone number, and role of all verified team members. Athletes can view their own profile. Guardians can see their linked athlete's profile.

Service providers

Each provider is bound by a data processing agreement and is prohibited from using your data for any purpose other than providing services to Rally Text.

Legal requirements

We may disclose information if required to do so by law, court order, or valid government request, or to protect the rights, property, or safety of Rally Text, our users, or the public.

Business transfers

If Rally Text is acquired or merges with another company, your data may be transferred as part of that transaction. We will notify users via email before any such transfer takes effect.

We never sell personal data. We do not sell, rent, trade, or otherwise transfer your personal information to third parties for their marketing or commercial purposes — ever. Email communications from Rally Text are limited strictly to platform administration, account management, and support matters.

SMS Messaging (A2P 10DLC)

Program description

Rally Text delivers recurring SMS messages from registered youth sports teams to verified team members — including coaches, athletes, parents, and guardians. Message types include practice reminders, schedule updates, event logistics, cancellation notices, attendance requests, and practice summary reports.

Message frequency

Message frequency varies by team activity and season. Typical active-season frequency is 2–5 messages per week. Frequency may be higher during race weeks or emergency weather events. Off-season frequency is minimal or zero.

Message and data rates

Msg & Data Rates May Apply. Standard message and data rates from your mobile carrier apply to all Rally Text messages.

Opt-out

Reply STOP to any message to unsubscribe. Additional opt-out keywords: STOPALL, CANCEL, END, QUIT, UNSUBSCRIBE, REVOKE, OPTOUT. You will receive one confirmation and no further messages will be sent from that team's number. To resubscribe, reply START.

Help

Reply HELP or INFO for assistance, or contact [email protected].

Supported carriers

Available on all major US carriers including AT&T, T-Mobile, Verizon, and regional carriers.

Consent

By providing your mobile phone number and joining a Rally Text team, you consent to receive recurring SMS messages from that team. Consent is not a condition of any purchase.

Phone number use

Your mobile phone number is used exclusively for team communications through Rally Text. We do not share your number with third-party marketers or any party outside of your team's coaching staff and Rally Text's messaging infrastructure.

No sharing of SMS opt-in data: Information gathered through the Rally Text SMS campaign — including your mobile phone number, opt-in status, and any consent records — will not be shared with any third parties or affiliates for marketing purposes. We do not sell, rent, lease, or transfer SMS subscriber data to any third party for promotional, advertising, or marketing use. This restriction applies regardless of whether you remain an active subscriber or unsubscribe.

Cookies & Analytics

The Rally Text web dashboard uses:

• Session cookies — Required to maintain your logged-in state. Set with SameSite=Strict and HttpOnly flags to prevent cross-site request forgery and script access. Cleared when you close your browser or sign out.
• CSRF tokens — Per-request tokens embedded in all state-changing API calls as an additional layer of protection against cross-site request forgery.
• Preference cookies — Store non-sensitive preferences such as your selected section in the dashboard. These persist across sessions.

Analytics

Our public marketing pages (rallytext.app and related pages) use Google Analytics 4 to understand aggregate traffic and page performance. Google Analytics collects anonymized data including pages visited, session duration, and general geographic region. We do not use Google Analytics inside the authenticated dashboard. You can opt out using the Google Analytics Opt-out Browser Add-on.

We do not use third-party advertising cookies, behavioral tracking pixels, or retargeting tools. You can disable cookies in your browser settings; this will prevent you from logging in to the dashboard.

Google User Data (OAuth Integrations)

Rally Text offers two optional OAuth integrations with Google. Both are strictly opt-in — they are never used unless you explicitly authorize the connection.

Sign in with Google

You may choose to sign in to Rally Text using your Google account instead of an email + password. This integration uses the standard openid, email, and profile scopes (non-sensitive) to verify your identity and pre-fill your name and email at signup. We do not access any other Google data through this integration. If you disconnect Google sign-in, your Rally Text account remains and can be accessed via email + password.

Google Calendar integration

Team managers may optionally connect their Google account so that Rally Text can publish the team's practice schedule (or shift schedule, rehearsal schedule, etc.) to a dedicated Google Calendar that members can subscribe to. This integration uses one sensitive scope:

• https://www.googleapis.com/auth/calendar — used only to:
  • Create a single dedicated Google Calendar for the team at the moment the manager clicks "Connect Google Calendar" (one calendars.insert call).
  • Add, update, and remove event entries on that one calendar when a manager edits the team's schedule in Rally Text (events.insert, events.patch, events.delete).

What Rally Text does NOT do with Google Calendar access:

• We do not read events from any other calendar on your Google account.
• We do not modify any calendar other than the dedicated one we created.
• We do not copy event content from Google back into the Rally Text database — events flow one direction only (Rally Text → Google).
• We do not share Google user data with any third party.
• We do not sell Google user data.
• We do not use Google user data to train artificial intelligence or machine learning models.
• We do not use Google user data for advertising, marketing, or any purpose outside the team calendar feature described above.

How Google user data is stored

The OAuth refresh token issued by Google is stored Fernet-encrypted at rest in our PostgreSQL database using a per-team symmetric key. Short-lived access tokens are held in process memory only and never persisted. We also store the ID of the single calendar we created for the team — no other identifiers from your Google account are retained.

How to disconnect / request deletion

You can disconnect Google Calendar at any time from Settings → Connect Google Calendar in the Rally Text dashboard. On disconnect:

• The stored refresh token is immediately cleared from our database.
• Rally Text stops pushing schedule updates to your Google Calendar.
• The calendar itself remains in your Google account — we do not delete data that belongs to you. You may delete it manually in Google Calendar if you wish.

You can also revoke Rally Text's access from your Google account at https://myaccount.google.com/permissions at any time. For any other data deletion request, email [email protected].

Limited Use Policy compliance

Rally Text's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Payment Data

All payment processing is handled by Stripe. When you subscribe to a plan or add-on:

• Your card number, CVV, and expiry are transmitted directly to Stripe's servers — they never touch Rally Text's servers
• We store only your Stripe Customer ID, subscription status, plan type, and billing cycle
• Stripe is PCI DSS Level 1 certified — the highest level of payment card industry compliance

For questions about a charge, contact [email protected]. For Stripe's privacy practices, see stripe.com/privacy.

Children's Privacy (COPPA)

• Athletes under 13 never receive a Rally Text account. They are listed on the team roster by a coach or parent, but they do not create their own login.
• Phone numbers for minors are not collected. All SMS communication goes to verified parents and guardians — not directly to minors' phones.
• Parental consent is built into the workflow: guardians verify their phone number and explicitly join the team. This verification serves as consent to receive messages on behalf of their athlete.
• Safe Sport auto-CC ensures every message directed at an athlete automatically copies a verified parent or guardian. There is no direct-message-to-minor capability.
• Roster data (athlete names, age groups) is visible only to authenticated team staff and linked guardians — never publicly accessible.

If you believe we have inadvertently collected personal information from a child under 13 without proper parental consent, contact us immediately at [email protected] and we will delete that information promptly.

Data Retention

We retain your data as follows:

• Active team data — Retained for the lifetime of your team account
• Message logs — Retained for 2 years to support audit and compliance needs, then deleted
• Attendance and practice records — Retained for 2 years or until deletion is requested
• Billing records — Retained for 7 years as required by financial regulations
• Deleted accounts — Account data is deleted within 30 days of receiving a deletion request; billing records are retained per the above
• Opt-out records — STOP logs are retained indefinitely to ensure we honor opt-outs even if you later re-join

Security

• All data in transit is encrypted using TLS 1.2 or higher
• Passwords are hashed with bcrypt (cost factor 12) — never stored in plaintext
• Phone numbers in message logs are encrypted at rest using per-team AES encryption keys — only members of the team that owns the log can decrypt and view them
• Database is co-located with the application server and is not accessible via any public network endpoint
• API endpoints require authentication; webhook endpoints verify carrier signatures
• Employee access to production data is role-limited and logged

Despite these measures, no internet transmission is 100% secure. If you discover a security issue, please report it responsibly to [email protected].

Your Rights

Access & portability

You may request a copy of your personal data at any time by emailing [email protected]. We will provide a machine-readable export within 30 days.

Correction

You may update your name, phone number, and email directly from the Rally Text dashboard. Contact us if you need help correcting other information.

Deletion

You may request deletion of your personal data by emailing [email protected]. We will complete deletion within 30 days, except where retention is required by law (e.g., billing records) or to honor opt-out requests.

California residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to know — What personal information we collect, use, disclose, and sell (we do not sell)
• Right to delete — Request deletion of your personal information
• Right to opt out of sale — We do not sell personal information
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights

To exercise your California privacy rights, contact us at [email protected] with the subject line "California Privacy Request."

SMS opt-out

Reply STOP to any Rally Text message at any time to stop receiving messages from that team. This is always free, always immediate, and always honored.

Contact

For privacy questions, data requests, or to report a concern:

• Email: [email protected]
• Security issues: [email protected]

We will respond to all privacy inquiries within 5 business days and complete requests within 30 days.

---

Rally Text may update this Privacy Policy from time to time. We will notify users of material changes via email at least 14 days before the changes take effect. The updated policy will also be posted at this URL. Continued use of Rally Text after the effective date constitutes acceptance of the updated policy.