LEGAL · 21 AUGUST 2026
Privacy policy
Rally is made by Kindred Labs Pte. Ltd., a company registered in Singapore. This policy explains what personal data Rally collects, why, who else sees it, how long we keep it, and what you can ask us to do about it.
It covers the Rally app, our website at rallyfit.co, and email you send us.
Effective 21 August 2026 · Version 1.0
1. The short version
- Your training log is yours. People in your rally see that you trained. They never see what you lifted, or where.
- We do not sell your personal data, we do not share it for advertising, and there are no ads in Rally.
- Product analytics is off unless you turn it on.
- Subscriptions are billed by Apple or Google. We never see your card details.
- You can ask us to delete your account and everything in it, and we will.
- rallyfit.co sets no cookies and runs no analytics, which is why there is no cookie banner.
This summary is not the policy. The sections below are.
2. Who we are, and how to reach us
Kindred Labs Pte. Ltd. is the controller of the personal data described here. We decide why and how it is processed.
| Company | Kindred Labs Pte. Ltd. |
| Unique Entity Number | 202616321G |
| Registered address | 68 Circular Road #02-01, Singapore 049422 |
| Personal data, data rights and complaints about personal data | privacy@rallyfit.co |
| Everything else, including every other complaint | hello@rallyfit.co |
Data protection officer. As Singapore's Personal Data Protection Act requires, we have designated a data protection officer responsible for our compliance with it, contactable at privacy@rallyfit.co.
3. What this policy does not cover
- Apple and Google. Signing in, downloading Rally and paying for a subscription happen with them, under their own privacy policies.
- An app you import from. How another training app handled your history is a matter between you and them. Once you import the file, this policy applies.
- Wherever you share a recap. A weekly recap image is made on your phone. Once you send it somewhere, the receiving app's policy applies.
- Map tiles. Maps are drawn by Apple or Google, who see the part of the map you are viewing.
- The gyms and other places on the map. They are third parties, and we do not act for them.
4. What we collect, and why
Rally opens an anonymous session the first time you launch it, so you can start training without an account. Until you sign in, what we hold has no name or email attached to it.
| Category | What it includes | Why we collect it |
|---|---|---|
| Account and identity | An account identifier; your email address and name if you sign in with Apple or Google; your display name and two-letter monogram; your settings, including whether analytics is on | To give you an account, keep you signed in, and show your rally who trained |
| Your training log | Workouts, exercises, sets, reps, loads, rest, effort ratings, your notes, personal records, the plan we generated for you, and any history you import from another app | To record your training, show it back to you, and decide what to recommend next |
| Health and fitness data | Your bodyweight on the days you log it and its trend over time; injuries you ask us to work around, which stay on your phone; your training history over months | To build a plan that fits you, work around what hurts, and show your progress |
| Location | Your location while the app is open; the location of a place you add to the shared map; the place attached to a workout or a rally | To show training places near you, and to fit your plan to the equipment where you train |
| Your rallies | Which rallies you belong to, who invited whom, and whether you committed to, started or completed each session | To run the shared week |
| Subscription | Whether you are on a free trial or an active subscription, and when it renews or ends | To give you what you paid for, and to keep required accounting records |
| Technical | Your IP address, device model, operating system and app version | To deliver the service, keep it secure, and fix faults |
| Product analytics | Events describing which features are used, with a pseudonymous analytics identifier | Only if you turn analytics on. To learn which parts of Rally work |
| Email you send us | Whatever you write to us, and the address you write from | To answer you, and to handle rights requests and complaints |
This data reaches us from three sources: directly from you, when you enter it in the app or write to us; from your use of the app, which generates your training log and the technical data your device sends; and from Apple or Google, when you sign in or subscribe.
Rally costs US$2.99 a month or US$29.99 a year, and there is a 7-day free trial, once per user. If you subscribe during a trial, the unused part of the trial is forfeited. Apple and Google take the payment and tell us only whether your subscription is active. We never receive your card number or billing address.
What you have to give us, and what is optional
An account identifier, your settings and your training log are needed for Rally to work at all. Without them we cannot record your training, show it back to you or generate a plan, so declining them means Rally cannot function.
Everything else is optional. Your bodyweight, the injuries you ask us to work around, your location and any place you add to the map are yours to give or withhold, though a plan fits you less well without them. Product analytics is entirely optional and is off unless you turn it on.
What stays on your phone
Injuries you ask us to work around, the health notice you accepted before your first plan, your onboarding answers and your unit preference are held in the app on your device. If you report pain during a session, we use it to change that session and store nothing.
What we do not collect
- Nothing from Apple Health, Health Connect, a watch or any other wearable. Rally does not connect to them.
- No heart rate, sleep, steps, calories or nutrition data.
- No card numbers or billing details.
- No contacts, no photos, no camera and no microphone.
- No advertising identifiers, ad SDKs, tracking pixels, or data bought from brokers.
- No location while the app is closed.
5. Our legal bases
Under the GDPR and UK GDPR we need a lawful basis for each purpose, and a further condition for health data.
| Purpose | Legal basis | Condition for health data |
|---|---|---|
| Creating and running your account | Performance of our contract with you, Art. 6(1)(b) | Not applicable |
| Recording your training and showing it back to you | Performance of our contract, Art. 6(1)(b) | Your explicit consent, Art. 9(2)(a) |
| Generating and adapting your plan | Performance of our contract, Art. 6(1)(b) | Your explicit consent, Art. 9(2)(a) |
| Bodyweight, injuries and other health data | Your consent, Art. 6(1)(a) | Your explicit consent, Art. 9(2)(a) |
| Running your rallies and invites | Performance of our contract, Art. 6(1)(b) | Not applicable |
| Finding training places near you | Performance of our contract, Art. 6(1)(b) | Not applicable |
| Keeping the shared map of places accurate | Our legitimate interest in an accurate shared map, Art. 6(1)(f) | Not applicable |
| Billing, subscriptions and accounting records | Performance of our contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) | Not applicable |
| Security, fault diagnosis and preventing abuse | Our legitimate interest in a service that works and is safe, Art. 6(1)(f) | Not applicable |
| Product analytics | Your consent, Art. 6(1)(a) | Not applicable, no training or health data is sent |
| Answering you and handling rights requests | Legal obligation, Art. 6(1)(c), and performance of our contract | Art. 9(2)(f) where a health matter arises in a claim |
Where we rely on consent, you can withdraw it at any time, as easily as you gave it, and we will stop. Withdrawing does not affect what we did before you withdrew.
In Singapore we rely on your consent under the PDPA, on deemed consent where you give us data for an obvious purpose such as joining a rally, and on the legitimate interests exception for security and the shared map.
6. Health and fitness data
We treat the following as health data: your bodyweight and its trend, injuries you tell us about, your effort ratings, your free-text notes, and your training history over time. In the EU and the UK these are special category data under Article 9, and we rely on your explicit consent for them. You can withdraw it at any time, though we would then be unable to generate or adapt your plan.
We never use health data for advertising, profiling or any purpose other than the ones in section 5. We never sell it. We do not operate a geofence anywhere, for any purpose.
7. Automated decisions and AI
Rally chooses your next exercise and your next load automatically, by applying fixed rules to what you logged. There is no AI model involved, and nothing you enter is sent to any AI or model provider.
Every recommendation is shown to you with the reason for it, in plain language. You can change the load, change the reps, swap the exercise, or ignore the plan entirely. These recommendations have no legal effect on you, and nothing similarly significant turns on them. You can override every one of them. If you would like a person to review one, write to privacy@rallyfit.co.
8. What other people in your rally can see
A rally shows the other members that you trained. It never shows what you lifted, or where.
Members of a rally you belong to can see your display name, your monogram, and whether you committed to, started or completed each session that week. They can also see the rally's own details, the group tally for the week, and who invited whom.
They cannot see your loads, reps, sets, effort ratings, bodyweight, notes, injuries, personal records, plans, the places you train at, your training outside that rally, any other rally you belong to, or your email address.
If you share a weekly recap image, it contains the rally name, the week, and each member's display name, monogram and attendance. It contains no training numbers.
9. Who we share your data with
We use a small number of providers to run Rally. They process your data on our instructions, under contract, and for no purpose of their own.
| Provider | What they do for us | Where it is processed |
|---|---|---|
| Supabase | Application database and authentication | Singapore |
| Apple and Google | Sign-in, app distribution, subscription payments, map tiles | Global infrastructure |
| PostHog | Product analytics, only if you consent | United States |
| Vercel | Hosting for rallyfit.co | Global edge network |
What goes to whom: your account and identity data, your training log, your health and fitness data, your location and your rallies go to Supabase, which holds the database. Your account identifier and your subscription status go to Apple and Google, who handle sign-in, distribution and payment. Analytics events and a pseudonymous analytics identifier go to PostHog, and only if you turn analytics on. Your IP address and the request your browser makes go to Vercel when you visit rallyfit.co.
We also disclose personal data:
- to other members of your rally, as described in section 8;
- to whoever you choose to send a recap image or an invite link to;
- where the law requires it, such as a valid court order or a regulatory demand, and we will tell you unless we are forbidden from doing so;
- if Kindred Labs is acquired or merges. We will tell you before your data transfers, and this policy continues to apply until it is replaced. Where the law requires your consent before health data transfers in a corporate transaction, we will ask for it first.
We do not sell personal data, and we do not share it for cross-context behavioural advertising, under any definition used in US state privacy law. We have not sold or shared personal information in the preceding 12 months, and we do not.
10. International transfers
Rally's database is hosted in Singapore. If you are outside Singapore, using Rally means your data is transferred there.
Singapore is not covered by an EU adequacy decision. Transfers from the EEA rely on the European Commission's Standard Contractual Clauses, together with a transfer impact assessment. Transfers from the UK rely on the UK International Data Transfer Agreement, or the UK Addendum to those clauses, together with a transfer risk assessment. For transfers out of Singapore, including consented analytics processed in the United States, we take the steps section 26 of the PDPA requires to ensure the recipient is bound by obligations comparable to it.
Some providers above operate globally, so requests may be served from outside Singapore, each under its own transfer terms. You can ask us for a copy of the safeguards we rely on by writing to privacy@rallyfit.co.
11. How long we keep your data
| Data | How long we keep it |
|---|---|
| Your account, profile and training log, including bodyweight and other health data | For as long as your account exists |
| Inactive accounts | Deleted after 24 months with no sign-in |
| Everything, once you ask us to delete your account | Deleted within 30 days of us verifying the request, and purged from backups within a further 30 days |
| Invites | Deleted 30 days after they are accepted or expire |
| Places you added to the shared map | Kept as part of the map. Your identifier is removed when you delete your account |
| Subscription and billing records | As long as Singapore tax and accounting law requires |
| Analytics events, if you turned analytics on | Deleted when you delete your account, or sooner if you ask us to delete your analytics profile |
| Technical logs, including IP addresses | Up to 90 days |
| Request logs kept by the host of rallyfit.co | Kept briefly, for security and troubleshooting |
| Email you send us | 24 months |
If we keep something for longer, it is because a law, a dispute or a live security investigation requires it, and only for as long as that lasts.
12. Security
Your data is encrypted in transit and at rest. Access is limited to the people who need it to run the service, support you or fix a fault. Our providers are contractually bound to protect it to the same standard.
Rally is not end-to-end encrypted. We can read your data, because we have to in order to generate your plan, run a rally and answer support requests.
If a breach occurs that is likely to cause you significant harm, we will notify Singapore's Personal Data Protection Commission within three calendar days of assessing it as notifiable. Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk. We will tell you directly where the risk to you is high.
13. Your rights
If you are in the EU or the UK
You have the right to access your data and get a copy, to have inaccurate data corrected, to have your data erased, to restrict how we process it, to object to processing based on our legitimate interests, to receive the data you gave us in a machine-readable format and have it sent to another provider, and to withdraw consent at any time.
We answer within one month. If a request is complex, or you have made several, we can extend by two further months and will tell you within the first month, with reasons. There is no charge, unless a request is manifestly unfounded or excessive. If we refuse, we will tell you why and how to challenge it.
If you are in Singapore
You can ask what personal data we hold about you and how it has been used or disclosed in the year before your request. You can ask us to correct an error or omission, and we will pass the correction on to anyone we disclosed it to who still needs it. You can withdraw consent on reasonable notice, and we will tell you what that means for the service before we act on it. We respond as soon as reasonably possible, and if we cannot respond within 30 days we will tell you within those 30 days when we will. Correction is free. For access requests we may charge a reasonable fee, and we will give you an estimate first.
If you are in California
You have the right to know what we collect and why, to a copy of it, to have it deleted, to have it corrected, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be treated differently for exercising any of these rights.
We do not sell or share personal information, and we have not in the last 12 months, so there is nothing to opt out of. The sensitive personal information we collect is your health and fitness data and, when you add a place, your precise location, used only to provide the service you asked for. We do not sell or share the personal information of anyone under 16. We respond within 45 days and may take a further 45 days where necessary, and we will tell you if we do. There is no opt-out signal for us to act on, and rallyfit.co sets no cookies and runs no analytics.
If you are elsewhere in the United States
Other states, including Colorado, Connecticut, Texas, Virginia, Washington and Nevada, give you rights to access, correct, delete and port your data, to opt out of sale and targeted advertising, and to appeal if we refuse. Rather than apply a different standard in each state, we apply one everywhere: opt-in consent for health data, no sale, no advertising use, deletion for anyone who asks. If you are in Washington or Nevada, you can also ask us to confirm and list any sharing of your consumer health data and to withdraw your consent to it, and you can appeal a refusal to us and then to your state Attorney General.
How to use any of these rights
Email privacy@rallyfit.co, from the address you use with Rally if you have one, or tell us your display name and a rally you are in so we can find you. We will ask for enough to be confident you are you, and no more. An authorised agent can make a request for you, if they give us written proof that you authorised them.
14. Deleting your account
Email privacy@rallyfit.co and ask us to delete your account, or use https://rallyfit.co/delete-account/, which explains the same route. Write from the email address on your account. If you never signed in, tell us whatever identifying detail you can and we will do our best to find you, though an account with no identifier attached to it may be impossible to match to a person.
We will verify the request is yours, confirm what will and will not be deleted, and complete the deletion within 30 days of verifying it. Backups are purged within a further 30 days.
We delete your profile, your account and sign-in records, your workouts, exercises and sets, your bodyweight history, your personal records, your plans, and your rally memberships and participation.
Two things stay, without you attached to them. A rally is a shared record, so it survives your departure, with your name and participation removed. A place you added stays on the map, with your identifier removed.
Deleting your account does not touch your phone. Delete the app to remove what is stored there. Signing out is not deletion.
15. Children
Rally is for people aged 16 and over, everywhere in the world. We do not knowingly collect personal data from anyone under 16. If we learn that someone under 16 has an account, we will delete it and their data. If you believe a child has an account, tell us at privacy@rallyfit.co.
16. Cookies, the website, and messages from us
rallyfit.co is a marketing website hosted on Vercel. It sets no cookies, runs no analytics, has no forms and embeds nothing from anyone else. That is why there is no cookie banner.
In the app, we store your training log, your preferences and your sign-in tokens on your device, all needed to work offline and keep you signed in. The only optional storage is what the analytics tool writes, and only if you turn analytics on.
We do not send marketing email or promotional push notifications. Reminders you set are scheduled on your own phone. If that changes, we will ask for your consent first, keep it separate from everything else, and put a working unsubscribe in every message.
17. Changes to this policy
We will update this policy as Rally changes. The version and effective date at the top tell you which one you are reading, and we keep the superseded versions so you can see what changed.
If a change materially affects you, such as a new category of data, a new recipient, a new purpose or a new transfer, we will tell you in the app before it takes effect, and we will keep the previous version available. If a change needs your consent, we will ask for it. We will not treat continued use as consent to anything that needs an explicit yes.
18. Complaints
Start with us. Email privacy@rallyfit.co for anything about personal data, and hello@rallyfit.co for everything else. We would rather fix a problem than have you escalate it.
If you are not satisfied, you can complain to a regulator.
- Singapore: the Personal Data Protection Commission, at pdpc.gov.sg.
- European Union: the data protection authority where you live, where you work, or where the problem happened.
- United Kingdom: the Information Commissioner's Office, at ico.org.uk.
- United States: your state Attorney General, and in California the California Privacy Protection Agency.