Privacy
Last updated 20 September 2026
RallyPost lets people send photos and videos to a club, and lets that club's team review them before anything is published. This page explains what we collect when that happens, who can see it, and how to get it removed.
RallyPost is operated from New South Wales, Australia. We handle personal information in line with the Australian Privacy Principles.
Who is responsible for what
When you send a post to a club, that club decides what to publish and where. The club is responsible for its own use of what you send. RallyPost provides the tools, stores the material, and enforces the permissions you set.
What we collect
If you send a post without an account
- Your name, and the role you pick (parent, coach, player, referee, official or fan)
- Your email address
- The photos or video you upload, the caption you write, and the game or event you choose
- Your answers to the consent questions, including whether anyone under 18 is identifiable
- The date and time you sent it
If you create an account
- Your email address, and your name as your sign-in provider gives it. If you use Google, we receive your name, email address and profile picture, and nothing else from your Google account
- The RallyPost handle, display name and short bio you choose
- Any social media handles you add, and for each one whether you want to be tagged and whether clubs may reshare posts you have already published yourself
- Which clubs you contribute to, and whether each has approved you
If you are part of a club's team
- Your email address, display name and role
- A record of the posts you approve, decline or ask changes on
If you ask for early access
- Your name, email address, organisation and organisation type
Photos and video
What you upload is stored so the club's team can review it and publish it. Where a club design is added, a second copy is kept without the club crest, because TikTok does not allow apps to add brand logos.
Stored files are private. They are not reachable by a public link: the app requests a short-lived signed address each time someone views one, and only the club's team and the person who sent the post can ask for that signature.
People under 18
Every submission must state whether anyone under 18 is identifiable in it. If the answer is yes, the person sending it must confirm that a parent or guardian has agreed before it can be sent, and clubs can require this. That confirmation is stored with the post, so the club can see who confirmed it and when.
We do not knowingly collect personal information directly from children. Accounts are for people 16 and over. A parent or guardian should send material on behalf of a younger child.
If you are a parent or guardian and you want a photo of your child removed, email support@rallypost.app and we will remove it from RallyPost. If it has already been published to a social channel, contact the club as well, since only they can remove it from their own account.
Who can see what
- The club's team sees the posts sent to that club, including the sender's name and email address, the role they chose and their consent answers.
- Other contributors see none of this. They see only their own posts and their own profile.
- Social media accounts. Once a post is approved and published, it appears publicly on the club's channels. The caption credits the sender by name where the club has that setting on, and tags the social handles you marked "tag me".
- We do not sell personal information, and we do not use what you send for advertising.
Where it is stored
Data is held in Supabase's Sydney region, in Australia. The site is served by Vercel. Sign-in is handled by Supabase, and by Google if you choose that option. These providers process data on our behalf under their own terms.
How long we keep it
Submissions and their consent records are kept while the club's account is open, because they are the club's record of what was agreed for material it has published. Profiles are kept until you delete your account. Early access enquiries are kept until we have finished responding to them.
Your choices
- Tagging. Turn "tag me" off for any platform in your profile and your handle stops being added to new posts. Posts already published are not changed.
- Resharing. Permission for clubs to reshare content you have posted yourself is off unless you switch it on.
- Leaving a club. A club's team can remove you, and you can ask them to.
- Access, correction and deletion. Email support@rallypost.app and we will tell you what we hold about you, correct it, or delete it. See Data deletion for how deletion works, including disconnecting Facebook and Instagram.
Security
Access is enforced in the database itself, so a club's team can only read that club's material and contributors can only read their own. Uploaded files sit in private storage and are reachable only through short-lived signed addresses. Traffic is encrypted in transit. No system is perfect, and we will tell affected people and the regulator if a breach occurs that is likely to cause serious harm.
Changes
If this page changes in a way that matters, we will update the date at the top and, where the change is significant, tell the people affected.
Contact
Questions, requests or complaints: privacy@rallypost.app. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.