Legal

Privacy Policy

Last updated: June 11, 2026 · Effective: June 11, 2026

Who we are

Rally is a community platform operated by QX Holdings Inc., a Canadian corporation. Rally powers private coaching communities, each led by a community owner (a “Coach”). This policy covers both the Rally platform and the Rally mobile app.

Contact: pascualrobshaw10km@gmail.com

Mailing address: QX Holdings Inc., 4705 Mann Road, Box 302, Rossland, BC V0G 1Y0, Canada.

Plain-language summary

• You create a profile to use Rally. We store the data you give us.
• Content you post (feed posts, comments, journal entries, dharma reviews, messages) is stored so the app can work. Who can see it depends on where you posted it.
• We use AI (“Quill” and other community AIs) to help you. Your conversations with AI are processed by third parties (Anthropic via our AI partner Anima) and stored so the AI has context.
• We use analytics to understand how the app is used. We don’t sell your data.
• You can request deletion of your account and data at any time.

1. Data we collect

Account data

Email address, name, profile photo, username, bio, and other profile fields you choose to fill in.

Content

Anything you post, write, send, or upload inside Rally: posts, comments, direct messages, reactions, journal entries, dharma reviews, loop entries, voice notes, photos, calendar events, scheduler bookings, and notes.

AI conversations

Your messages to Quill (or your community’s AI coach), the AI’s responses, and the context it uses to answer you (e.g. recent posts, classroom progress, journal entries — scope depends on the feature and your privacy settings). We retain conversation history so the AI has memory across sessions.

Community membership

Which communities you belong to, your role (member, admin, owner), when you joined, and your engagement level.

Device data

When you use the Rally mobile app (iOS or Android): your device type, OS version, app version, crash reports, and push notification tokens (if you enable push).

Usage data

Pages viewed, features used, session duration, and anonymous analytics events (e.g. post_created, dharma_review_submitted). Used to improve the product.

Payment data

If your coach charges for your community, payment is processed by Stripe. We receive only the minimum needed (subscription status, last-4 of card, country). We never see your full card number.

Connected services

If you connect Google Calendar (via the Rally Calendar feature), we receive calendar events you choose to sync, per the scope you grant. See §3b for our Google API Services Limited Use disclosure.

If a community admin connects a Facebook Page or Instagram Business accountvia the Rally → Meta integration, we receive: the connecting admin’s Meta user ID and name, the IDs and names of the Pages and Instagram Business accounts they grant access to, short-lived and long-lived access tokens (stored encrypted at rest), and the granted permission scopes. We do not receive contact lists, friends lists, or any data outside the granted scopes. See §3a below for what flows from Rally to Meta when an admin cross-posts content.

What we do NOT collect

Precise location, contacts, health data, advertising identifiers, or biometric data. (Face ID / fingerprint unlock happens entirely on your device’s secure enclave; we never see the biometric template.)

2. How we use your data

• Provide the Rally platform and app
• Power AI coaching (Quill and community AIs) with your context
• Send notifications you opted into (in-app, email, push)
• Improve the product (analytics, feature usage)
• Keep Rally secure (fraud detection, abuse prevention)
• Comply with legal obligations

We do not sell your data. We do not use your content to train third-party AI models — AI processors (Anthropic via Anima) are bound to process data only on our behalf and not train on it.

3. Who sees your data

Inside your community: coaches, moderators, and other members can see content based on where you post it. A post in the main feed is visible to all community members; a direct message is visible only to the recipient; your journal and dharma reviews are private to you (and optionally to your AI coach if you enable classroom context in your Quill settings).

Rally platform staff: limited, role-based access. Engineering access to raw data is logged.

Third-party processors (bound by data processing agreements):

Law enforcement: we disclose data only when legally compelled by a valid order, subpoena, or warrant.

3a. Connecting third-party social accounts (Meta)

Community admins can connect a Facebook Page or Instagram Business account so they can cross-post community content from Rally to those surfaces. The connection is per-community and admin-initiated. Members do not connect their personal Facebook or Instagram accounts through Rally.

Permissions we request

• pages_show_list — list the Facebook Pages the admin manages so they can pick which one to connect.
• pages_manage_posts — publish posts to the connected Facebook Page on the admin’s behalf.
• pages_read_engagement — read post identifiers returned by Meta after a successful publish (used for the Rally audit log).
• instagram_basic — fetch the Instagram Business account ID and handle linked to the connected Facebook Page.
• instagram_content_publish — publish posts to the linked Instagram Business account when an admin enables Instagram cross-posting.

What flows from Rally to Meta

Only when a community admin explicitly toggles “Cross-post to Facebook” (or Instagram) on an individual post, Rally sends to Meta:

• The post text body the admin authored.
• Image and video URLs the admin attached, if any (Instagram requires media).
• The Page or Instagram Business account access token (used to authenticate the publish request).

Rally does not transmit member identities, comments, reactions, AI conversations, journals, direct messages, or any other community data to Meta. We do not use Meta-granted tokens to read content from connected Pages or Instagram accounts beyond confirming a successful publish.

How tokens are stored

All Meta access tokens are encrypted at rest using AES-256-GCM. Tokens are stored only on Rally’s servers (Supabase), never sent to client browsers, and never logged. Tokens are scoped to the community that connected them — Rally cannot use one community’s tokens on behalf of another.

Disconnecting and data deletion

A community admin can disconnect Meta at any time from the community’s admin settings. Disconnecting revokes the access token at Meta and removes the encrypted token from Rally’s database. The admin can also revoke Rally’s access from Facebook’s own settings → Business Integrations panel; Meta will notify Rally via the deauthorize webhook and Rally will mark the connection as revoked.

Members of the community whose posts were cross-posted to Meta can request deletion of the Meta-side post by contacting the community admin (who controls the connected Page) or by submitting a deletion request via qxrally.com/legal/data-deletion. Rally forwards Meta-initiated data deletion callbacks to /api/public/meta/data-deletion-callbackper Meta’s requirements.

3b. Google API Services — Limited Use

Rally’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Rally connects to Google Calendar only when you choose to link your Google account from the Rally Calendar feature. When you do, we request the following Google OAuth scopes:

• https://www.googleapis.com/auth/calendar — to read your calendars and to create, update, and sync calendar events between Rally and Google Calendar.
• https://www.googleapis.com/auth/userinfo.email and openid — to identify which Google account you connected.

Specifically, in relation to data obtained through these Google APIs, Rally:

• uses Google user data only to provide and improve the user-facing calendar sync features you enable inside Rally;
• does not transfer Google user data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior notice to users;
• does not use Google user data for serving advertisements;
• does not sell Google user data, and does not use it to train, develop, or improve generalized or non-personalized AI / machine-learning models;
• does not allow humans to read Google user data unless we first obtain your affirmative agreement to view specific data, it is necessary for security purposes (such as investigating abuse), it is required to comply with applicable law, or the data has been aggregated and anonymized.

You can disconnect Google Calendar and revoke Rally’s access at any time from your Rally calendar settings, or from your Google Account → Security → Third-party access page. Disconnecting revokes the token at Google and deletes the stored access and refresh tokens from Rally.

4. AI and your data

Rally’s AI features (“Quill” and community-specific AIs) run on Anthropic Claude models via our AI partner Anima (also operated by QX Holdings Inc.). When you interact with AI:

• Your current message plus relevant context (recent posts, profile, classroom progress, journal entries — scope depends on the feature and your Quill privacy toggle) is sent to Anthropic.
• Anthropic processes the request and returns a response.
• We retain your conversation history so the AI has memory across sessions.
• Anthropic does not train on your data. It is processed under a commercial agreement that prohibits training use.

You can control AI context by adjusting privacy settings in Rally. Options include “full context,” “ask-only,” and “never use my classroom/journal data.”

5. Retention

• Active account data: kept while your account is active.
• After account deletion: most data is erased within 30 days; some data (audit logs, legal holds, anonymized analytics) may be retained longer where required by law.
• AI conversations:retained alongside your profile; deleted when you delete your account or explicitly clear your AI history (where supported in your community’s configuration).
• Backups: deleted data may persist in encrypted backups for up to 90 days before being purged.

6. Your rights

You can:

• Access your data — export from your settings or by emailing us
• Correct inaccurate data — edit in the app, or email us
• Delete your account and data — Settings → Account → Delete Account, or email us
• Port your data — export in machine-readable format (JSON or CSV)
• Opt out of non-essential communications — Settings → Notifications
• Withdraw consent to optional processing — revoke calendar sync, revoke AI context, etc.

EU / UK residents (GDPR): you also have the right to object to processing, restrict processing, and lodge a complaint with your local data protection authority.

California residents (CCPA / CPRA):you have the right to know, delete, correct, opt out of sale (we don’t sell), and non-discrimination. Email us to exercise these rights.

Data Controller: QX Holdings Inc.

7. Security

We use industry-standard practices:

• TLS 1.2+ for all data in transit
• Encryption at rest (Supabase: AES-256)
• Row-level security (RLS) on all database tables
• Magic-link or OAuth sign-in (we don’t store plaintext passwords)
• API keys stored as encrypted environment variables
• Biometric unlock on mobile uses your device’s secure enclave — we never see the biometric template

No system is perfectly secure. In the event of a breach affecting your data, we will notify you within the timeframe required by applicable law (typically 72 hours under GDPR).

8. International transfers

Rally uses infrastructure providers (Supabase, Vercel, Anthropic, Google, Firebase) with data centers primarily in the United States and Europe. Transfers from the EU / UK are covered by Standard Contractual Clauses where required.

9. Children

Rally is not intended for users under 16 (or the minimum age required by your country’s law, whichever is higher). We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

10. Changes to this policy

We will post the updated version at this URL with a new “Last updated” date. Material changes are announced in-app and by email at least 14 days before taking effect.

11. Contact

Privacy questions: pascualrobshaw10km@gmail.com

QX Holdings Inc.
4705 Mann Road, Box 302
Rossland, BC V0G 1Y0
Canada