Privacy Policy
This Privacy Policy explains how Orvry Apps (“Rally Club,” “we,” “us,” or “our”) collects, uses, stores, and shares information when you use the Rally Club tournament-management service (the “Service”). Customize this policy to match the deployed product and the operator’s legal obligations before publication.
1. Information we collect
- Account and contact details: name, email address, login identifiers, account role, club membership, and preferences.
- Club and event details: club name, tournament details, registrations, teams, rosters, court assignments, match schedules, scores, brackets, and event communications.
- Participant details: information that an organizer or participant submits for an event, which may include player/team names and contact details where needed. Organizers should not enter unnecessary personal information.
- Support communications: messages, feedback, and details needed to respond to requests.
- Technical and security information: basic request logs, IP address, browser/device details, timestamps, and diagnostic/security events processed by hosting and infrastructure providers.
- Cookies and local storage: technologies needed for authentication, security, and basic preferences. If analytics or non-essential tracking is added, this policy and any required consent flow must be updated.
2. How we use information
We use information to create and secure accounts; operate clubs and tournaments; manage registrations, teams, courts, matches, scores, and brackets; display event information according to organizer settings; respond to support requests; prevent abuse and investigate incidents; maintain, troubleshoot, and improve the Service; comply with legal obligations; and protect the rights and safety of users and the operator.
3. Legal grounds and notices
We process information as permitted by applicable law, including as needed to provide the Service, fulfil arrangements with account holders or organizers, comply with legal obligations, protect legitimate interests where recognized by law, or based on consent where required. The specific legal ground depends on the data and context. If Japan’s Act on the Protection of Personal Information (APPI) or another privacy law applies, the operator must confirm the policy and actual processing satisfy that law, including any required disclosures, procedures, and cross-border transfer requirements.
4. When information is shared
- With event organizers and clubs: account holders acting as administrators may access event and participant information needed to run the event.
- With other users or the public: tournament details, player/team names, brackets, schedules, and scores may be visible according to the event’s publication settings. Do not publish private participant information.
- With service providers: we use infrastructure providers to operate the Service. The planned stack uses Supabase for database, authentication, storage (if enabled), and Edge Functions. Confirm your actual Supabase project region and provider configuration before launch. Add any actual email, analytics, payments, customer-support, or other vendors here before enabling them.
- For legal and safety reasons: information may be disclosed when reasonably necessary to comply with law, respond to lawful requests, protect users, investigate misuse, or protect rights and security, subject to applicable law.
- Business changes: if the Service or its assets are reorganized, transferred, or acquired, relevant information may be transferred subject to applicable safeguards and legal requirements.
We do not intentionally sell personal information for money. Do not make this statement unless it accurately reflects the product and all applicable privacy laws.
5. International processing
Service providers may process or store information in the country where your Supabase project is configured and in other countries where the providers or their subprocessors operate. Before launch, confirm the project’s selected region, review provider terms and data-processing documentation, and provide any notices, safeguards, or consent required for international transfers.
6. Retention
We keep information for as long as reasonably necessary to provide the Service, maintain tournament records, resolve disputes, enforce agreements, maintain security, and meet legal obligations. Retention periods vary by data type. Account deletion requests will be handled subject to technical limitations, backup cycles, event-record needs, and applicable law. Replace this paragraph with specific retention periods where required or appropriate.
7. Security
We use reasonable technical and organizational safeguards appropriate to the information we process. No online service can guarantee perfect security. Access to production data should be limited by role, database Row Level Security (RLS) should be enabled and tested, secrets must not be embedded in the client, and administrative access should be reviewed regularly.
8. Your choices and privacy rights
Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of, or restrictions on certain personal information, or to withdraw consent where processing is based on consent. Some rights are subject to exceptions. Data deletion is currently handled manually and must be requested by email to support@orvry-apps.com. See the Data Deletion Instructions for the steps and information to include. We may need to verify your identity and coordinate with the club or organizer that submitted the information.
9. Children and participant information
The Service may contain tournament records for participants of different ages. Organizers are responsible for providing required notices and obtaining any required parent/guardian authorization before entering information about minors. We should only process participant information for tournament administration and related purposes described here. The operator should create a dedicated contact and deletion process for requests involving minors before launch.
10. Cookies, analytics, and third-party links
The legal site bundled with this draft does not include analytics scripts or advertising trackers. The deployed app may use essential authentication or security storage. If non-essential cookies, analytics, advertising, embedded media, or third-party integrations are added, list them here, explain their purposes, and implement any required consent and opt-out controls. External sites are governed by their own privacy notices.
11. Changes to this Policy
We may update this Policy when the Service or our data practices change. We will revise the “Last updated” date and provide notice where required by law. Material changes should be communicated clearly before they take effect when required.
12. Contact the privacy operator
Privacy requests and questions: support@orvry-apps.com
Operator: Orvry Apps
Address: Tokyo, Japan
Privacy contact / responsible person: Mark Anthony Torres
This is a draft template, not legal advice. The operator must verify the actual data flows, Supabase region, retention behavior, service providers, applicable jurisdictions, and required APPI or other legal disclosures. Do not publish with placeholders remaining.