Privacy notice
Last updated 2 September 2026
Rallyo is a neighbourhood noticeboard for shops with surplus stock. To do that it needs to know roughly where you are and how a shop can reach you. This page says exactly what we keep, why we keep it, and how to make us delete it. It is written to be read, not to be survived.
Rallyo is operated by [legal entity name], [registered address]. For the purposes of India’s Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the personal data described here.
What we collect
| What | Why |
|---|---|
| Your name, email address and profile picture, from Google sign-in | To create your account and show who wrote a comment |
| Your mobile number — required once, then permanently locked | So a shop can confirm a pickup, and so one person cannot run many accounts. It is never shown to other users and cannot be edited once saved, by you or by us |
| Your location — read from your device while the feed is open, and stored as a single coordinate pair on your profile | To sort deals by how far away they are. This is the whole product; without it the feed is a random list |
| Your neighbourhood and city | To fall back to a sensible area when GPS is unavailable |
| What you save, follow, react to and comment on | To show your saved deals and to notify the shop |
| Reports you submit about a post | To moderate. Reports are visible only to us, never to the shop you reported |
| For business accounts: shop name, address, phone, WhatsApp, categories, photos | This is your public shop listing. It is meant to be seen by everyone and is not private data |
What we do not do
- We do not show your phone number or your location to other users. Not to shops, not to neighbours. The database enforces this, not just the screens.
- We do not sell personal data, and we do not share it with advertisers or data brokers.
- We do not track you across other websites, and we set no advertising cookies.
- We do not read your location when the app is closed or in the background.
Who else can see it
We use a small number of processors, each of which sees only what it needs to run the service:
- Supabase — the database, sign-in system and photo storage. Your account data lives here.
- Vercel — hosting. It processes requests and standard server logs, including IP addresses.
- Google — if you sign in with Google, and to draw the static map images on shop pages. Map images are requested with a shop’s coordinates, never yours.
We will also disclose data where the law actually requires it, and we will tell you when we are permitted to.
How long we keep it
Your account data is kept while your account exists. Delete your account and we erase your profile, phone number, saved location, saves, follows and reactions within 30 days. Comments you left on a shop’s post are anonymised rather than removed, so the conversation still makes sense. Business listings and their posts are kept while the shop is listed. Server logs roll off within 30 days.
Your rights
Under the DPDP Act you can ask us to:
- tell you what personal data we hold about you, and who we have shared it with;
- correct anything that is wrong or incomplete;
- erase your data and close your account;
- nominate someone to exercise these rights if you die or become incapacitated.
Withdrawing consent to location means the feed can no longer sort by distance, so the app stops being useful — but you can withdraw it in your browser or device settings at any time, and you can delete your account entirely from Settings.
Grievances
Our Grievance Officer is [name], reachable at [email address]. We answer within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
Security
Data is encrypted in transit. Access to the database is restricted per user by row- and column-level rules, so one account cannot read another’s private fields even by talking to our API directly. If a breach occurs that puts you at risk, we will tell you and the Data Protection Board as the law requires.
Children
Rallyo is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, write to the Grievance Officer and we will remove it.
Changes
If we change what we collect, we will update this page and change the date at the top. If the change is significant, we will tell you in the app before it takes effect.