Privacy notice
Last updated 6 September 2026
Rallyo is a neighbourhood noticeboard for shops with surplus stock. To do that it needs to know roughly where you are and how a shop can reach you. This page says exactly what we keep, why we keep it, and how to make us delete it. It is written to be read, not to be survived.
Rallyo is operated as a sole proprietorship by Sai Nihar Gandra in Bengaluru, Karnataka, India, and is reachable at sainihargandra@gmail.com. For the purposes of India’s Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the personal data described here.
What we collect
| What | Why |
|---|---|
| Your name, email address and profile picture, from Google sign-in | To create your account and show who wrote a comment |
| Your mobile number — required once, then permanently locked | So a shop can confirm a pickup, and so one person cannot run many accounts. It is never shown to other users and cannot be edited once saved, by you or by us |
| Your location — read from your device while the feed is open, and stored as a single coordinate pair on your profile | To sort deals by how far away they are. This is the whole product; without it the feed is a random list |
| Your neighbourhood and city | To fall back to a sensible area when GPS is unavailable |
| What you save, follow, react to and comment on | To show your saved deals and to notify the shop |
| Reports you submit about a post | To moderate. Reports are visible only to us, never to the shop you reported |
| For business accounts: shop name, address, phone, WhatsApp, categories, photos | This is your public shop listing. It is meant to be seen by everyone and is not private data |
Google sign-in and Google user data
When you choose “Continue with Google” on https://www.therallyo.com, Rallyo asks Google for three standard sign-in permissions and nothing else:
- openid — your Google account identifier, which is how we recognise you as the same person on your next visit.
- userinfo.email — your email address, used as your account name and to send you service email such as a sign-in link.
- userinfo.profile — your display name and profile picture, shown next to comments you write.
We request no other Google permission. Rallyo cannot read your Gmail, contacts, calendar, Drive files or anything else in your Google Account, because it never asks for access to them.
How we store it. The identifier, email address, name and picture URL that Google returns are stored in our Supabase database and kept for as long as your account exists. Nothing received from Google is copied anywhere else.
How we share it. Data received from Google is never sold, rented or shared with advertisers, data brokers, or any third party for their own purposes. Your name and profile picture are visible inside the app next to your comments. Your email address is never shown to other users or to shops.
Limited Use. Rallyo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How to revoke it. You can disconnect Rallyo at any time from your Google Account permissions page. That stops future sign-ins. To erase what we already hold, delete your account from Settings — see How long we keep it below.
What we do not do
- We do not show your phone number or your location to other users. Not to shops, not to neighbours. The database enforces this, not just the screens.
- We do not sell personal data, and we do not share it with advertisers or data brokers.
- We do not track you across other websites, and we set no advertising cookies.
- We do not read your location when the app is closed or in the background.
Who else can see it
We use a small number of processors, each of which sees only what it needs to run the service:
- Supabase — the database, sign-in system and photo storage. Your account data lives here.
- Vercel — hosting. It processes requests and standard server logs, including IP addresses.
- Google — if you sign in with Google, and to draw the static map images on shop pages. Map images are requested with a shop’s coordinates, never yours.
We will also disclose data where the law actually requires it, and we will tell you when we are permitted to.
How long we keep it
Your account data is kept while your account exists. Delete your account and we erase your profile, phone number, saved location, saves, follows and reactions within 30 days. Comments you left on a shop’s post are anonymised rather than removed, so the conversation still makes sense. Business listings and their posts are kept while the shop is listed. Server logs roll off within 30 days.
Your rights
Under the DPDP Act you can ask us to:
- tell you what personal data we hold about you, and who we have shared it with;
- correct anything that is wrong or incomplete;
- erase your data and close your account;
- nominate someone to exercise these rights if you die or become incapacitated.
Withdrawing consent to location means the feed can no longer sort by distance, so the app stops being useful — but you can withdraw it in your browser or device settings at any time, and you can delete your account entirely from Settings.
Grievances
Our Grievance Officer is Sai Nihar Gandra, reachable at sainihargandra@gmail.com. We answer within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
Security
Data is encrypted in transit. Access to the database is restricted per user by row- and column-level rules, so one account cannot read another’s private fields even by talking to our API directly. If a breach occurs that puts you at risk, we will tell you and the Data Protection Board as the law requires.
Children
Rallyo is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, write to the Grievance Officer and we will remove it.
Changes
If we change what we collect, we will update this page and change the date at the top. If the change is significant, we will tell you in the app before it takes effect.