Privacy notice

1. Who we are

Rallyo, owned and operated by Justene D. Selgas ("Rallyo", "we", "us") runs this website and is the personal information controller for the information described here.

Hosts who run events on Rallyo decide for themselves how they use the details of the players who join their events. For that use, each host is responsible as their own personal information controller.

Our Data Protection Officer can be reached at support@rallyo.ph.

2. What we collect

Account details: the name you play under, your email address, and the level you choose. For a Host ID, also your organisation name if you give one.

Host contact link: if you are a host and add one, the Facebook profile or page link you choose to share. It is public: it shows on your Host card as "View on Facebook" for anyone to use. You can change or remove it at any time, and deleting your account removes it.

Activity on Rallyo: the events you ask to join or host, your requests and their status, check-ins, the scores hosts record, and the ratings, records and standings those scores produce.

Payment records: the payment method you choose (cash, GCash or free), the fee, and any GCash receipt image you upload. A host may upload a GCash QR code for their event. Receipt images and QR codes can show a name, a mobile number and a reference number. Crop out anything you do not want to share.

Player card photo: if you add one, the background picture of your Player card. It may show your face. Only you can see it. Replacing it, removing it or deleting your account deletes it.

Technical details: a sign-in cookie, and the IP address, browser and device details that our servers and security tools log when you use the site.

Messages you send us, for example to support or with "Send feedback", any screenshot you attach, the page you sent it from and your browser. After an event you hosted, your rating and answers about it.

Partner inquiries: if you send one from the Partners page, your business name, the contact person's name, email address and, if you give it, mobile number, your city and type of business, what you are interested in, and your message.

Joining as a guest, without a Player ID: the name you play under, your mobile number and/or email address, the level you choose, your request and its status, its payment method and any GCash receipt you upload, the check-in code we give you, and a private link that shows your request.

Host requests: if you ask to host, your mobile number, where and how often you host, about how many players usually come, the kinds of event you run and your note, with the club or group name and Facebook link you give (which also show on your Host card, as above), and our decision with any reason we give you. When we approve you, we email you a link and an access code to start hosting, and keep a record of the email address we sent them to, when they expire and when they were used.

We do not ask for sensitive personal information such as government IDs, health information or financial account details. Please do not upload any.

3. Why we use it, and on what basis

To run your account and the games you join or host: sign-in, requests, approvals, check-in, live sessions, scores, standings, results and receipts. Our basis is the service you ask for when you create a Player ID or Host ID, and your consent.

To keep Rallyo safe and working: preventing abuse and fraud, securing accounts, and fixing errors. Our basis is our legitimate interest in a safe, working service.

To answer partner inquiries and arrange partnerships with the businesses that send them. Our basis is the consent given with the inquiry, and our legitimate interest in replying to businesses that contact us.

To let you join an event as a guest: your request goes to that event's host, who uses your mobile number or email only to reach you about that event. Our basis is your consent, given with the box you tick, and the service you ask for. Rallyo itself does not email or text guests.

To decide who can host on Rallyo and to prevent misuse of hosting: we read your host request to decide on it, and may use your mobile number or email to ask you about it. Our basis is the service you ask for when you request to host, and our legitimate interest in keeping hosting fair and safe.

To meet legal obligations, and to respond to lawful requests from authorities.

We email you only for sign-in codes and messages about your account. We do not sell your personal information, show ads, or use it for profiling beyond the game ratings described here.

4. Who can see it

Anyone: your name, rating, record and standings, and the results of events you played in.

Anyone with an event's link: that event's list of who is in, who has asked to join and who is on the waitlist. It shows each person's short name (for example "Rico S."), rating, category or division, and a partner's name as it was entered; someone who joined as a guest shows with a "Guest" tag instead of a rating. It never shows your email address, mobile number, check-in code, level, payment or receipt. Event pages ask search engines not to list them.

Anyone with an event's link, while it takes requests: the host's GCash QR code and GCash name, if the host takes GCash, so players and guests can pay.

Anyone, for a host: your public Host card, with your host name, Host ID code, organisation, when you started hosting, your upcoming listed events, and the Facebook link you chose to share. It never shows your email address. Conversations on Messenger or Facebook happen there, not on Rallyo: Rallyo does not see or keep them, and Meta's own privacy policy applies to them.

The host of an event you ask to join: your name, rating, level, your request and its payment method, and any receipt you upload for that event.

The host of an event you ask to join as a guest: your name, level, mobile number and/or email address, your request and its payment method, and any receipt you upload for that event.

Anyone you give your private guest link to: your request on that page, with your name, contact, check-in code and receipt. Keep it to yourself.

Only you: your check-in code and your Player card. Your email address, which your own Player card and Host card show you when you are signed in, is seen only by you and the people who run Rallyo.

The people who run Rallyo: your email address, to answer your messages and feedback and to check payments, and the feedback you send, with any screenshot.

The people who run Rallyo, and no one else: your host request (your mobile number, where and how often you host, how many players come, the kinds of event you run and your note) and our decision on it. Players and other hosts never see them.

Service providers who process data for us under contract, only to run Rallyo: website hosting (Vercel), the database (Neon), sign-in emails (Resend), maps (MapTiler, with OpenStreetMap data) and error monitoring (Sentry). Some of them process data outside the Philippines, for example in Singapore or the United States. We choose providers who protect it to a standard comparable to Philippine law, and we remain responsible for it.

Authorities, when the law requires it.

Partners: never. Rallyo does not share players' personal information with brands, shops or other partners. A partner inquiry is read only by the people who run Rallyo.

5. How long we keep it

Your account stays while you use it. An account that is not used for two years is deleted automatically. We email you 30 days before, and signing in keeps your account.

You can also ask us to delete your account sooner (see "7. Your rights"). We do so within 30 days.

Deleting an account removes your name and email, your receipt images, the team names made from your name and, for a host, the GCash details of past events, and signs you out everywhere. Scores already recorded stay in other players' results and in the standings, without your name: they show "Former player". A name someone else typed, such as a team name they chose or a partner entered without an email, is theirs and may stay. We keep only what the law requires us to keep.

Receipt images are kept for up to one year after the event, then deleted.

Signatures on official scoresheets: in a tournament its host runs with official result sign-off, the name and finger-drawn signature of the player who confirms or disputes a result, and of the umpire, are kept with that match's official scoresheet for its host. Only the host and the people who run Rallyo can see them; the public page shows only that a result was signed. The signature images are kept as receipt images are, then deleted; the names stay on the scoresheet with the match's result. Deleting an account removes that player's name and signatures from the scoresheets.

A guest's mobile number, email address and private link are deleted 30 days after the event. The receipt is kept as receipts are. The name stays in that event's list and results, as entered; after two years it becomes "Former guest". You can ask us to delete your guest details sooner (see "7. Your rights").

Partner inquiries are kept for up to 2 years after they arrive, then deleted automatically. They are never sold.

Feedback is deleted a year after we close it, and after two years at most, with any screenshot. Deleting your account deletes its words and screenshots at once.

A host request and our decision on it are kept while your Host ID exists, whether we approved it or not, and are deleted when you delete your account. The access link and code are stored only in scrambled (hashed) form; their record, with the email address they were sent to, is deleted 30 days after they are used or expire.

Sign-in codes expire after 10 minutes and are deleted soon after. Sign-in sessions end after 60 days without use. Security logs are kept for a short time.

6. How we protect it

The site is served only over encrypted connections (HTTPS). There are no passwords to steal: sign-in codes are stored only in a scrambled (hashed) form. Receipt images can be opened only by the player or guest who uploaded them (a guest through their private link) and the host of that event. Access to the database is limited to the people who run Rallyo.

A feedback screenshot can be opened only by the person who sent it and the people who run Rallyo.

If a breach puts your information at real risk, we will notify the National Privacy Commission and you within 72 hours of knowing about it, as the law requires.

7. Your rights

Under the Data Privacy Act you have the right to be informed; to access your personal information; to object to its processing; to have it corrected, or erased or blocked; to receive it in a portable format; to withdraw consent; and to be paid damages for harm caused by inaccurate, incomplete, outdated, false or unlawfully obtained or used personal information.

You can also file a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, including deleting your account, email us from the address on your account (a guest: tell us the event, and the mobile number or email you joined with). We reply within 15 working days. To exercise your rights, write to support@rallyo.ph.

8. Children

Rallyo is for people 18 and over. A player under 18 may use it only with the consent and supervision of a parent or guardian, who agrees to these terms for them. If we learn that a minor uses Rallyo without that consent, we will close the account.

9. Cookies

We use one essential cookie to keep you signed in on your device, and short-lived ones that keep a sign-in in progress. If you join as a guest, one more remembers your private guest links on that device for up to 60 days. We use no advertising or tracking cookies, and no third-party analytics.

10. Changes to this notice

If this notice changes in a way that matters, we will say so on the site before the change applies.

Last updated: October 21, 2026.