Rallymaker · Rallyrider
Effective 24 August 2026 · applies to rallymaker.org, rallyrider.org, and the Rallyrider mobile app
Rallymaker and Rallyrider are operated by Rallymaker LLC, a Minnesota limited liability company. This policy describes what the software collects, why, and who can see it.
Rallymaker and Rallyrider are two halves of one tool for planning, running, and scoring motorcycle endurance rallies. This policy covers the websites and the Rallyrider mobile app together, because they share a single database.
Three kinds of people appear in the system, and the difference matters for what is collected: organizers (rallymasters, scorers, and scouts, who hold accounts), riders (who take part in a rally), and anyone browsing the public site.
Email address, first and last name, and a password stored only as a cryptographic hash — the plain password is never written down and cannot be recovered, only reset. Accounts cannot be created by the public; a rallymaster or administrator creates them.
Rider details are entered by the rallymaster running the rally, usually from an entry form the rider filled in elsewhere. Depending on what that rallymaster chooses to record, this can include:
Emergency contact and passenger details concern people who are not themselves users of this software. They exist so a rallymaster can reach someone if a rider does not come back, and they are used for nothing else.
When a rider submits a bonus, the app records:
This is the evidence a scorer reviews to decide whether a bonus counts. It is the point of the app.
Worth stating plainly, because it is unusual enough to be worth knowing:
We do not sell personal information, and never have.
Solely to run rallies: to plan routes, to let riders see the bonuses available to them, to let scorers judge submitted evidence, to produce results, and to let a rallymaster reach a rider or their emergency contact. It is not used to build profiles, and not used for marketing.
The app requests location access while you are using it, and never in the background. Your position is read at one moment only: when you capture a photograph or submit a bonus, because proving you were at a place is what a rally bonus is.
The app does not follow your route, does not log where you travel between bonuses, and does not record location while it is closed.
Bonus photographs are uploaded to our server and shown to the rallymaster and scorers for that rally. Photographs taken inside the app are also saved to your phone's own camera roll, with their location written into the image file, so your normal photo app can place them on a map. That copy is yours and lives on your device.
Access follows the rally. The rallymaster, scorers, and scouts assigned to a given rally can see the riders and submissions for that rally only. Riders see their own submissions and their own results. Administrators can reach data for support and maintenance; where an administrator opens a rally they do not organize, that access is time-limited, recorded, and the rallymaster is notified by email.
Rally results, including rider names and scores, are ordinarily published by the rallymaster as part of running the event.
These are the only outside parties that receive anything, and what each one gets:
| OpenRouteService | Bonus coordinates, to calculate routes and travel times. No personal details. |
|---|---|
| Resend | Email addresses and message contents, to deliver sign-in PINs and notifications. |
| OpenStreetMap & Overpass | Map tiles and searches for points of interest. Used when a rallymaster is designing a rally. |
| Anthropic | Descriptions of public places drawn from OpenStreetMap, when a rallymaster asks for suggested bonus locations. No rider or organizer information is sent. |
| Expo (EAS) | Basic device and version information, so the app can receive updates. |
| DigitalOcean | Hosts the servers and the database, in the United States. |
Opening a map link hands you to Google Maps, which is governed by Google's own privacy policy, not this one.
Rally records — including riders, submitted photographs, and scores — are kept indefinitely, because a rally's results are its historical record and organizers refer back to past events. The database is backed up nightly, and backups are retained for 14 days.
Sign-in PINs are temporary and are replaced each time one is issued.
Ask your rallymaster first — they entered your registration and can correct it directly.
To request a copy of what is held about you, or to ask for it to be deleted, write to privacy@rallymaker.org and we will respond within 30 days. Deletion may be limited where a rally is still running or where the record is part of a completed rally's published results; if so, we will tell you what can be removed and what cannot, and why.
Traffic is encrypted in transit. Passwords are stored only as hashes. Access is restricted by role and by rally, and administrator access to a rally an administrator does not run is logged and notified. No system is perfectly secure, and we do not claim otherwise.
This software is not directed at children under 13, and accounts are not open to the public. Where a rally permits a passenger who is a minor, only the name and relationship a rallymaster records are held.
Rallymaker and Rallyrider are intended for use in the United States, and all information is stored on servers in the United States. If you use the service from elsewhere, you are sending your information to the United States.
If this policy changes materially, the effective date above changes and organizers are notified. This policy is governed by the laws of the State of Minnesota.
Questions, requests, or complaints: privacy@rallymaker.org.