Privacy Policy
Last updated 18 July 2026 · Applies to the Rallypoint app (app.rallypoint-app.com) and this website
The short version: Rallypoint never shares your exact location by default. Other riders see a rough area of roughly a kilometre, not where you live. Live location and push notifications are opt-in. We don't run ads, we don't use tracking cookies, and we never sell your data. That's the whole business model — riders ride free, and Pro is a simple subscription.
Who we are
Rallypoint is built and operated by Meridium Labs, based in the United Kingdom. Meridium Labs is the data controller for the personal data described on this page.
Questions, requests, or complaints: info@meridiumlabs.co.uk.
What we collect
Account
Your email address and password (stored hashed — we never see it in plain text). We use your email to sign you in, send account emails such as confirmation links, and keep you posted on updates to the app. You can unsubscribe from update emails any time — account emails still arrive, since the app can't work without them.
Profile
Your username, an optional first name, your bike, and an optional profile photo. By default other riders see your username, not your real name — you choose in your profile settings whether to show your first name at all.
Location
Location works in three modes, and you're always in control of which one you're in:
- My area (default). You type a town or area, we convert it to rough coordinates rounded to roughly a kilometre, and that's all the app ever stores or shows. In this mode the app does not read your device's GPS at all, so an app left open can't leak where you actually are.
- Live location (opt-in). If you explicitly switch it on — with a clear warning — the app shares your device's GPS position with nearby riders while it's enabled. Turn it off any time.
- Hidden. You don't appear in anyone's nearby search at all. You can still browse the map, see meets, and message. A town is still required as the private centre point for your own searches — it's never shown to others.
Activity in the app
- Messages you send to other riders, so they can be delivered and shown in both riders' inboxes.
- Meeting points you create or join, including the meet location, time, and attendee list.
- Blocks and reports. If you block or report a rider, we record it so the block can be enforced and the report reviewed.
Notifications
If you opt in to push notifications, we store a push subscription for your device so we can deliver messages and meet updates while the app is closed. Disable it any time in your profile or browser settings.
Payments (Rallypoint Pro)
Pro subscriptions are handled by Stripe. Your card details go directly to Stripe and never touch our servers — we store only a Stripe customer reference and your subscription status.
What we don't collect
No advertising identifiers, no tracking cookies, no analytics profiles, no selling or renting data to anyone, ever. The app stores your sign-in session and a couple of preferences (like map style) on your own device so it works — that's it.
Why we use it
Under UK GDPR, our legal bases are:
- Contract — running your account, showing you on the map at the precision you've chosen, delivering messages, running meets, and providing Pro features you've paid for.
- Consent — live location sharing and push notifications. Both are off until you switch them on, and you can withdraw consent any time in the app.
- Legitimate interests — keeping the community safe: enforcing blocks, reviewing reports, and acting on abuse.
Who processes it for us
We use a small number of service providers to run Rallypoint. They process data on our instructions and can't use it for their own purposes:
| Service | What it does |
|---|---|
| Supabase | Database, sign-in, realtime messaging, and photo storage. Hosted in London (eu-west-2) — your data stays in the UK. |
| Netlify | Serves the app and this website. |
| Stripe | Handles Pro payments and card details. |
| Resend | Sends account emails (confirmation links and the like). |
| CARTO / OpenStreetMap | Provide the map tiles. Loading tiles sends the map area you're viewing, as with any online map. |
| Nominatim (OpenStreetMap) | Turns typed place names into map coordinates when you set your area or search for a meet location. Only the text you search is sent. |
How long we keep it
- Your profile, messages, and meets are kept while your account exists.
- Deleting a conversation removes it from your inbox; deleting a message you sent removes it for both riders.
- Reports and block records are kept for safety and moderation purposes, including after the accounts involved are closed.
- When your account is deleted, your profile, photo, messages, and location data are removed.
To delete your account, email info@meridiumlabs.co.uk from your sign-up address and we'll action it promptly.
Your rights
Under UK GDPR you can ask us to access, correct, delete, or export the personal data we hold about you, restrict or object to how we use it, and withdraw any consent you've given. Email info@meridiumlabs.co.uk and we'll respond within a month.
If you're not happy with how we've handled something, you can complain to the UK Information Commissioner's Office at ico.org.uk.
Children
Rallypoint is for motorcyclists and isn't intended for anyone under 16. We don't knowingly collect data from children; if you believe a child has created an account, contact us and we'll remove it.
Changes to this policy
If we make meaningful changes, we'll update this page and the date at the top, and flag anything significant in the app. Minor wording tweaks may happen without notice.