Privacy Policy

Who is responsible

Bag Rally operates from Ontario, Canada. Questions, privacy requests, and concerns can be sent to support@bagrally.com.

Information we collect

We collect the information needed to operate Bag Rally, including your email address, sign-in provider identifiers, profile name and optional photo, approximate home area, games, join requests, messages, reviews, notifications, reports, and account or moderation activity.

If you host at a residence, we store the complete address in encrypted form. Public discovery uses a deliberately separated, approximate map pin. The complete address is available only through the private access rules shown in the product.

We also process limited technical information needed for security and reliability, such as session records, coarse network location supplied by our hosting provider, rate-limit identifiers, request metadata, and error or delivery status. We do not use precise device location unless you choose the browser’s location action.

How we use information

We use information to authenticate accounts, show relevant games, coordinate attendance, deliver messages and notifications, enforce capacity and safety rules, investigate reports, prevent abuse, respond to privacy requests, and maintain the service. We do not sell personal information or use it for cross-site advertising. Advertising is disabled.

When information is shared

Your public profile, coarse area, public game details, and approximate residential-game pin may be visible to other visitors. Private messages, join-request details, and residential addresses follow the access controls shown in Bag Rally. A host can grant or revoke address access as described in the product, although a recipient may retain information they already saw.

We use service providers to run Bag Rally: Cloudflare for hosting, database, private files, and security; Google for optional sign-in; Mapbox for maps; Geoapify for location search; and Resend for transactional email. They process information under their own terms and privacy commitments. We may also disclose information when required by law or when reasonably necessary to protect people, rights, and the service.

Retention, deletion, and security

We keep personal information only as long as reasonably needed to provide the service, respond to privacy requests, resolve disputes, prevent abuse, comply with legal obligations, and preserve security or moderation evidence. Retention periods vary by record type. Information involved in an access request is retained long enough for you to pursue available recourse. A documented legal, dispute, or safety hold may pause deletion of affected records until the hold is released.

You can request account deletion in your privacy settings. After verification and scheduling, you have seven days to cancel. When deletion runs, Bag Rally revokes sign-in sessions and provider tokens; removes private file artifacts, residential-address data, profile identifiers, notifications, delivery records, block relationships, and authored private text; and cancels active hosting or participation. Some lifecycle records are retained in de-identified or pseudonymized form so other players’ records and the service remain coherent.

We retain limited policy-acceptance, privacy-case, moderation, security, and administrator-audit evidence for their approved retention periods when needed to demonstrate compliance, protect users, investigate abuse, resolve disputes, or meet legal obligations. Retained records are access-restricted and are not used to restore a deleted account.

We use access controls, private object storage, encrypted secrets, and application encryption for residential addresses, but no online service can guarantee absolute security.

Your choices and rights

You can edit profile information, choose whether to use Google or email-code sign-in, decline device location, and control what games you host or join. In your privacy settings, you may request access to or correction of your personal information, request account deletion, track the request, download a prepared one-use access export, and cancel a scheduled deletion during its seven-day cancellation period.

We verify privacy requests using a recent authenticated session and may ask for additional information only when reasonably needed to verify the request or locate the relevant records. If we cannot fulfill a request, we will explain the reason and available recourse, subject to applicable law.

Age and changes

Bag Rally is for adults age 18 or older and is not directed to children. We may update this policy as the service changes. Material updates are published as a new immutable version with a new effective date, and users who have not accepted that version are asked to review and accept it before continuing with authenticated features.