Privacy Policy
Effective November 13, 2026
Who is responsible for your data
Daily Rally is a daily trivia game at dailyrally.io, run by one person, who is responsible for the personal data described here (the “data controller” under the GDPR). You can always reach them at dailyrally.support@gmail.com.
The short version
- You can play Daily Rally without an account, a name or an email. When you play without signing in, we do not receive any personal data about you.
- There are no ads, no analytics and no tracking cookies.
- Signing in with Google is optional. It is only needed to buy Archive and Unlimited, or to keep your progress on several devices.
- We never sell or rent your data, and your card details never reach us.
Data saved on your device
Your progress, streak, rally history, settings, chosen car and, if you sign in, your sign-in session are saved in your browser's local storage on your own device. This is strictly necessary for the game to work, so it does not need consent. It is not sent to us unless you sign in. You can erase it at any time with Settings > Delete my data or by clearing the site data in your browser.
Data we process and why
| What | Why | Legal basis (GDPR art. 6) | How long |
|---|---|---|---|
| Google sign-in: your Google account ID, name, email address and profile picture (if any) | To create your account, show who is signed in and connect your purchases and saved progress to you | Contract - providing the service you asked for (6.1.b) | As long as your account exists. Deleted within 30 days after you ask us to delete it |
| Saved progress: streak, rally history, settings and cars | So your progress follows you to other devices | Contract (6.1.b) | As long as your account exists |
| Purchases: what you bought, when, the amount and Stripe's payment reference (never your card details) | To unlock what you bought and restore it on any device | Contract (6.1.b) and legal obligation - bookkeeping and tax law (6.1.c) | As long as your account exists, and the accounting records as long as bookkeeping law requires (generally 6 years after the end of the year of purchase) |
| Emails you send us: your email address and message | To answer you and fix problems, such as missing answers or purchases | Legitimate interest in handling your request (6.1.f) | Until the matter is handled, then deleted within 12 months |
| Technical logs: IP address, browser type and time of the request, kept by our hosting provider | To deliver the website and protect it from attacks and abuse | Legitimate interest in a secure website (6.1.f) | Short-lived, as set by Cloudflare |
Giving us personal data is voluntary. If you do not sign in, you can still play the daily rally and the theme rally; you just cannot buy or sync progress. We do not make decisions about you based solely on automated processing, and we do not profile you.
Who processes the data for us
We use the following service providers. Each only gets what its job needs:
- Cloudflare - hosting and security of the website. Cloudflare privacy policy
- Supabase - sign-in, saved progress and purchase records. The database is located in the EU (Ireland). Supabase privacy policy
- Google - the optional Google sign-in. Google privacy policy
- Stripe - processes payments on its own checkout page. Stripe handles your card details as an independent controller; we only receive a payment confirmation. Stripe privacy policy
- Buy Me a Coffee - optional donations on its own website, as an independent controller. Buy Me a Coffee privacy policy
- Gmail (Google) - our support email.
Transfers outside the EU
Some of these providers (Cloudflare, Google and Stripe) may process data outside the European Economic Area, for example in the United States. In those cases the transfer is protected by the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
Cookies and similar technologies
Daily Rally sets no cookies of its own and uses no advertising, analytics or tracking. The game only uses your browser's local storage for things it needs to work, as described above. Cloudflare may set a short-lived, strictly necessary security cookie to block bots. Stripe and Buy Me a Coffee use their own cookies on their own websites. If ads or analytics are ever added, we will ask for your consent first and update this policy.
Your rights
Under the GDPR you have the right to:
- get a copy of your personal data (access) and receive it in a machine-readable format (portability)
- have incorrect data corrected (rectification)
- have your data deleted (erasure), unless the law requires us to keep it - for example accounting records
- restrict or object to processing that is based on legitimate interest
To use your rights, email dailyrally.support@gmail.com - if you have an account, from the email address of that account so we can confirm it is you. We answer within one month. Data on your own device you can delete yourself at any time with Settings > Delete my data.
You also have the right to lodge a complaint with a data protection authority, for example in the EU country where you live. List of EU data protection authorities
Security
The site is served only over encrypted HTTPS. Signed-in players can only access their own data (database row-level security), purchases can only be recorded by our server after Stripe confirms the payment, and we do not store passwords - sign-in is handled by Google.
Children
Daily Rally is not directed at children under 13, and we do not knowingly collect personal data from them. You must be at least 13 years old to sign in. If you are under 18, please ask a parent or guardian before buying. If you believe a child has given us personal data, email dailyrally.support@gmail.com and we will delete it.
Changes to this policy
We may update this policy when the game or the law changes. The date at the top always shows the current version.
Contact
Questions about privacy or your data: dailyrally.support@gmail.com. The rules of the game and of purchases are in the Terms of Use.