Measure attention. Minimize identity.

01 / Collection

Data the service needs.

• Account and organization identifiers, email, authentication state, roles, and security events supplied by Clerk.
• Public profile, product, ownership, organization, rally, and reputation information you submit or authorize.
• Reports, ownership evidence, support messages, appeals, moderation actions, and related audit history.
• Sponsor checkout amounts, provider identifiers, billing and transaction status, refunds, disputes, and ledger adjustments. Stripe collects full card credentials, not Spot & Rally.
• While measurement is on, a signed random visitor cookie, pseudonymous season-scoped visitor key, rally visit, visible-time totals, intentional measured outbound clicks, qualification decisions, and limited user-agent abuse signals. We do not durably store a raw IP address for scoring.
• A count of clicks on product links, recorded with the product, season, and time only. No cookie, identifier, or network address is stored, so this count does not depend on your measurement choice.
• Necessary request, rate-limit, deployment, database, email, and incident records created while operating and securing the service.

Do not submit passwords, full card data, government identifiers, health information, or unnecessary sensitive or third-party personal data in free-text fields.

02 / Purpose

Delivery, integrity, safety, and legal records.

We use data to authenticate and authorize users; publish requested profiles, products, boards, and rallies; verify ownership; calculate and explain the two independent rankings; prevent duplicate, automated, or manipulated activity; process and reconcile Sponsor transactions; investigate reports and appeals; provide support; protect the service; recover from failures; keep tax and contract records; and comply with law or establish legal claims.

03 / Recipients

Public fields and controlled providers.

Public profile, product, board, rally, title, and finalized season fields are visible to anyone. Other data is disclosed only as needed to providers performing a service: Clerk for identity, Neon for the database, Vercel for hosting and delivery, Upstash for rate limiting, Resend for operational email, Stripe for test and future payment processing, and professional advisers or authorities when reasonably necessary for law, safety, fraud, or a transaction involving the service.

Spot & Rally does not sell personal information or share it for cross-context behavioral advertising. Other parties do not collect information through Spot & Rally for their own cross-site advertising. External product sites have their own practices once you leave the service.

04 / Tracking

Verified Attention measurement can be turned off.

Measurement is on by default on rally pages only: opening a rally page sets the Verified Attention visitor cookie and creates a rally visit. Every rally page and the Privacy choices control in the footer let you turn measurement off with one click, which deletes the cookie and stops new visits and signals. Turning it off preserves the direct product link but cannot award a point. A product-link click is still counted for the product without any cookie or identifier. Global Privacy Control and Do Not Track turn measurement off until you turn it on. Authentication and security storage may still be used when you request a protected feature. See the Cookie and Storage Notice.

05 / Retention

Raw signals expire first.

Attention events, referral tokens, and linkable visitor keys are deleted or irreversibly de-identified 90 days after a season is finalized. The award fact and finalized result remain without a linkable visitor key. Account data normally lasts for the account plus 30 days; resolved reports, moderation cases, and ownership evidence for two years (with the decision retained); policy acceptance and privacy/copyright request audit for four years; payment, refund, dispute, tax, and accounting ledgers for seven years; and operational/security events for one year. Short-lived rate-limit counters expire in their configured windows.

We may retain specific records longer for an active dispute, security investigation, legal hold, fraud prevention, financial obligation, backup expiry, or another lawful requirement and will restrict their use accordingly.

06 / Choices

Access, correct, export, delete, or appeal.

Email support@spotandrally.com to request access, correction, a portable copy, deletion, or an appeal. Include the account email and request type, but no password or government ID. We verify proportionately, target completion within 45 days, explain extensions or denials, and do not discriminate for exercising a right. Authorized agents may be asked for signed authority and direct account confirmation.

Some information cannot be deleted immediately, including public content retained at your direction, another person's records, de-identified score history, fraud and security evidence, and contract, payment, tax, dispute, or legal records. We will explain the applicable exception. Dashboard editing remains the quickest way to correct supported public fields.

07 / Scope

Adults-only U.S. participation.

The service is not directed to children. Account participation is limited to people at least 18 and located in the United States. If we learn an account belongs to a minor, we suspend it and delete associated personal information unless safety or law requires limited retention. Public pages may be read elsewhere, but we do not intentionally offer account participation or Sponsor services outside the United States at this stage.

08 / Contact

Material changes are visible.

We update the effective date and post the revised notice. Material participant changes require renewed acceptance before the next account action. Contact support@spotandrally.com for privacy questions and security@spotandrally.com for a suspected vulnerability or incident.