Privacy Policy

The short version

We collect what we need to run conventions and nothing we don't. You go by your chosen name almost everywhere. We don't sell your data, and we don't run advertising trackers. The conventions you join see the information you give them — that's the point of joining — and nobody else does.

Names, and our stance on them

RallyPoint identifies you by your username and display name — the name you choose. That's what appears on your badge, in event signups, and anywhere other people see you.

Legal names are collected only where a convention genuinely needs them, such as verifying identity at badge pickup or processing a payment. When a legal name is collected, it is masked by default in organizer tools and revealed only deliberately, one record at a time, for those specific purposes. It is never shown publicly. If the name you use is not the name on your documents, the name you use is the one we treat as yours.

What we collect

• Account information — email address, username, and display name, managed through our authentication provider. Sign-in credentials are handled by that provider and never stored by RallyPoint.
• Convention activity — badges you hold, events you sign up for, merch you reserve, and applications you submit (volunteer, sponsor, exhibitor), including answers to questions the convention defines.
• Purchase records — what you bought or were granted, when, and for how much. Conventions need books that balance; those records are the ledger. Card numbers are handled by a payment processor when payments are live and never touch RallyPoint's servers. We do keep the payment method type and the last four digits of a card, for reconciliation and dispute lookups; they are never shown to attendees.
• Abuse signals — records of checkouts declined at a convention's purchase limit, reservations that expired unpaid, and unusual request patterns. We monitor how the application is used to identify abuse and protect conventions from it, not to identify or track people.
• Email we send — receipts, invitations, and the alerts and announcements conventions send through us. You manage alerts from your profile.

The only cookies are the ones that keep you signed in. Per-device preferences live in your browser's own storage and never leave it. There is no third-party analytics and no advertising tracker.

Who sees what

When you register for a convention, apply to volunteer, or exhibit, the organizers of that convention see the information you submitted to them. They see your display name and email for the practical business of running their event. They do not see your activity at other conventions, and they may use what you give them only to run their event.

Legal names, where a convention collects them, are masked in organizer tools and revealed one record at a time for a specific purpose — at the pickup desk, one name on screen at a time.

We share data with the service providers required to operate the platform, each bound to use it only to provide their service: Clerk for sign-in, Neon and Google Cloud for the database and the API, Google Cloud Storage for images, Cloudflare for the websites, Stripe for payments, and Postmark for email. Your data is stored in the United States. We do not sell personal information, and we do not share it with advertisers or data brokers.

Retention and deletion

You can ask us to delete your account and personal information. Some records survive deletion where they must: a convention's financial ledger is an audit record, so purchase rows are retained with your identifying details removed rather than erased outright. Otherwise we keep your information for as long as your account exists.

Data moves over encrypted connections and sits behind access controls; the people who can see it are the people who need to. If a breach ever affects your information, we will tell you. If you live somewhere that gives you specific rights over your data — the EU, the UK, California — email us and we will honor them.

Children

RallyPoint accounts are for people 13 and older. Conventions welcome attendees of all ages, but the account holder — the person registering — must meet the age requirement.

Changes and contact

When this policy changes, the update lands on this page with a new date. Questions or deletion requests: support@rallypoint.events.