Privacy

Last updated: April 18, 2026.

Short version: we collect what we need to run the program and to send you a receipt. We don't sell your data. You can read, export, and delete your data. If you have a question, email [email protected].

What we collect

  • Account basics. Your name, email, and phone number. We use the phone number for two-factor sign-in (Twilio Verify). We don't text you marketing.
  • Billing data. We use Stripe to process payments. We never see your card number. Stripe gives us back a customer ID, the last four digits of the card, the country, and billing events.
  • Program activity. Which lessons you opened, how far you got, and whether you marked a workbook complete.
  • Office-hours attendance. Which sessions you RSVP'd to and whether you showed up. Small-group no-shows count toward the no-show policy.
  • Server logs. IP address, user agent, timestamps of sign-in and sensitive actions. Kept 90 days for security.

Why we collect it

  • To run the program (lesson progress, cohort rosters, office-hours signups).
  • To process payments and prevent fraud (billing data + server logs).
  • To secure your account (two-factor, session rotation, audit logs).

Retention

  • Account data: kept while you have an account, plus 30 days after you delete it.
  • Billing records: kept as long as tax and accounting rules require (typically 7 years).
  • Server logs: 90 days.

Who we share with

We share the minimum needed, with these service providers:

  • Stripe — billing. See Stripe's privacy policy.
  • Twilio — two-factor sign-in codes (phone only).
  • Mux — video hosting and playback.
  • Cloudflare R2 — we store transcripts and thumbnails in R2.
  • PostHog — product analytics (anonymized page views, feature events).

We don't sell your data. If we're ever required to hand something over (subpoena, court order), we'll tell you unless the law forbids it.

Your rights

  • Access. Ask what we have. We send you a copy inside 30 days.
  • Export. Get a machine-readable copy of your data.
  • Delete. We remove your account inside 30 days. We keep billing records as long as the law requires.
  • Correct. If something is wrong, tell us and we'll fix it.
  • Complain. You can file a complaint with your local data-protection authority. In California, that's the CPPA.

Cookies and tracking

We use a session cookie scoped to .rallytasks.com so you stay signed in between Rally and vibe101. We use PostHog for anonymized product analytics. We don't use third-party advertising cookies.

Children

The program isn't aimed at kids under 13, and we don't knowingly collect their data.

International

Our servers are in the United States. If you're using us from outside the US, your data gets processed in the US.

Security

We take security seriously. Two-factor sign-in, no card data on our servers, secrets in environment variables, rate limits on sensitive endpoints, audit logs on admin actions.

Changes

If we change this page, we update the "Last updated" date. Material changes get an email.

Contact

Questions or requests: [email protected].