Privacy Policy
Last updated: July 24, 2026
CPRally respects your privacy. This Privacy Policy explains how CPRally collects, uses, discloses, and protects information when you visit cprally.com, use the CPRally application at app.cprally.com, participate in an event managed through CPRally, or otherwise communicate with us.
The public website and application serve different purposes:
- cprally.com provides public product information and searchable upcoming-event discovery.
- app.cprally.com provides account access, event administration, registration, team participation, checkpoint check-ins, scoring, standings, results, and related event workflows.
By using CPRally, you acknowledge the practices described in this Privacy Policy.
1. Information We Collect
The information CPRally collects depends on how you use the platform.
1.1 Public Website Information
You may browse most of cprally.com without creating an account.
When you use the public website, CPRally may process:
- Search terms and event-type filters you submit
- Public event pages or links you request
- Internet Protocol address
- Browser and device information
- Request date and time
- Referring page and requested URL
- Technical and security information needed to operate, protect, and troubleshoot the site
The public-site MVP does not use advertising cookies, cross-site tracking, or analytics cookies unless those practices are separately approved and this Privacy Policy is updated.
1.2 Account and Identity Information
Standard users sign in to the CPRally application using Google Sign-In. When you authenticate, CPRally may receive and store:
- A CPRally user identifier
- Your email address
- Your display name
- Your Google account subject identifier
- An optional profile-image URL
- Account creation date
- Last sign-in date
- Account status
CPRally does not receive or store your Google password.
Google processes your interaction with Google Sign-In under Google's own privacy policy and terms.
1.3 Organization, Event, Registration, and Team Information
When you create, manage, register for, or participate in an event, CPRally may collect or store information such as:
- Organization membership and administrative assignments
- Event-management assignments
- Event registrations and registration status
- Team name, team membership, and team-captain status
- Event class
- Event participation and progress
- Checkpoint completion history
- Scores, poker cards or hands, standings, and results
- Announcements and organizer-provided event content
- Event, organization, sponsor, and card-image content provided by authorized organizers
- Records of approvals, changes, exports, and administrative actions
Some information is supplied directly by you. Other information may be entered or managed by an event organizer or authorized organization representative.
1.4 Location and Check-In Information
CPRally uses location information to validate checkpoint check-ins.
When you choose to submit a check-in and grant browser or device location permission, CPRally may collect:
- Submitted latitude and longitude
- Reported location accuracy
- Date and time of the check-in attempt
- The user, team, event, and checkpoint associated with the attempt
- Whether the check-in was accepted or rejected
- Information needed to detect duplicate or invalid check-in attempts
Location is requested for a check-in workflow. CPRally is not designed to continuously track your location, create a travel history outside submitted event activity, or collect location in the background.
You may deny or revoke location permission through your browser or device. GPS-based check-ins will not work without the required location information.
1.5 Communications
When you contact CPRally or communicate with an event organizer through supported channels, we may collect:
- Your name and email address
- The content of your inquiry
- Information you choose to provide
- Records needed to respond, troubleshoot, or document the request
CPRally does not provide a public contact form in the MVP. Communications may occur through configured email links or other approved contact methods.
1.6 Technical, Audit, and Security Information
CPRally records technical, audit, and security information to operate and protect the platform. This information may include:
- Internet Protocol address
- Browser and device information
- User-agent information
- Sign-in and sign-out activity
- Failed authentication attempts and failure categories
- Session and request timestamps
- Actions performed in the application
- Changes to organizations, events, registrations, teams, checkpoints, scoring, and settings
- Authorization failures
- Suspected cross-organization access attempts
- Correlation identifiers and diagnostic summaries
- Export activity and other security-sensitive actions
CPRally does not display passwords, password hashes, OAuth tokens, session cookies, connection strings, or other secrets in normal user-facing logs.
2. How We Use Information
CPRally may use information to:
- Provide, maintain, and improve the public website and application
- Authenticate users and maintain secure sessions
- Create and maintain user accounts
- Resolve organization, event, team, and participant permissions
- Process event registrations and team participation
- Validate GPS checkpoint check-ins
- Assign cards and calculate scoring for supported event formats
- Generate standings, leaderboards, results, reports, and exports
- Display public event information when an organizer enables public visibility
- Support organizers in administering events
- Preserve completed-event records and event history
- Respond to questions and provide support
- Detect, investigate, and prevent fraud, abuse, security incidents, and unauthorized access
- Enforce platform rules and protect users, organizations, and CPRally
- Comply with legal obligations and respond to lawful requests
CPRally uses location information for event check-in validation and related event, audit, support, and security purposes. CPRally does not use precise check-in location for advertising or targeted marketing.
3. How Information Is Shared
CPRally does not sell personal information. CPRally does not use personal information for cross-site behavioral advertising or targeted advertising.
Information may be disclosed in the following circumstances.
3.1 Event Organizers and Authorized Organization Users
Information related to an event may be available to authorized organization administrators, event managers, and other users with appropriate permissions.
Depending on your role and the event configuration, this may include:
- Registration and team information
- Check-in history and validation results
- Event progress
- Scores, standings, and results
- Information needed to operate, support, audit, or correct the event
Organizations and event organizers are responsible for their own event practices, instructions, and lawful use of information available to them.
3.2 Other Participants and the Public
Certain information may be visible to other participants or the public when the event organizer enables the applicable visibility setting. This may include:
- Event name and public description
- Organization name
- Event type, date, and public location
- Event image
- Team name
- Class
- Standings, leaderboard position, or results
- Sponsor information
CPRally does not make private events, participant contact information, precise checkpoint coordinates, hidden clues, internal identifiers, audit logs, or security logs publicly available.
3.3 Service Providers
CPRally may use service providers to support functions such as:
- Cloud hosting and application delivery
- Database storage
- Identity and authentication
- Email delivery
- Map and tile delivery
- Security, logging, and operational support
These providers may process information only as needed to provide their services to CPRally and are subject to their own terms and privacy practices.
3.4 Legal, Safety, and Security Reasons
CPRally may disclose information when reasonably necessary to:
- Comply with applicable law, regulation, legal process, or governmental request
- Protect the rights, safety, or property of CPRally, users, organizers, or others
- Investigate fraud, abuse, security incidents, or violations of platform rules
- Establish, exercise, or defend legal claims
3.5 Business Changes
If CPRally is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information may be transferred as part of that transaction, subject to applicable law and appropriate protections.
4. Public Event Information and Organizer Control
Organizations control whether an eligible event is publicly discoverable and which supported information is made public.
The public Events page displays only information that satisfies CPRally's public-event eligibility and visibility rules. Public event summaries may include an event name, organization name, event type, date, general location, short description, registration availability, and an optional event image.
Selecting a public event may take you from cprally.com to the event's public page on app.cprally.com.
Disabling public visibility prevents future anonymous access but may not remove information that was previously copied, shared, indexed, or captured by others while it was public.
5. Cookies, Sessions, and Browser Storage
5.1 Public Website
The public-site MVP does not rely on advertising, cross-site tracking, or analytics cookies.
The public site does not store business data, event data, or user profiles in local browser storage. Harmless temporary interface state may be stored when necessary.
5.2 CPRally Application
The CPRally application uses essential session technology to keep authenticated users signed in and to protect application workflows.
Session cookies are used for authentication and security. They are not used for advertising. Session information is scoped to the application and is not shared with the public marketing site as a cross-site login state.
Your browser may also store limited preferences or harmless interface state where supported. CPRally does not treat browser-stored permissions or role information as authoritative.
5.3 Third-Party Services
Google and other external services may use their own cookies or similar technologies when you interact with them, such as when you use Google Sign-In or follow an external link. Their practices are governed by their own privacy policies.
6. Data Retention
CPRally retains information for as long as reasonably necessary to:
- Provide and support the platform
- Maintain accounts, memberships, registrations, teams, event history, standings, and results
- Preserve auditability and historical accuracy
- Meet organizer, security, dispute-resolution, and legal needs
- Enforce agreements and protect the platform
Completed events and their associated operational records may be retained as historical records.
Audit, security, check-in, scoring, export, and administrative records may be retained when needed to investigate activity, preserve event integrity, support users, or satisfy legal obligations.
When information is no longer reasonably required, CPRally may delete, anonymize, or otherwise dispose of it, subject to technical limitations, backup cycles, legal obligations, and legitimate recordkeeping needs.
7. Data Security
CPRally uses administrative, technical, and organizational safeguards intended to protect information. These include access controls, tenant isolation, server-side authorization, secure sessions, input validation, logging, and restrictions on access to sensitive records.
No method of transmission or storage is completely secure. CPRally cannot guarantee absolute security.
You are responsible for protecting access to your Google account, device, browser, and any account or event links you receive.
8. Your Choices and Privacy Requests
8.1 Account and Profile Information
You may review supported profile and account information in the CPRally application.
Some identity information, including the email address associated with Google Sign-In, is managed through your Google account and may not be editable within CPRally.
8.2 Location Permission
You control location permission through your browser and device settings. You may deny or revoke permission, but GPS-based checkpoint check-ins require location access.
8.3 Public Visibility
Event organizers control public event visibility and related public settings. Contact the applicable organizer with questions about an event's public content, team information, standings, or results.
8.4 Access, Correction, and Deletion Requests
Depending on where you live and applicable law, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information.
The MVP does not include a self-service account-deletion or privacy-download tool. Submit privacy requests through the CPRally Contact page:
Please provide enough information to identify your account and request. CPRally may need to verify your identity before completing a request.
Some requests may need to be directed to the organization or event organizer that collected or manages the event information. CPRally may retain information when required or permitted for security, legal compliance, dispute resolution, historical event integrity, or other legitimate purposes.
You may appeal a privacy-request decision when applicable law provides that right by replying to the decision or contacting CPRally again with the word “Appeal” in the subject line.
8.5 Marketing Communications
CPRally does not operate a marketing-newsletter or bulk marketing-email program in the MVP.
Operational messages may still be sent when needed for authentication, invitations, event participation, support, or platform administration.
9. Children's Privacy
CPRally is not directed to children under 13.
Do not create an account for, register, or submit personal information about a child under 13 through CPRally unless the responsible organization has confirmed that it has the legally required authority and parental consent.
If CPRally learns that personal information from a child under 13 was collected without the required authorization, CPRally may take steps to delete or restrict that information. Contact CPRally through the Contact page if you believe this has occurred.
10. Third-Party Websites and Services
CPRally may link to third-party websites, navigation services, sponsor websites, organizer resources, Google authentication, or other external services.
CPRally does not control the privacy, security, content, or availability of third-party services. Review their privacy policies before providing information to them.
Map displays may retrieve tiles or related resources from external mapping services. Those services may receive ordinary request information such as your Internet Protocol address and browser information.
11. United States Operation
CPRally is intended primarily for use in the United States.
Information may be processed in the United States or in other locations where CPRally's service providers operate. Privacy protections in those locations may differ from those in your place of residence.
12. Changes to This Privacy Policy
CPRally may update this Privacy Policy to reflect changes in the platform, data practices, service providers, or legal requirements.
When the policy changes, CPRally will update the “Last updated” date. Material changes may also be communicated through the website, application, or another appropriate method.
Your continued use of CPRally after an updated policy becomes effective is subject to the updated policy.
13. Contact CPRally
Questions, concerns, and privacy requests may be submitted through:
The Contact page provides CPRally's configured public contact email address.
For event-specific questions, you may also need to contact the organization or organizer responsible for the event.
Related Policy
Read the CPRally Terms of Use:
Return to the CPRally homepage: