Privacy notice

Version 2026-10-13 · Pilot notice. Operator contact details and retention periods must be completed before a broad public launch.

Join without an account

We collect your contact details to record club membership or event registration. Account creation is optional. Organizers may use operational contact details for their own events. Your personal profile and audience answers are not public. The only thing shown publicly is a review you choose to post (see Reviews below).

Three separate choices

Privacy and event terms agreement is required for registration. Analytics consent and marketing consent are separate, optional and off by default. Joining does not subscribe you to marketing. You can skip all audience questions.

Insights

Only profiles with current analytics consent are counted in demographic insights. Organizers see aggregated age bands and income ranges, never full dates of birth or exact income. Nothing is shown until at least five people have answered, and a group of fewer than five is never named: it is merged into an unlabelled “Other answers” row. Emergency phone numbers are limited to confirmed attendees at events requiring them, from 24 hours before until 24 hours after the event.

Reviews

Reviewing is optional. If you review an event you attended, your rating, words and photos are public on the club’s page, shown with the nickname you gave when registering or, if you gave none, your first name and the first letter of your last name (or your Rallyfox display name, for an older member registration). Choose “Post anonymously” to show “Anonymous joiner” instead; the club is then not shown who wrote it, although at a small event it may be able to guess. Rallyfox keeps a private link between a review and its author to prevent duplicates and to handle deletion requests. You can edit or delete your own review at any time. The club can post a public reply but cannot edit or remove your review. Only post photos you have permission to share.

Remembering your details

An essential secure cookie remembers a guest identifier for 30 days so this device can prefill your details. No personal information is stored in localStorage; if you save an event without an account, only that event’s ID is kept on your device. On a shared device, use “Forget this device profile” in the join form. Entering an email alone does not reveal an existing profile.

Instagram and payments

Your Instagram name is optional. If you give it, only the organizer of the event you join can see it. For a paid event, the organizer’s payment details (a QR code or bank account) are shown to people registering. If you attach a transfer slip, only that club’s team can open it; it is used to confirm your payment and for nothing else. Rallyfox does not receive, hold or move money.

What organizers see about attendance

Organizers see who registered and came to their own events, including a short list of people who came once or have stopped coming (first name and the first letter of the last name), so they can invite them back. They also see how many of their joiners have joined another club on Rallyfox, as a number only: never which clubs, and never names.

Visits

We count visits and note the site that sent you (for example Instagram or Google) to understand how people find Rallyfox. This uses no advertising cookie, and your address is not stored: only an anonymous mark that changes every day. If you then create an account or join, that source is saved with your profile for the platform administrator.

Your rights

Under Thailand’s Personal Data Protection Act you may ask to see, correct, delete or receive a copy of your data, object to its use, and withdraw a consent you gave. Use the form below. You may also complain to the Personal Data Protection Committee.

Providers and retention

Cloudflare hosts the site and stores profiles, registrations, photos and slips; its servers may be outside Thailand. Resend sends configured sign-in and confirmation emails. Data is retained for event operation and reviewed when you request deletion; the operator must finalize specific retention periods.

Administrators verify identity before releasing, correcting or deleting data. A request does not immediately delete records.