Privacy policy

Every club owns its private data: SetRally never shows it to another club and hands it back whenever the club wants. Results, on the other hand, are public, like a results sheet pinned up in the gym — and SetRally uses them to keep each player’s history and rating.

Our three promises

• A club’s private data belongs to the club. Email addresses, genders, official levels, registrations, payments, attendance, notes: what the club enters, and what its players give it when they sign up, is the club’s. SetRally never shows it to another club, doesn’t sell it, and doesn’t use it for advertising.
• Results are public. Players’ names, their teams, the divisions and match scores show without signing in, as on federations’ results sites. SetRally also uses them for players’ history, rating and rankings, across events and clubs.
• The club takes its data with it whenever it wants, on every plan, the free one included: see Export your data.

Who is responsible

The SetRally service — the setrally.com site and the app.setrally.com app — is operated by Badminton À Montréal Inc. (Québec enterprise number 1181602849) under the name SetRally Software. SetRally was born at BAM!, a Montréal badminton league that uses it like any other club: no club, BAM! included, has access to another club’s private data.

Two roles share the data. The club — the organizer who creates its events — decides what information it collects about its players and what it uses it for; SetRally processes it on the club’s behalf, to run its events. SetRally is directly responsible for SetRally accounts themselves — organizers’ and players’ alike — and for what links an account to its records, as well as for public results when it uses them on its own account: players’ history, rating, rankings and profiles. The terms of use set out these roles.

Person in charge of the protection of personal information: contact@setrally.com.

What SetRally keeps

SetRally accounts

For every account, organizer or player: name, email, language and the sign-ins in progress. An organizer’s password is never stored as such — only a fingerprint from which it can’t be recovered — or, if you sign in with Google, the identifier Google sends us. For an organizer, each person’s role in their organization; the console also records who did what — who entered or corrected a score, for instance — so the club can check it.

For a player’s account, in addition: the email addresses they have confirmed, through a link received at that address or through Google; their consent, dated, with the version of this policy and their statement that they are 14 or older; the records they have linked, each with the date of their agreement; and the sign-ups they have made, for themselves or for someone else.

For players

What the club enters, or the player fills in when signing up: name, email (optional), team or partner, gender when a division requires it or the club asks, and the official level or ranking when the club follows one. Then what the season produces: availability replies, attendance, matches and scores. When a player signs someone else up, that person’s record carries only their name; the sign-up keeps the account that made it, and its emails go to that account. For a session paid online, the person signing up also has their own record at the club — their name and their account’s address — made and linked to their account if there was none: that is where the credit from a cancellation goes.

Registrations and payments

The option chosen, the amount, where the payment stands, the note left for the club and, if there are any, acceptance of the club’s own terms. Online payments go through Stripe, on the club’s account. The payment form is Stripe’s own, shown inside SetRally’s page; card numbers go straight from your browser to Stripe, and SetRally never sees or stores a card number. For a session, each sign-up also keeps the cancellation rule shown at the time of payment, and what was refunded or credited.

The credit a club grants a player is kept in a ledger, on the player’s record at that club: each movement is a dated line — credit on a cancellation, spending on a sign-up, a refund to the card, credit paid back by the club — that is never edited: a correction is a new line. This ledger is part of the club’s data.

The photo a player adds to their player card stays on their device: it is never uploaded.

Images attached to messages

An organizer can attach one image — a map of the hall, a poster — to the word they send the players of a session, or to the one they send the captains of a team league. SetRally keeps it and shows it to those who receive that word: in the email and, for players, on their reply page. It is served at an address that cannot be guessed, never on a public page. Before it is sent, the organizer’s browser shrinks and re-encodes it: the photo’s metadata, its GPS position included, are not transmitted. When the organizer removes or replaces it, or the session or event is deleted, SetRally erases it and stops serving it. An image can show people: an organizer who attaches one makes sure they may share it.

What is public

An event’s public page, the Arena and the players’ link show, without signing in, players’ names, their teams, the divisions and the results — like a results sheet pinned up in the gym. The sign-up form says so when you sign up.

SetRally may also gather a player’s results on a public profile, with their history and rating by sport and discipline.

Never shown publicly: email addresses, gender, players’ official levels, payments, notes and images attached to messages.

What it is used for

Running the club’s events: sign-ups, placement, schedule, scoring, standings. Applying the club’s rules for a session: crediting a player who cancels before the deadline, refunding them to their card when the club decides so, offering a freed place to the waitlist. Keeping your SetRally account: signing you in, bringing your sign-ups and records together, and filling in your name on your next sign-up. Sending the emails the club triggers — invitations, reminders, receipts — and the sign-in link you ask for. Taking online payments, keeping bots off the sign-up form, and answering you when you write to us.

Keeping, from the results, each player’s history and rating, and rankings, across events and clubs. Results are collected for this purpose from the start: the sign-up form says so, and organizers tell the players they add by hand.

Measuring how SetRally is doing, in overall counts and rates — how many sessions were played, how many clubs are active, what share of scores players entered themselves — to run and improve the service. These figures name no player and no club, and SetRally may publish them. The SetRally team also sees, for each organization, its plan and its organizers’ email addresses, to support and bill it.

Nothing else: no advertising, no sale, no promotional email sent to players.

Who it is shared with

Only with the providers the service needs in order to work, and only for that need:

• Cloudflare — hosts the site, the app and the database, and checks on the sign-up form that a person is filling it in (Turnstile).
• Stripe — online payments, on the club’s Stripe account; its payment form shows inside SetRally’s pages when you pay.
• Resend — sending emails.
• Google — Sign in with Google, only if you choose it; and the site’s and app’s fonts, which your browser downloads from Google, so Google sees your IP address.

These providers may process data outside Québec, notably in the United States. Before entrusting them with this information, SetRally assessed the privacy-related factors of that transfer, as the law requires. SetRally discloses information to an authority only when the law requires it.

Test copies

To diagnose a problem, the SetRally team may copy a club’s data into its test environment. Players’ email addresses there are always replaced with fictitious ones, so no message can reach them; names and results stay.

Between clubs

In each club, a person has their own record, and their private information is never shown to another club. Their SetRally account brings their records together for them alone. A record is linked to it only with their agreement — by signing themselves up, which a line announces before sending, or by ticking a box in their account — and only if the record’s address is one they have confirmed. Only one record per club can be linked to an account. Their results, however, follow them: those they earn in several clubs may be gathered into one history and one rating. To recognize the same person from one club to another, SetRally may rely on their SetRally account, the email address the clubs hold for them, or their own request; this information serves to recognize them, never to show them to another club.

Export your data

In the console, Settings → Your data downloads an event’s data as files a spreadsheet opens: players, registrations and payments, results and, for a league, standings. On every plan, at any time, without asking us. The details are in the guide.

A player downloads, from their account settings, a file that sets out their account, their consents, their confirmed addresses, their records with their sign-ups and availability replies, and the sign-ups they made for others.

Retention and deletion

• A club’s private data stays for as long as the club uses SetRally.
• An organizer can delete an event at any time: its divisions, registrations and results are erased from the club’s console.
• When an event is deleted or a club leaves SetRally, SetRally may keep its results — names, matches, scores, dates — for players’ history and rating, detached from any private information.
• A player who runs no club deletes their account themselves, from its settings. Their sign-ins, confirmed addresses and consents are erased; their records stay with the clubs, detached from the account, with their sign-ups, results and credit; the sign-ups they made for others stay there too, no longer carrying their account.
• To delete a whole organization or an organizer’s account, write to us: for now it is done by hand.
• The database keeps a 30-day history so an error can be repaired; erased data leaves it within 30 days.

Your rights

You can ask to see the information about you, to have it corrected or erased, to receive a copy in a common format, and to withdraw your consent. Ask the club that signed you up, or write to us at contact@setrally.com: we answer within 30 days. If the answer doesn’t satisfy you, you can turn to Québec’s Commission d’accès à l’information.

A player can also ask us to remove their name from their public profile and history: their results are then made anonymous, and keep counting toward their opponents’ ratings without naming them.

A player can also take some of these steps themselves, from their account settings: downloading their data, deleting their account.

A SetRally account is for people aged 14 and over, who declare it when creating it. A player under 14 has no account: their parent or guardian signs them up from their own account, and that consent also covers the child’s history and rating.

Cookies

The app only uses the cookies it needs: keeping you signed in — 90 days for a player, 30 for an organizer —, remembering your language, remembering which player you are on a players’ link, and completing a Google sign-in. Your browser also keeps a few display preferences and, while you sign in for a sign-up, the address the link was sent to. When you pay, and only then, Stripe’s payment form sets two cookies it uses to prevent fraud: __stripe_mid (one year) and __stripe_sid (30 minutes). No advertising cookie, no audience measurement.

Security

Everything goes over HTTPS. Passwords are stored as a salted fingerprint, never in plain text. Each organization sees only its own data, and in the console only the club’s administrators and managers can change an event’s settings and export its data. Payments go through Stripe.

Changes

Any change to this policy is published here with its date. A significant change is announced to organizers before it takes effect. A player’s consent keeps the version they accepted.