About you, the developer

Account details: your name, email address, the company you tell us about, and your two-factor setting, to run your account and keep it secure.
Keys: a name and the first characters of each key. We store only a one-way hash of the rest, so we cannot read your keys back.
Usage: the number of calls each key makes each day, live or test, and when a key was last used, to apply your plan, bill overage and show your usage. We keep these counts while your account exists; invoices that rely on them are kept as long as tax law requires.
Errors: when a request fails on our side, our error report may include its time, path, request id and IP address so we can find the fault. Error reports do not include your key.
Billing: Stripe handles card details for paid plans. We keep invoices and the plan history.

Connected apps and OAuth

When you connect an app with OAuth, we keep which app it is (its name and the addresses it may return to), which of your keys it acts as, and when it was last used. We store only hashes of codes and tokens.
Apps can read only what the MCP tools return. They cannot see your account details, your guests' details or your payment information.
The app you connect, such as an AI assistant, has its own privacy policy for what it does with the answers it receives. We do not control it.

About your guests

When you book for a guest, you send us their name and email address. We use them to hold the booking, email the guest a link to pay and manage it, and keep the booking record as our booking terms require.
You must have the guest's permission to send us their details, and tell them that we will email them about the booking.
Test bookings are checked and never stored, so guest details in them are not kept.
Once the guest signs in or joins, our privacy policy applies to them directly.

What the API never shares

The API and MCP server never return personal information about players, or the text of reviews. Coach and club details are those they chose to publish on Rally & Roam.

Your rights

You can see and change your account details at any time, download your data, and close your account. Our privacy policy explains your rights under UK GDPR, including complaining to the Information Commissioner's Office.

Privacy for API and MCP use