Rally Reader Data Storage
Rally Reader Data Storage
Last updated: 09/30/2026
We take student data privacy seriously. We never sell your data. This page tells you where your information is stored, who can reach it, and under what rules.
Where your information is stored
Rally Reader runs on three platforms. Amazon Web Services and Google Cloud each have separate Canadian and United States environments; Vercel runs our server-side code in its Montréal region:
Amazon Web Services: The book system — book storage, copy protection, licensing and purchases — and the login system.
Google Firebase / Google Cloud: The rest of the application — application data, reading data, reading content, logs and backups.
Vercel: Our websites, and the server-side code behind our registration forms.
A Canadian account’s information stays in the Canadian environment on each platform.
Named Canadian regions: AWS ca-central-1 (Montréal), with ca-west-1 (Calgary) as backup; Google Cloud northamerica-northeast1 (Montréal), with northamerica-northeast2 (Toronto) available; Vercel yul1 (Montréal), with all server-side code executing there.
Each provider is bound by written agreement not to use information stored on its infrastructure for any purpose other than operating the Rally Reader service.
Canadian customers. Information about Canadian accounts is stored in Canada, in the Canadian environment on each platform. Our application database, file storage, book system, login system, application logs and backups are all in Canada. No copy of Canadian information is stored, hosted, replicated or backed up in any other country. Canadian information is not transferred out of Canada.
United States customers. Information about US accounts is stored in the United States.
Our service provider list — the companies that host and run the Rally Reader application and our websites, what each does, and where each processes information — is published at rallyreader.com/legal/data-storage/service-providers.
Who can reach your information
Storage and access are different questions, and Rally Reader’s answers to them are different. Nothing leaves Canada. But people outside Canada can look at what is in Canada.
Rally Reader employs support, service and customer success staff in Canada, the United States and Europe. When one of them is working on a support request, they may access account information for that purpose only. They do so by connecting remotely to the Canadian environment. The information remains stored in Canada throughout: it is displayed to the person handling the request, not moved to another country to be kept or processed there.
That access is:
- limited to what the request requires;
- logged;
- covered by written confidentiality obligations;
- concentrated on system and account settings. Reading Content — the audio of a child reading, and the associated book capture — is technically reachable but is rarely needed for support.
Under Canada’s Personal Information Protection and Electronic Documents Act, sending information to a service provider for processing is a use, not a disclosure, and does not require separate consent. We tell you about it because you should know where your information can be reached from.
Our support tooling does not export, cache or store Canadian personal information on systems outside Canada. Support tickets, screenshots and debugging extracts are subject to the same rule.
We maintain written data processing agreements with every sub-processor.
Nova Scotia
Nova Scotia’s Personal Information International Disclosure Protection Act requires a public body and its service providers to store personal information in Canada and to access it from within Canada, subject to limited exceptions.
Our storage meets that requirement. Our support model does not, on its face, because support staff outside Canada may access information temporarily.
A Nova Scotia school wishing to use Rally Reader should contact us. We will work out a path.
How long we keep information
While an account is active, we keep the information needed to run it.
After a customer relationship ends, we keep information for a minimum of 90 days and up to 12 months, and delete it at 12 months as standard. If you ask us to delete sooner, we will. Deletion from live systems is immediate.
Backups run on a fixed cycle and are immutable, so deleted information persists in backups until the cycle expires:
- Point-in-time recovery backups are retained for 7 days.
- Daily backups are retained for 30 days.
- Weekly backups are retained for 98 days.
Backups are used only to restore the service after a failure. Where a restore would reinstate information already deleted, we re-apply the deletion.
IP addresses and approximate location
We receive an IP address with every request, as every internet service does, and derive an approximate location from it — country, province or state, and in some cases city.
We use it to secure the service and, where books are purchased, to determine which tax jurisdiction applies, so the correct sales tax is charged and remitted.
We do not collect a precise device location. The app does not ask a device for its location, and no location permission prompt appears.
What we never do
- We do not sell, rent or trade personal information.
- We do not use a student’s personal information for advertising or marketing.
- We do not use personal information to train artificial intelligence or machine learning models, and we do not authorize any service provider to use it for that purpose.
- We do not send email, text messages or in-app messages to a student.
The rules we work under
Canada. The Personal Information Protection and Electronic Documents Act; Alberta’s and British Columbia’s Personal Information Protection Acts; Quebec’s Act respecting the protection of personal information in the private sector as amended by Law 25; and, where we act as a service provider to a public school board, that province’s public-sector Act — including Ontario’s Municipal Freedom of Information and Protection of Privacy Act together with section 266 of the Education Act, British Columbia’s Freedom of Information and Protection of Privacy Act, Alberta’s Protection of Privacy Act, New Brunswick’s Right to Information and Protection of Privacy Act, and Nova Scotia’s Personal Information International Disclosure Protection Act.
Our Canadian Privacy Statement sets this out in full, including where we conform to a standard and where we do not.
United States. The Family Educational Rights and Privacy Act, the Children’s Online Privacy Protection Act, the Protection of Pupil Rights Amendment, and state student data privacy laws.
Security
We protect information with encryption in transit and at rest, role-based access controls, logging and monitoring, staff training and periodic independent security testing.
Questions
Rally Reader, Inc.
265 Cambridge Ave #60459
Palo Alto, CA 94306
- General and support: hello@rallyreader.com
- Privacy: legal@rallyreader.com
- Legal notices: legal@rallyreader.com
Our Privacy Lead is Stouffer Egan, reachable at legal@rallyreader.com.