Privacy Policy — 3pRally & 3pRally Pro

Last updated: 2 November 2026
Effective date: 2 November 2026

This Privacy Policy explains how your information is handled when you use the 3pRally and 3pRally Pro applications for iPhone and iPad (together, the "Apps"). It applies to both equally.

The short version: we designed these Apps so that your data never leaves your control. We run no servers, we collect nothing about you, and we do not track you. The sections below explain this in the detail that data protection law requires.

1. Who we are (Data Controller)

The Apps are published by:

Stooj srl
Via Alfredo Panzini 71, 09045 Quartu Sant'Elena (CA), Italy
VAT no. (P.IVA): 03932870920, REA CA-350185
Share capital: €10,000.00, of which €2,500.00 paid up
Contact for privacy matters: privacy@stooj.co

Stooj srl is the "data controller" for the limited purposes described in this policy. Because the Apps do not send your personal data to us, in practice we hold no personal data about you. We are established in Italy, and this policy is governed by the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Italian data protection law (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

Stooj srl has not appointed a Data Protection Officer and is not required to: we carry out no large-scale monitoring of individuals and process no special categories of personal data. Privacy questions go to the address above.

2. Our privacy principles

No data collection by us. We operate no backend servers and no accounts. Nothing you do in the Apps is sent to Stooj.
No tracking. We do not use analytics SDKs, advertising identifiers, cross-app tracking, fingerprinting, or third-party trackers of any kind.
On-device by default. Your GPS position and everything you record are processed and stored on your device.
Your iCloud, your control. If you enable sync, your data is stored in your own iCloud account, which only you control. We have no access to it.
No selling or sharing. We do not sell, rent, or share your data with anyone, because we do not have it.

3. What the Apps process, and where it goes

3.1 Location (GPS) data

The Apps are GPS tripmasters and rally computers. To measure distance, speed, heading and time, to follow a roadbook, and to draw your track, the Apps use your device's precise location while you are recording.

This location data is processed on your device to power the odometer, timers, inclinometer, map display, average-speed and regularity calculations, and roadbook following.
It is used only for the app's driving/navigation features.
It is not transmitted to Stooj, and it is not transmitted to any third party by us.
You control location access through iOS. You can grant or revoke the Apps' location permission at any time in Settings → Privacy & Security → Location Services. The Apps request "While Using" (and, where you enable background recording, "Always") access solely to keep recording your track when the screen is off or another app is in front.

3.2 Track recordings, roadbooks, and your notes

When you save a track, the App stores information such as the route (a series of GPS points), distance, timestamps, automatically generated start/finish place names, and any names or notes you choose to add.

To find those place names, the App sends the start and end points of the track to Apple's place-name service, built into iOS, which returns the name of the nearest place. Only those two points are sent, never the whole route. Apple handles the request as an independent controller under its own privacy policy, and Stooj does not receive it.

The Apps also work with roadbooks, the sequence of waypoints, distances, headings, timings and instructions for an event. This covers roadbooks you create or edit in the App, and roadbook files you open from elsewhere on your device (for example from the Files app, an email attachment, or AirDrop).

These records are stored locally on your device.
If you enable iCloud sync, they are also stored in your personal iCloud account so you can access them across your own devices. This uses Apple's iCloud service under your Apple ID; Stooj cannot see or retrieve this data.
You can delete anything you have recorded, and all associated data, at any time from within the App, and you can remove iCloud copies through your Apple device or iCloud settings.

3.3 Maps

The Apps display your position and track on a map using Apple Maps (MapKit), Apple's built-in mapping framework. When maps are shown, Apple processes the map requests needed to serve map tiles, in accordance with Apple's own privacy policy. Stooj does not receive this information and is not the controller of it. A data connection is only used to load maps and to look up the place names described above; the core functions work offline.

3.4 Purchases and the App Store

You obtain the Apps through the Apple App Store. Apple processes your download, payment, and account information as an independent controller under Apple's privacy policy. Stooj never receives your payment details, your card, or your App Store account identity. At most, we may see aggregated, anonymised sales and App Analytics reports from Apple that cannot identify you, and only if you have allowed Apple to share analytics.

The Apps are downloaded free and include a time-limited trial. After the trial, continued access to the full feature set requires an in-app purchase, either an auto-renewing subscription or a one-off unlock. Customers who bought either App when it was a paid download keep what they paid for. Two further points follow from that model:

Your entitlement is checked on your device. To know what you have access to, the Apps ask StoreKit, Apple's on-device purchase framework, for your purchase record for these Apps only: which products you bought, when, whether a subscription is active, and the date and app version of your original purchase. That last item is how the Apps recognise long-standing customers and grant them the upgrade they are entitled to. This information comes from Apple, is verified on your device using Apple's cryptographic signature, and is not sent to Stooj. We operate no purchase server and no receipt-validation server. The Apps cannot see anything else you have bought on the App Store.
Managing or cancelling a subscription happens in your Apple account; the link inside the App simply opens Apple's own subscription page.

3.5 When you contact support

If you email our support address (currently support@3pmaster.com) or submit an issue or idea through the in-app link to our support portal, the message and any contact details you choose to provide are handled through Atlassian Jira, which we use to receive, track, and respond to support requests and feedback. Atlassian acts as our data processor under a data processing agreement and processes this information on our behalf, solely so that we can reply to you and improve the Apps. We do not use support details for marketing. This is the one situation in which information reaches Stooj, and only because you chose to contact us.

When you use the in-app Send Feedback link, your mail app opens with a short technical block already filled in, so that we can troubleshoot: your device model, your iOS version, the app's name, version and build number, your required-accuracy setting, whether distances are taken from the roadbook or measured, and whether a subscription is active and when it expires. It contains no location data. The accuracy entry is the setting you chose, never a position reading. You can see the whole block before you send, and you are free to delete it.

3.6 Bluetooth accessories and photos

iOS may ask your permission for two more things. Neither sends anything to Stooj, and neither gives the Apps any information about you.

Bluetooth. The Apps can pair with a Flic button, so you can mark a waypoint or reset a counter without taking a hand off the wheel. Pairing is handled by iOS and by Flic's framework on your device; what the App receives is a button press, and nothing else. No pairing information, device name, or accessory identifier is sent to Stooj. Your device may also take its position from an external GPS receiver: that connection is managed by iOS, not by the Apps, which simply use whichever fix iOS provides. You can grant or revoke Bluetooth access at any time in Settings → Privacy & Security → Bluetooth; the driving features work without it, and only the Flic button stops responding.

Photos. iOS may ask for permission to add to your photo library. This works in one direction only, and only when you ask for it:

When you share a map from the App and choose Save Image, iOS writes that picture into your library. The App produces the picture; iOS, not the App, performs the save.
When you pick an image inside the App, for example a photo of your vehicle for the inclinometer, iOS's own picker hands the App only the single image you chose.

The Apps cannot read, browse, or search your photo library. No image is ever sent anywhere, and Stooj never sees one. We do not look at, analyse, or store any picture you save or select.

Who receives information, and who does not. Apart from you, only three parties are ever involved:

Apple, as an independent controller, for your App Store download and any purchases, for iCloud storage if you enable sync, for serving map tiles, and for looking up the place names of your saved tracks. Governed by Apple's own privacy policy.
Atlassian, as our data processor, and only for support messages you choose to send us.
Stooj srl, the content of those support messages, and nothing else.

No other company, advertiser, analytics provider, or data broker receives anything from the Apps, because the Apps send nothing to them.

4. What we do not collect

Other than information you voluntarily send us when you contact support, the Apps do not collect or transmit to Stooj:

your name, email, phone number, or contacts;
your account credentials;
your precise or approximate location;
your tracks, routes, roadbooks, or notes;
your payment details or App Store account identity;
your photo library, or any image in it other than one you hand to the App yourself;
information about your Bluetooth accessories;
device identifiers, advertising IDs, or usage analytics;
crash logs tied to you (any diagnostics you choose to send go to Apple, not to us, and only if you opt in at the iOS level).

5. Legal bases for processing (GDPR Article 6)

Although processing happens on your device rather than on our systems, for transparency the relevant legal bases are:

Consent (Art. 6(1)(a)): access to your device's precise location is granted by you through the iOS permission prompt, and can be withdrawn at any time. Withdrawing it does not affect the lawfulness of any processing carried out before you withdrew it.
Performance of a contract / provision of the service (Art. 6(1)(b)): processing your location and everything you record locally is necessary to provide the features you asked the App to perform. Checking your purchase entitlement on your device is necessary to give you the access you paid for.
Legitimate interests (Art. 6(1)(f)): when you contact support, handling your message and feedback to answer you and improve the Apps; on our website, hosting it and counting page views, as described in the Website section.

We do not process any special categories of personal data, and we do not carry out profiling or automated decision-making.

You are not obliged to provide anything. Giving the Apps access to your location is neither a statutory nor a contractual requirement, and you are free to refuse it or revoke it later. The only consequence is functional: without location access the Apps cannot measure distance, speed or time, or draw your track, so the features they exist for will not work. Contacting support is equally voluntary.

6. International data transfers

Except for support correspondence (below) and our website (see the Website section), Stooj does not transfer your personal data anywhere, because we do not receive it.

Any storage in iCloud or processing by Apple Maps and the App Store is carried out by Apple under Apple's own terms and safeguards. Please refer to Apple's privacy policy for details of how and where Apple processes that data.

Where you contact support, the information you send may be processed by Atlassian (Jira) on infrastructure that can be located outside the European Economic Area. Such transfers are covered by the safeguards in Atlassian's data processing terms, including the EU Standard Contractual Clauses. A copy of those Clauses is published with Atlassian's data processing addendum, which applies automatically to our use of their service; you may also request a copy from us at privacy@stooj.co.

7. Data retention

On your device: your tracks, roadbooks and notes remain until you delete them or delete the App.
In your iCloud: copies remain until you delete them from your Apple account.
With Stooj: we retain no personal data about you from ordinary use of the Apps. Support correspondence (emails to privacy@stooj.co or support@3pmaster.com, and issues/ideas submitted through the support portal) reaches us as ordinary email and support tickets. We keep it for as long as it remains useful for handling your request and for context on recurring issues, and we do not delete it on a fixed schedule. You can ask us to delete your support correspondence at any time by writing to privacy@stooj.co, and we will do so unless we still need it to establish or defend a legal claim.

8. Your rights

Under the GDPR you have the rights to access, rectify, erase, restrict, and port your personal data, and to object to processing. Because your data lives on your own device and in your own iCloud account, you can exercise most of these rights directly and immediately: view, edit, export, or delete your recordings within the App, and manage iCloud copies through Apple.

If you believe Stooj holds any personal data about you, or you have any question about this policy, contact privacy@stooj.co and we will respond within one month (extendable by two further months for complex requests, with notice).

You also have the right to lodge a complaint with your local data protection authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it). You may alternatively contact the supervisory authority in your own EU/EEA country of residence.

9. Children

The Apps are driving/navigation tools intended for a general adult audience and are not directed to children. We do not knowingly collect personal data from children. In Italy the age of consent for information society services under Article 8 GDPR is 14; in any case, because the Apps collect no personal data for Stooj, no such data is gathered from users of any age.

10. California residents (CCPA/CPRA)

If you are a California resident, we want to be clear: Stooj does not collect, receive, sell, or share your personal information. We have not sold or shared personal information in the preceding 12 months, and we do not use or disclose sensitive personal information beyond the on-device purposes described above. Because we hold no personal information about you, there is nothing for us to disclose, delete, correct, or limit in response to a request, and we never discriminate against anyone for exercising their privacy rights. Any data associated with the Apps resides on your own device and in your own iCloud account, under your control.

11. Website

Our website (3prally.com) does not use cookies, advertising, embedded Google services, or third-party trackers, and it stores nothing on your device.

To count page views and see how quickly pages load, we use Cloudflare Web Analytics, and only for visitors outside the European Union. If you visit from the EU, the analytics script is not loaded at all. For other visitors, a small script loaded from Cloudflare sends Cloudflare the address of the page you are viewing, the page that linked to it, your browser and operating system type, your country, and the page's loading times. It uses no cookies or other storage on your device and does not identify you. We see only totals. Cloudflare keeps the detailed data for about a week and the totals for up to six months.

Cloudflare also hosts the site, for every visitor. Like any web host, it receives your IP address when your browser asks for a page, and uses it only to deliver the site and keep it secure. For hosting and analytics alike, Cloudflare acts as our data processor, and our legal basis is our legitimate interest in running the site and knowing which pages are read and which load slowly (Art. 6(1)(f) GDPR). Cloudflare may process this data in the United States, under its certification to the EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses as a fallback.

12. Security

Because your data stays on your device and in your own iCloud account, its security is protected by Apple's device-level and iCloud encryption and by the passcode/biometric protection you set on your device. We recommend keeping your device software up to date and your Apple ID secured.

13. Changes to this policy

We may update this policy to reflect changes to the Apps or to legal requirements. When we do, we will change the "Last updated" date above and, for material changes, note it within the Apps or on our website. Continued use of the Apps after an update means you accept the revised policy.

14. Contact

Questions about privacy or this policy:

Stooj srl, privacy@stooj.co