Effective date: 14 November 2026
This privacy policy describes how R.A.L.L. Media (“we”) processes information when you visit rall-media.com. It applies to this website only. Each of our apps has its own privacy policy, linked from the product page.
To contact us about privacy, write to support@rall-media.com.
Statistics
We keep our own, first-party statistics of how the site is used, so we can see which pages are visited and which app store links are opened. We do not use Google Analytics, Yandex Metrica, Facebook Pixel or any other third-party analytics service.
The statistics work like this:
- No cookies are set for statistics, and nothing is written to local storage for statistics.
- When a page is actually shown in a browser, a small first-party script may send a request to our server (
/api/t). Only this request lets us count the visit as a person rather than an automated request. - We do not store your IP address in the statistics. Instead we compute a short hash: HMAC-SHA256 of the IP address and the browser’s user agent, using a random salt that is new each day (in the Asia/Jerusalem time zone). Only the first 16 hexadecimal characters of the hash are kept. The salt is deleted after two days, and after that the hash can no longer be linked back to an IP address.
- We also record the page address, the country (looked up locally from the IP address with the DB-IP Lite database; no query is sent to an outside service), the user agent, a simple device/operating-system/browser group, and the referring site or campaign parameter, if any.
- Search-engine and AI crawlers, scripts, automated browsers and requests from our own servers are filtered out and counted separately. Our own visits are not included in the public statistics.
For visitors in the European Union, the European Economic Area, the United Kingdom and Switzerland, this statistics script does not run until you accept it in the banner at the bottom of the page. If you decline, it does not run. You can change your choice at any time through “Cookie settings” in the footer. We remember the choice on your device for 12 months (in the browser’s local storage, not in a cookie). If you do not accept, we may still record ordinary server-side requests (for example in the web server log, as described below) and classify automated traffic, but we do not count you as a human visitor in the statistics.
If you are not in those regions, the same first-party statistics run without a banner, still without cookies and still without storing your IP address.
Links to app stores
Buttons that take you to the App Store, Google Play or another store go first through a short address on our site (/go/…) and then redirect to the store. This lets us count which product and which store were opened. The record uses the same hashed identifier, country and device group as the statistics above. The redirect itself is needed for the link to work.
Contact form
If you write to us through the contact form, we receive the name, email address, subject (if you enter one), message and the language of the page you used. You must confirm that we may use these details only to reply to your message.
We store the message in our private admin inbox, together with the time, the language and the IP address from which it was sent. We also send the same information by email to support@rall-media.com. Messages stay in the inbox until we handle and delete them, or until you ask us to delete them.
To limit automated submissions, the form shows a short arithmetic question as an image (a captcha). A session cookie named rc_sid is used only for this form: it is first-party, Secure, HttpOnly, SameSite=Strict, limited to the /api/ path, and lasts only for the browsing session. It holds a one-time captcha answer (valid for up to one hour) and a security token. We also apply rate limits (a hashed form of the IP address, kept for one hour) and a hidden honeypot field. A technical log of form attempts (hashed IP, language and result, without the message itself) is kept on the server.
Server logs
The web server writes a standard access log and an error log. These logs typically include the IP address, the time, the requested address, the response code, the referrer and the user agent. We keep them for 14 days and then they are deleted. They are used to run the site, to diagnose faults and to detect abuse. The same access log is also read into our first-party statistics so that automated traffic can be classified, as described above.
Cookies and local storage
This site does not use advertising or tracking cookies, and it does not use third-party cookies.
- The contact form may set the strictly necessary cookie
rc_sid, as described above, only when you use the form. - If we show you the statistics banner, your Accept or Decline choice is stored in the browser’s local storage for 12 months, so that we do not ask again on every page. This is not a cookie. You can change it through “Cookie settings” in the footer, or clear it by deleting the site’s data in your browser.
No third-party analytics
We do not send your browsing on this website to a third-party analytics or advertising platform. Store buttons lead to Apple, Google or another store, which then have their own privacy policies.
Your rights
If the GDPR or the UK GDPR applies to you, you have the right to request access to personal data we hold about you, to have it corrected or deleted, to restrict or object to certain processing, and, where applicable, to receive it in a portable form. You also have the right to withdraw consent where processing is based on consent, and to lodge a complaint with a supervisory authority in your country.
In practice, statistics identifiers cannot be turned back into an IP address after the daily salt is deleted (within two days). Contact-form messages and the IP address stored with them can be deleted on request. To exercise any of these rights, write to support@rall-media.com.
Changes
If this policy changes, the updated text will be published on this page with a new date.
Contact
R.A.L.L. Media.
Email: support@rall-media.com.