match /activity_log/{uid} {
   allow create: if request.auth.uid == uid;
   allow update: if false;
   allow delete: if false;
}