Privacy Policy

1. Who Operates Riveryn

In this policy, "Riveryn," "we," "us," and "our" mean MyTip Innovations s.r.o. when it operates the Riveryn app, website, backend, and support channels.

MyTip Innovations s.r.o. is established in the European Union. No separate EU representative is required for GDPR purposes. We have not appointed a data protection officer.

2. Scope

This policy covers the Riveryn iOS app, the website at riveryn.com, our backend at api.platecue.com (and its backup address, platecue-api.onrender.com), and support by e-mail.

It does not cover Apple's own services, App Store billing, or other websites we link to. Their own terms and privacy policies apply.

The app also sends us short technical reports on crashes and performance: after a crash or a freeze, where in our code it happened; and about once a day, how often the app was closed and why (for example, iOS needed the memory) and how much memory it used. Each carries the app version, iOS version and iPhone model and is tied to the same random install ID as usage diagnostics. None carries anything you logged. They are sent while Anonymous usage diagnostics is on (You › Your data). Test builds from TestFlight may send them either way.

3. Short Summary

• No account. You never sign up. Your log lives on your iPhone: meals, lines, answers, your plate (the food targets Riveryn sets for you) and what Riveryn remembers. You can export or delete it any time.
• Some things do leave your phone. When you log by typing, voice or photo, or ask a question, it goes to our server and on to OpenAI, and voice to ElevenLabs. Day totals from Apple Health help write the day's notes. Our server doesn't keep what you send. It keeps only a count of requests and a short technical log.
• A few things live on our server. Your band, if you join one. A record of any access code you redeem. Daily usage counts per install. See Retention.
• Apple Health is read-only and optional. We never write to it. We never use Health data for ads or marketing, and we never sell it.
• No ad tracking or sale. Riveryn has no advertising SDKs, no cross-app tracking and no data brokers. We don't sell personal data.
• Usage diagnostics, on by default. We count which buttons get used, tied to a random install ID, never to your name. If an Apple Search Ads ad brought you here, we note which ad. Your photos, voice, words, meals, body data and Apple Health values never go to analytics. Analytics do learn whether you connected Apple Health and which kinds of data it had, never the values. Turn it off in You › Your data › Anonymous usage diagnostics.
• Our website. If you tap an App Store button on riveryn.com, we note which page and link you used. No cookies, no ad pixels.
• Deleting on your iPhone does not reach our server. To have server data deleted, e-mail us. Your choices says how.

4. What We Collect, and Why

• Your plate and profile. Sex, age, height, weight, units, how much you move, your goal and what you eat (everything, no meat or fish, or nothing from animals). Your wake and bed times. These stay on your iPhone and set your plate. With meal requests we send only your goal, eating style, activity level and your calorie, protein and carb targets. Your sex, age, height and weight are not sent. Your targets are worked out from your weight, though.
• Your log: taps, lines and answers. The parts you tap, from Sleep to People. The lines you type or say, like "walked 20 minutes" or "slept badly". Your hunt, how you slept, how you feel and who you spent the evening with. Anything you say about being sick, sore, drinking or coffee. All of this is stored on your iPhone. Some of it goes to our server and OpenAI when Riveryn needs AI to read a line or write a note (see section 6).
• Meal photos. Photos you take or pick for a meal. The app keeps a copy on your iPhone. To estimate the meal, the photo is resized, stripped of location data and sent to our server and OpenAI. Our server does not store it.
• Voice. When you tap the microphone, your voice is turned into text. On most screens the sound is streamed live through our server to ElevenLabs. On the meal recorder, a short clip goes through our server to ElevenLabs. If that clip fails, Apple's speech recognition may be used instead, and Apple may process the sound on its servers. The app deletes its temporary sound files. Our server does not store sound or text.
• Your questions and what Riveryn remembers. Questions you type to Riveryn, and short facts it remembers about you (shown in You › What I remember). These stay on your iPhone and are sent with the request that needs them.
• Meal estimates. Foods, calories, protein, carbs, fat and other nutrients. These are estimates, stored on your iPhone, and you can correct them.
• Apple Health. Only if you connect it. See section 5.
• Your city for sunrise. Riveryn never asks for your location. It guesses a city from your time zone, or you type one. A typed city is searched with Apple Maps. The city is kept on your iPhone, rounded to about 11 km, and never sent to us.
• Your band. Only if you start or join one. See section 7.
• Purchases. Apple handles payment. The app checks your subscription with Apple (StoreKit) and keeps the result on your iPhone. A small trial record is kept in your iPhone's keychain, so a free trial can't start over. Our server may get Apple's coarse subscription notices (for example "trial started"), without your Apple ID or transaction numbers. We never see your card.
• Access codes. If you redeem a code, our server keeps the code and your hashed install ID, so each code works once per install. This is sent even when diagnostics are off.
• Feedback notes. Earlier versions of the app let you send a short note from Today. Those notes are stored on our server with the hashed install ID. Riveryn 2.0 does not show this note form.
• Usage diagnostics. On by default; you can turn them off in You › Your data › Anonymous usage diagnostics. The app sends simple usage events straight to TelemetryDeck, an analytics service, and to our own server, which keeps one row of counts per install per day. The events are: onboarding, taps and lines logged, meal estimate, correction, save and saved-meal reuse, how-you-feel answers, paywall, trial, purchase, restore, export, delete and error events. Analytics also learn whether you connected Apple Health and which kinds of data it had, like steps or sleep, never the values. Each event carries a random install ID (hashed before it leaves the phone), a per-launch session ID, app version, iOS version, device type, app language, App Store country, time of day and day of the week. It also carries whether notifications are allowed and your reminder settings, how many days and sessions you've used Riveryn and how long they last, which test group you're in, and which access-code campaign you used, if any. If you came from an Apple Search Ads ad, it carries the campaign, ad group and keyword IDs. No ad identifier (IDFA) is used. The install ID lives in your iPhone's keychain, so it stays if you delete and reinstall the app. Delete all local data makes a new one. While diagnostics are on, the same hashed ID also travels with AI requests to our server, which helps us count use and stop abuse.
• Taps on our website. When you tap an App Store button on riveryn.com, the site tells our server. It sends the page, the button and the campaign tags in the link. We use it only to count which links work. It uses no cookies, no ad pixels and no ad identifiers. It never sends your meals, your account or your contact details.
• Server logs. Our server writes short technical logs: time, endpoint, size, model, cost and errors. When diagnostics are on, logs also carry the hashed install ID. They never carry what you wrote, said or photographed. Our server reads your IP address only to limit request rates, in memory, and does not log it. Our host may keep its own network logs.
• Support e-mail. If you write to us, we get your e-mail address and whatever you send. You › Send feedback opens a draft with your app version, iOS version, access state, whether diagnostics are on and, if they are, a support token (your hashed install ID). You can delete any of it before sending.
• Reminders, the Lock Screen card and widgets. All reminders are made on your iPhone; we run no push server. The Lock Screen card and widgets can show your next move or a meal name on a locked phone. Turn the card off in You › Reminders › The Lock Screen card.
• Website. Our host and CDN (Cloudflare) see normal web traffic, like IP address, browser and pages. We use Cloudflare Web Analytics for page counts. There are no ad pixels or tracking cookies.

5. Apple Health

Apple Health is optional. Riveryn works without it. If you connect it, Riveryn only reads, and never writes anything to Health.

• What it reads for your day: steps, walking and running distance, cycling distance, workouts, active energy, sleep, stand hours, mindful (quiet) minutes and time in daylight. You choose which ones in Apple's permission sheet.
• What it reads for your plate: only if you tap "Fill in from Apple Health" in setup, it also reads your weight, height, date of birth and sex. A new weight from Health quietly updates your plate.
• Background reading: once connected, iOS wakes Riveryn about once an hour to read new steps, so your fire can grow without opening the app.
• What it works out: day totals, like steps, active energy, hours slept, a workout's kind and minutes, daylight minutes and stand hours. Riveryn keeps 14 days of these on your iPhone, outside iPhone backups.
• What leaves your phone: day totals, like your steps, hours slept, active energy and a workout's kind and minutes, go to our server and OpenAI to write the day's notes and answer your questions. Nothing is stored there.
• What never leaves your phone: raw Health samples, hour-by-hour tables, and your height, age and sex. Your weight stays on your phone too, but your food targets are worked out from it, and those targets go with meal requests and questions.
• Analytics: analytics never get Health numbers. They only learn whether you connected Apple Health and which kinds of data it had, like steps or sleep.
• What we never do: we never use Health data for ads or marketing, never sell it, never give it to data brokers, and never mine it for any other purpose. We share it only with the service providers who run Riveryn for you, under contract.
• How to stop: turn off You › Apple Health › Use Apple Health, or remove Riveryn in the Health app under Sharing › Apps. Turning it off, or Delete all local data, erases the Health data Riveryn kept on your iPhone. A weight Health already put into your plate stays until you change it.

Riveryn does not use the Motion & Fitness API.

6. What AI Reads, and Who Runs It

When you log by typing, by voice or with a photo, or ask Riveryn something, the app sends it to our server. Our server asks OpenAI to read it and write back. Voice goes to ElevenLabs to become text.

With each request we send only what that answer needs. That can include:

• your recent lines in your own words, and corrections you make;
• the answers you tapped: how you slept, how you feel and who you were with;
• your day's parts and fire, your hours of sleep and your steps;
• your plan, your targets, your goal in your own words, and what Riveryn remembers about you.

Your recent meals, with their names and nutrients, go with the weekly read and with questions about food.

If you write something that sounds like you might hurt yourself, Riveryn shows you where to find help. Our server checks for those words first, and a line it catches never reaches the AI. Riveryn keeps such lines out of the notes the AI writes.

• OpenAI. We send requests with OpenAI's storage setting turned off ("store: false"). OpenAI may still keep request data for a limited time to check for abuse, under its API terms. We do not send OpenAI your name, e-mail, Apple ID or install ID.
• ElevenLabs. It receives the sound of your voice and returns text. ElevenLabs may keep audio for a limited time under its own terms.
• Our server. It handles each request in memory and does not save your photos, words, sound or the AI's answers.

AI can be wrong. Estimates and notes are approximate and you can correct them. See the Wellness and AI Disclaimer.

7. Bands

A band is two to five people who live the day together. It is optional, and you join only by invite code.

If you start or join a band, our server keeps:

• the name you go by in the band, and your time zone;
• your daily fire, and which parts of your day were lit;
• the moments you kept and the warmth taps;
• any evening line you choose to share.

The people in your band see these, plus a seven-day strip of fires.

They never see your food, calories, weight, hours of sleep or how you said you felt. Band data is tied to a random member key, not to your install ID.

You can leave in one tap, in You › Your band, and nobody is told. Leaving hides you from the band, but your name and past lines stay on our server. Delete all local data does not take you out of a band, so leave first. To have your name and lines erased, e-mail us with the band's code and the name you used.

8. Health Data and Your Consent

Some of what you give Riveryn is about your health: Apple Health data, your sleep, how you feel, what you eat, your weight, the people you spent time with, and anything you write about being ill or hurt.

We use it only because you choose to give it to us, and only to run Riveryn for you. Where the law treats it as health data, that choice is your explicit consent. You can take it back any time: turn off Apple Health, or stop logging it. That stops new use. It doesn't undo what already happened.

We never use this data for ads, never sell it, and never use it to guess unrelated things about you.

9. Legal Bases for Processing

Where GDPR, UK GDPR, or similar laws apply, we rely on these legal bases:

10. Who Gets Data

We share data only with the providers who run Riveryn for us, and only what each one needs. Each of them may use it only to run Riveryn and must protect it at least as well as this policy does.

We may also share data with professional advisers, courts, regulators or law enforcement when the law requires it, or with a buyer if the business is sold, under this policy.

11. International Transfers

We are in the Czech Republic. Our backend runs on Render, and its database is in Oregon, in the United States. OpenAI processes requests in the United States. Other providers, like ElevenLabs and TelemetryDeck, may process data in other countries.

When data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on the EU Standard Contractual Clauses in each provider's data processing terms, or on the EU-U.S. Data Privacy Framework where a provider is certified under it.

12. How Long We Keep Data

Today nothing on our server is deleted automatically. We keep it until you ask us to delete it, and we delete it when you ask.

13. Your Privacy Rights

Depending on where you live, you can ask to see, correct, delete, restrict, move or object to the use of your data, and withdraw consent. Withdrawing consent doesn't affect what happened before.

You can complain to a data protection authority. Ours is the Czech Office for Personal Data Protection (ÚOOU, www.uoou.cz). You can also go to the authority where you live.

For California and other US state privacy laws: we don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you. You can send any request through the Privacy Choices page.

14. Your Choices and Controls

• Export: You › Your data › Export local data, then Share export file. You get a JSON file of your log, profile and what Riveryn remembers.
• Delete on your iPhone: You › Your data › Delete all local data. It clears your Riveryn data from this iPhone, including photos, lines, answers and the Apple Health data it kept. It doesn't reach our server, doesn't take you out of a band, and doesn't cancel a subscription.
• Diagnostics: You › Your data › Anonymous usage diagnostics. Turn it off and no more usage events, crash reports, Apple Search Ads numbers or install IDs on AI requests are sent.
• Apple Health: You › Apple Health › Use Apple Health, or the Health app under Sharing › Apps.
• Bands: You › Your band › Leave the band.
• Lock Screen card and reminders: You › Reminders, or iOS Settings › Notifications.
• Camera, photos and microphone: iOS Settings › Riveryn. You can still type.
• Delete what's on our server: e-mail support@riveryn.com with the subject "Riveryn Privacy Request". For a band, tell us the band's code and the name you used. For anything else, send the support token from You › Send feedback; it shows when diagnostics are on. Send it before you use Delete all local data, because that makes a new token. We answer within one month. If we need more time, we will tell you why.
• Subscriptions: manage or cancel in your App Store settings. Deleting data doesn't cancel them.

15. Children

Riveryn is for people 13 and older. It is not made for children under 13. If you think a child under 13 has given us personal data, write to support@riveryn.com and we will delete it.

16. Security

We use reasonable safeguards: HTTPS, API keys kept on our server, data stored on your iPhone first, size limits and rate limits. Riveryn doesn't sync your data to iCloud. An iCloud backup of your iPhone can still hold a copy of your log. No system is perfectly secure.

17. Changes

We may update this policy as Riveryn, our providers or the law change. We will show material changes here, in the app's links, in the App Store privacy details and, where it fits, in release notes.

18. Contact

MyTip Innovations s.r.o.

K lukam 1071/19a, 142 00 Praha-Libus, Czech Republic

Email: support@riveryn.com

Support URL: https://riveryn.com/support/