Privacy Policy
Effective November 3, 2026
This policy explains what personal data Riveora (“we”, “us”) handles, why, and what choices you have. It covers two groups of people: customers, who sign up and use the dashboard, and end users, the people who use apps that include the Riveora SDK.
1. Our role
- For customer data (your account, sign-in and billing), we decide how the data is used. We are the controller.
- For end-user data, the company that built the app decides what is collected and why. They are the controller, and we process the data only on their instructions, as their processor. If you use an app that includes Riveora, the app’s own privacy policy applies, and you should contact that company first about your data.
2. Data about customers
| What | Why |
|---|---|
| Email address, and a password (stored only as a secure hash by our sign-in provider) | To create your account and sign you in |
| If you sign in with Google: your name, email and profile picture from Google | To sign you in without a password |
| Your projects, their settings, and anything you upload, such as screen pictures | To provide the Service |
| Your plan, your subscription’s status and the IDs our payment provider gives you and your payments. When you buy a plan, we share your name and email with Stripe, which processes the payment and keeps your card and billing details. Stripe also uses them to prevent fraud, under its own privacy policy. We never see your full card number. | To charge for paid plans, keep your plan up to date and meet tax rules |
| Until your free trial starts: how many devices and events your apps have sent, and from how many places (see section 3). Afterwards, only when and why the trial started. | To start your free trial when real people use your app, not when you’re testing it |
| Messages you send us | To answer you and improve the Service |
| Technical logs and error reports, which can include your IP address and browser | To keep the Service secure and fix problems |
Our legal bases are: performing our contract with you, our legitimate interest in running a secure and working service, and legal obligations such as tax records. We don’t sell your data or use it for advertising.
3. Data about end users
The SDK is designed to collect behaviour, not identity. Once the app has turned it on, it can collect:
- Screens opened and how long each was open.
- Taps: the type of element, the name of the component, its position on screen (rounded), and a short label such as a button’s text (“Add to cart”). Longer text such as a message, text that differs from one list row to the next (a contact’s name, say) and keypad keys are never used as labels, and numbers, emails and tokens in labels are masked. Taps on keypad keys are sent without their position, so a PIN can’t be rebuilt.
- Rage taps, taps on things that aren’t buttons, and app crashes (the message only, with personal details masked).
- Failed and slow network requests: method, host, path (with IDs, names, emails, phone numbers and tokens replaced, and IP addresses shown as “private”), status and duration.
- Device model, operating system, screen size, language and time zone.
- A random ID for each install of the app, and the app’s own user ID if the app chooses to send one.
- Events the app sends, such as onboarding steps, paywall views and purchases, with their details. Details whose names or values suggest passwords, tokens, emails, phone numbers, card or bank account numbers, or people’s names are dropped by the SDK, and again by our servers.
- If the app connects RevenueCat: purchases, renewals, cancellations and refunds linked to the app’s user ID.
The SDK does not collect:
- Screenshots, screen recordings or video of end users’ screens.
- Anything typed into text fields, including passwords.
- Stack traces, or the query strings, headers or bodies of network requests.
- Emails or phone numbers. The SDK refuses them as user IDs and drops values that look like one.
- Advertising IDs, the device’s own hardware IDs, contacts, photos or location.
We don’t store end users’ IP addresses with their events. Our servers use the address a request comes from for a short time to limit abuse. Until a customer’s free trial starts, we also keep up to three shortened network addresses that their apps’ data came from (the first three parts of an IPv4 address, or the first three groups of an IPv6 one) and up to three of the random install IDs, only to tell real use from testing. They are deleted when the trial starts.
Pictures of an app’s screens are only taken in the developer’s own development builds, on their own test device, never in the versions people download from the app stores. Nothing is sent from an end user’s device until the app has granted consent through the SDK.
4. Who we share data with
We use these service providers to run Riveora. They may only use the data to provide their service to us.
| Provider | What they do |
|---|---|
| Supabase | Database, customer sign-in and sign-in emails |
| Heroku (Salesforce) | Hosting for our servers |
| Cloudinary | Storage for screen pictures |
| Sentry | Error reports from our own servers |
| Sign in with Google, if you choose it | |
| Stripe | Checkout, card payments, tax, invoices and receipts for paid plans |
We may also share data if the law requires it, to protect our rights or users’ safety, or as part of a merger or sale of our business, in which case this policy continues to apply. RevenueCat and other services a customer connects are run by those companies under their own policies.
5. International transfers
Our providers may store or process data outside your country, including in the United States. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.
6. How long we keep data
- End-user events (every screen, tap and request) and the summaries made from them, such as visit summaries, paywall visits, onboarding results, the screen list and insights, are kept while the project exists, so its dashboard can show any period, including each visit in full. They’re linked to random device IDs, not names or contact details.
- A customer can ask us to delete the data of one of their end users at any time, for example to answer that person’s deletion request.
- Deleting an app deletes its data straight away. Its screen pictures are removed within a few minutes, and any events that arrive after the delete are removed within a week. We keep a short record that the app existed (its ID, when it was created and deleted, and how much was removed), without its name. Deleting an app can’t be undone: we don’t keep a copy, so we can’t restore it or its data. Backups are only for recovering the whole Service after a failure, not for restoring single apps.
- To close your account, write to us. We then delete your account and apps within 30 days, except records we or our payment provider must keep by law, such as invoices.
- Server logs and error reports are kept for up to 90 days.
- Backups are overwritten on a rolling basis and may hold deleted data for a short time.
7. Security
Data is encrypted in transit (HTTPS) and stored with providers that encrypt it at rest. Database access is limited to our servers, screen pictures are only reachable through short-lived signed links, and secrets for connected services such as RevenueCat are stored only in a form that can’t be read back.
8. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict how it’s used, and to withdraw consent. You can also complain to your local data protection authority.
- Customers: write to us at support@riveora.com. We reply within 30 days.
- End users: contact the company that made the app. Records are linked to a random device ID, so they are the ones who can find yours. We’ll help them respond.
9. Cookies
The website and dashboard only use storage needed to keep you signed in and remember your choices. We don’t use advertising or cross-site tracking cookies.
10. Children
Riveora accounts are not for anyone under 16. Customers must not use Riveora to knowingly collect data from children under 13, or the age set by their local law, without the consent the law requires.
11. Changes
If we change this policy in a way that matters, we’ll tell customers by email or in the dashboard before the change applies. The date at the top shows when it last changed. See also our Terms of Use.
12. Contact
For privacy questions or requests, write to support@riveora.com.