Privacy Policy

What we collect

Account information. When you create an account we collect your email address and a password. Passwords are stored only as a cryptographic hash by our authentication provider; we never see or store them in plain text.

Learning activity. To sync your progress across sessions we store the decks you open, the cards you study, your self-ratings, exercise results, streaks, badges, favorites and display preferences, linked to your account.

Subscription status. Payments are processed entirely by Apple through your App Store account. We receive your subscription or entitlement status (for example “Pro until date X”), never your card or bank details.

Product analytics and diagnostics. To understand how people move through the app (for example how many finish onboarding, or where a study session is abandoned) we record a small, fixed set of in-app events, along with the app version and error reports, linked to your account. This runs on PostHog, hosted in the European Union and acting only on our behalf. We do not collect advertising identifiers.

What we don’t do

RIFF shows no ads, does not sell or rent your personal data, does not track you across other companies’ apps or websites, and does not embed advertising or attribution SDKs. The product analytics described above serve only to improve RIFF itself; that data is never combined with other companies’ data for advertising. If any of this ever changes, we will update this policy and tell you before it takes effect.

How we use your information

We use the data above to operate the service and sync your progress, to grant rewards you earn (such as free days from badges), to answer support requests, to keep the service secure and debug problems, and to meet legal obligations. We do not use your personal data for profiling or automated decisions that have legal effects on you.

Where your data lives

RIFF runs on a small set of service providers acting on our behalf: Supabase (authentication and database), Cloudflare (delivery of card images and audio), PostHog (product analytics and error reporting, hosted in the European Union) and Apple (payments and app distribution). These providers may process data in the European Union or the United States under their own contractual safeguards. We only share what each provider needs to do its job.

Retention and deletion

We keep your data while your account is active. You can delete your account at any time inside the app (Settings → Delete account) or by emailing us; deletion removes your account and learning data from our systems, except for minimal records we are legally required to keep (for example billing-related records held by Apple).

Your rights

Depending on where you live (including under the GDPR and Türkiye’s KVKK), you have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. You can exercise most of these directly in the app, or by emailing us. You also have the right to lodge a complaint with your local data-protection authority.

Children

RIFF is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

Security

Data is encrypted in transit, and access to production systems is restricted. No method of storage or transmission is 100% secure, but we work to protect your information proportionally to its sensitivity.

Changes to this policy

We will post any changes on this page and update the date above. For material changes we will notify you in the app or by email before they take effect.

Contact

For anything related to your data or this policy: [email protected].