Privacy Policy

We collect what we need to run boards and nothing for advertising. We don’t sell your data, we don’t track you across other sites, and there are no advertising or social-media trackers on this site. You can delete your account and everything in it from Settings, and that deletion is real — including the image files.

• Account identity. When you sign up, our authentication provider (Clerk) handles your email address and password. Rivori’s own database stores a Clerk account identifier, your display name and your avatar image URL. We deliberately do not copy your email address into our database.
• Profile. An optional handle (the address of your public profile), an optional bio, and whether you’ve opted into being found in people search. Search listing is off unless you turn it on.
• Board content. Everything you put on a board: board titles and descriptions, and for each wish its title, link, price, description, your private note, and its picture. Notes are free text — please don’t put anything sensitive in them.
• Images. Photos you upload, and copies of product photos from pages you link to. We copy merchant images onto our own storage because retailers block hotlinked images and rotate their URLs, which would otherwise leave your board full of blank tiles.
• Link metadata. When you paste a product link, our servers fetch that page to read its title, price and image. The result is cached by URL so the same link isn’t re-fetched for everyone who pastes it. That cache holds no reference to you or your boards — it cannot say who wanted what.
• Error diagnostics. When something breaks, we log the error, the page it happened on and technical details about the browser. This is used to fix bugs.

We do not collect your location, your contacts, or any special categories of personal data, and we do not build advertising profiles.

• Session cookies. Set by Clerk to keep you signed in. Strictly necessary — the app cannot work without them.
• The purchase token. When someone marks a gift as bought on a shared board, we store a random identifier in that browser’s local storage under rivori.claim. It exists so that browser can un-mark what it marked, and so purchases can stay anonymous — it carries no identity, is never linked to an account, and is not used for analytics or tracking. You can clear it at any time by clearing your browser storage for this site.

We use no advertising cookies and no cross-site trackers, which is why there is no cookie consent banner.

Boards are private by default. When you make a board public, anyone with its link can open it without signing in, and that page shows your display name, your handle, your avatar and everything on the board. Link previews for a public board — the card that appears when the link is pasted into a messaging app — include your display name and avatar, and those previews are cached by the messaging platforms, not by us.

Your profile page at /@handle is public and lists your public boards. Private boards are never listed, and nothing on that page reveals that they exist. Turning off “discoverable” in Settings removes you from people search, but a profile link someone already has will still open — treat a handle as public.

Making a public board private stops it being served, but link previews already cached elsewhere and images already downloaded by other people are outside our control.

We don’t sell personal data and we don’t share it for advertising. We use a small number of service providers, each of which processes data only to provide their service to us:

• Clerk — accounts, sign-in and passwords.
• Convex — our database and file storage.
• Vercel — website hosting and delivery.
• Sentry — error diagnostics.
• Firecrawl — reads product pages on our behalf when a retailer blocks our servers. It receives the product URL only, never anything about you.

When you paste a product link, our servers request that page from the retailer. The retailer sees the request, but it does not identify you. Clicking through to buy something takes you to the retailer, where their own privacy policy applies.

We may also disclose data if legally required, or to protect the rights and safety of our users, and we would transfer data as part of a merger or acquisition — in which case this policy travels with it.

• Your account and boards: until you delete them.
• Cached link metadata: between 6 hours and 7 days, depending on how complete the result was, then automatically deleted.
• Uploaded images you never saved: deleted automatically within about a day.
• Error diagnostics: kept for a limited retention window by our monitoring provider.

Delete everything. Settings → Delete account. This erases your account, your boards, the wishes on them and the image files they own. Wishes you contributed to other people’s boards stay on those boards, because they belong to the person whose board it is — but your name is removed from them and they are no longer connected to you. Deleting your account from Clerk directly triggers the same erasure.

You can edit your display name, handle and bio, and change any board’s visibility, at any time. Depending on where you live you may also have the right to access, correct, export or restrict processing of your data, and to complain to a data protection authority. Email privacy@rivori.app and we’ll help. We don’t charge for these requests and we won’t treat you differently for making one.

Where GDPR applies, our legal bases are: performing our contract with you (running your account and boards), legitimate interests (keeping the service working, secure and free from abuse), and consent where we ask for it. Our services are operated from the United States, so your data is processed there.

Data is encrypted in transit. Access to your boards is enforced on the server, not just in the app: a private board is never returned to someone who isn’t its owner or a collaborator. No system is perfectly secure, and a public board’s link is its only lock — anyone you send it to can pass it on.

Rivori isn’t for children under 13, and we don’t knowingly collect their data. If you believe a child has created an account, email us and we’ll remove it.

If we change this policy materially we’ll update the date at the top and, for significant changes, tell you in the app. Continuing to use Rivori after a change means you accept it.