Rilver
Legal
Privacy policy
Rilver reads your newsletters and your articles, and with a mailbox connected it reads and sends your mail. This page says what is collected, why, how long it is kept, and how to have it deleted.
The short version
- Newsletters arrive at an address Rilver gives you. A sender writing for the first time is held until you confirm you subscribed to them.
- Connect a mailbox and Rilver is your mail app: your own mail in your own colours, sent and filed when you say so.
- Newsletter content is deleted after 90 days unless you save it.
- Your data is never sold, and never used for advertising.
- This website sets no cookies.
- You can delete your account, and everything with it, from inside the app.
What is collected, and why
| What | Why | Kept for |
|---|---|---|
| Your email address | To identify your account and send sign-in links | Until you delete your account |
| Sign-in tokens and sessions | To keep you signed in without a password | Sign-in links expire in minutes; sessions until you sign out |
| Your Rilver address, and who has written to it | To receive newsletters, and to ask you once about each new sender | Until you delete your account |
| Newsletter content and the original message | To turn it into an article and let you re-read it | 90 days, unless you save the article |
| Your mailbox credential | To show you your mail, and to act on it when you ask | Until you disconnect the mailbox or delete your account |
| Articles you import from a link | To show you the reading | Until you delete them or delete your account |
| Pages you photograph | To keep a scan you chose to save. The text is recognised on your phone | Until you delete them or delete your account |
| Your colour and type settings | So a second device starts from something sensible | Until you change them or delete your account |
| Colour test answers | To produce your result, and to improve the test itself | Until you delete your account |
| Narration audio | So the same article is not paid to be spoken twice | Removed 90 days after nothing has played it |
| Subscription status | To know what your account is entitled to | Until you delete your account |
| Technical job records | To retry failed work and diagnose faults | 30 days |
Your mail
Newsletters arrive at an address Rilver gives you. Subscribe with it, or forward to it, and what lands there is what Rilver reads.
A sender writing to that address for the first time is held unread while Rilver asks whether you signed up to them. Say yes and the message becomes an article. Say no and it is deleted, and that sender is refused from then on.
Approved newsletters are sent to an artificial-intelligence provider to be turned into articles: the writing, its headline, its structure and a category. They are processed only to return that result, and are not used to train models.
Connecting a mailbox is a separate choice, and it is what makes Rilver a mail app — your own mail on the same reading surface, sent, replied to, filed and binned when you tell it to.
Your mail is shown to you and acted on at your instruction, and that is the whole of it. It is never sent for article extraction, never read for advertising or profiling, and never used to train anyone's models.
Your mailbox credential is encrypted before it is stored, with a key held separately from the database. Disconnecting the mailbox deletes it.
What holds for every mailbox
- What it is used for: showing you your own mail, and doing what you ask with it.
- What it is never used for: advertising, profiling, sale, or training models of any kind.
- Who it is shared with: the processors listed below, and only to run those features.
- How to stop it: disconnect the mailbox in the app and the stored credential is deleted straight away. You can also remove Rilver's access from your provider's own security settings.
Google user data
The commitments above hold for a Gmail account as they do for any other. Google asks for them in its own terms, which is what this section is.
Where you connect a Gmail account, Rilver's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- What is requested:
gmail.modify. It covers reading, composing, sending and organising your mail, and does not permit permanently deleting anything. - How to revoke it: disconnect the mailbox in the app, or remove access at myaccount.google.com/permissions.
Your colour test
The test runs on your device. It has to, because it needs your eye to stay adapted between choices and a network round trip per question would break that. The result and the individual answers are then stored on your account.
The answers are kept, not just the final colour, and it is worth being straight about why: repeatability in this area is genuinely poor, and the search will need improving against real answers rather than against assumptions. That is a use of your data beyond serving you personally. It is not shared, sold or published, and deleting your account deletes it.
Alongside a run, Rilver records the screen conditions it was taken in (brightness, and whether features that alter your screen's colour were switched on) and an identifier for the device model and screen type. A result measured on one screen does not transfer to another, so this is what tells the app whether your result still applies.
Read-aloud
Article text is sent to a speech synthesis provider to be spoken. The audio is stored under a key derived from the text and the voice rather than under your name, so if two people ever narrate identical text in the same voice it is synthesised once. Audio nothing has played for 90 days is deleted.
This website
No cookies. No advertising, no third-party trackers, no social widgets, and no fonts loaded from anyone else's server.
Your reading settings on this site — colour, text size, line spacing, typeface — are stored in your own browser and never sent anywhere. Clearing your browser storage removes them.
Visits are counted with a privacy-preserving analytics service, which records page views without cookies and without building a profile of you or following you between sites.
Who else processes your data
| Who | What they handle |
|---|---|
| Cloud hosting | Running the service, and the database and job queue behind it |
| Object storage and delivery | Narration audio, saved scans, and this website |
| An artificial-intelligence provider | Turning an approved newsletter into an article |
| A speech synthesis provider | Turning article text into audio |
| An email delivery provider | Sending sign-in links and service email |
| The app stores | Subscription payments and receipts, where you subscribe |
Rilver does not sell your data, does not share it for advertising, and does not pass it to anyone beyond the processors above. The companies currently filling those roles are named on request, from the contact address at the top of this page.
Rilver is run from the United Kingdom, and several of the processors above are based in the United States, so some of your data is handled outside the UK. Those transfers rely on the data protection terms in each processor's own agreement — the UK's International Data Transfer Addendum to the standard contractual clauses, or an adequacy decision where one covers them.
Why we are allowed to hold it
Under UK and EU data protection law the lawful bases are:
- Performance of a contract
- Your account, your mailbox connection, your articles, your settings and your subscription. Rilver cannot do what you asked without them.
- Legitimate interests
- Keeping the service secure and working, and improving the colour test against real answers. You can object to the second of these; see below.
- Legal obligation
- Records we are required to keep, such as those relating to payments.
Your rights
You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, ask for it in a portable form, or object to processing based on legitimate interests. Write to privacy@rilver.app and you will get a reply within one month.
The quickest route for deletion is the app itself; see deleting your account.
If you are unhappy with how it is handled you can complain to the UK Information Commissioner's Office at ico.org.uk/concerns, or to your own country's supervisory authority.
Security
Mailbox credentials are encrypted at rest. Sign-in and session tokens are stored only as keyed hashes, so a copy of the database is not enough to impersonate anyone. Presenting a session refresh token twice ends the session, which is how a stolen one gets caught. Audio and saved scans are served over expiring links rather than public addresses.
No system is perfect. If you find a security problem, please write to the contact address at the top of this page before disclosing it publicly.
Children
Rilver is intended for adults and is not directed at children. It is not designed for classroom use and does not knowingly collect data from children.
Changes
If this policy changes in a way that affects what is collected or who it goes to, the date at the top changes and you will be told in the app before it takes effect.