Privacy Policy — Riff

Effective date: July 9, 2026

1. Introduction

Riff is a mobile app, published by Reno Labs ("we", "us"), that turns a link or a pasted script into a short-form voiceover read aloud in your own cloned voice, in multiple languages. This policy explains what we collect, why, and your choices. Riff has no user accounts — you can use it without signing up or giving us your name or email.

2. Information We Collect

Information you provide

• Voice recording. When you choose to clone your voice, you record a short sample (up to ~30 seconds) with your device microphone. That audio is sent to our server to build your voice model. You affirm, before recording, that it is your own voice. We record only from a live in-app recording — there is no way to upload an existing audio file.
• Links and scripts. When you paste a link or write/paste a script, that text (and the content fetched from a link) is processed to write and voice your script.

Information collected automatically

• Purchase data. If you subscribe, our payments provider (RevenueCat, via Apple) receives your subscription status and transaction identifiers, plus device identifiers and IP address used to process and restore purchases.
• Anonymous usage & diagnostics. We record a small number of anonymous product events (e.g., that an install opened the app, completed a voice clone, generated its first clip, or viewed the paywall) and crash/error diagnostics, tagged with a random per-install identifier, through our analytics provider PostHog. This carries no name, email, or contact information and is used only to measure our own funnel and fix bugs.

Device permissions

• Microphone — used only to record your voice sample. We do not access the camera, photos, location, contacts, or health data.

3. How We Use Your Information

• Voice recording → to build and store your voice model so your scripts can be read in your voice.
• Links and scripts → to fetch content, write a short-form script, and generate the voiceover audio.
• Purchase data → to provide, restore, and manage your subscription.
• Anonymous usage counts → to understand aggregate product usage. No advertising, no cross-app tracking.

4. Third-Party Services

We share data with the providers below only to deliver the service you request — never for advertising or cross-app tracking. Each processes it on our behalf under a policy that provides the same or equal protection to this one. The app also discloses each sharing moment in-app and asks for your agreement before any data is first sent.

• Google (Gemini API) — the links and scripts you submit are processed by Google's Gemini API to write and translate your script. Do not paste anything you wouldn't want processed by a third-party AI service. (Google Privacy Policy)
• RevenueCat — manages subscriptions on our behalf as a data processor (purchase history, device identifiers, IP address). It does not use your data for cross-app tracking. (RevenueCat Privacy)
• PostHog — our product-analytics and error-tracking processor. It receives the anonymous product events and crash diagnostics described above, keyed to the random per-install identifier; no name, email, or cross-app tracking. (PostHog Privacy)
• Apple — processes your payment and manages your subscription through the App Store. (Apple Privacy)
• Cloud infrastructure (Modal) — our backend and your stored voice model run on cloud infrastructure we operate.

5. Data Storage and Security

• Your voice recording and voice model are stored on our server until you delete the voice.
• Your generated clips are stored only on your device (in the app's local storage) and are never uploaded to us.
• Links/scripts are processed to generate output and are not retained by us as a profile of you.
• We use industry-standard measures to protect data in transit and at rest. No method of transmission or storage is 100% secure.

6. Your Rights

EU/EEA & UK (GDPR). You have the right to access, correct, delete, or restrict processing of your personal data, and to data portability. Our legal basis is performance of the service you request and your consent (for the voice recording).

California (CCPA/CPRA). You have the right to know what personal information we collect, to request deletion, and to opt out of "sale" or "sharing." We do not sell or share your personal information.

To exercise any right, delete your data in-app (see Section 7) or contact us at the email below.

7. Deleting Your Data

Riff has no accounts, so there is nothing to "close." You control your data directly:

• Delete a voice in Settings removes that voice model from our server.
• "Delete everything" in Settings removes every voice from our server and erases all clips stored on your device.

8. Children's Privacy

Riff is not directed to children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us data, contact us and we will delete it.

9. Changes to This Policy

We may update this policy as the app evolves. We will post the updated version here and revise the effective date above.

10. Contact Us

Reno Labs — hello@riff.app