Privacy Policy

Who we are

River is operated by Horizon Studios. This policy applies to the River iOS app, rivercouple.com, invite links, and support communications.

Questions or privacy requests can be sent to privacy@rivercouple.com.

Information River handles

Account and profile

When you use Sign in with Apple, River receives an Apple account identifier and, if you choose to share them, your name and relay email address. We also store your display name, time zone, onboarding state, and authentication records. An Apple refresh token is encrypted and stored only so River can revoke its Sign in with Apple authorization if you delete your account.

Partner and commitment data

We store partner memberships, private invite codes, commitment intentions, schedules, durations, participation status, protected-time totals, and any reflection or early-exit text you submit. Information marked as shared may be visible to your connected partner.

Screen Time data stays local

Apple's Family Controls framework gives River opaque tokens for the apps, categories, or websites you select. River keeps that selection on your device to apply shields. We do not upload the selection, app names, browsing history, screen contents, or per-app usage to River's servers, and your partner cannot see them.

Waitlist

If you join the River waitlist, we store your email address and the place on our website where you signed up. We use it only to provide early access, product availability, and launch updates. A signup notification containing your email address is also sent to our private team workspace in Slack.

Diagnostics, support, and safety reports

River 1.0 is free and does not collect purchase or subscription data. Our services create limited security and reliability logs, such as request identifiers, timestamps, IP-derived network information, and error details. If you contact support or submit a safety report, we receive what you send us.

Product analytics

We use PostHog to understand how people use River and where the app can improve. We record app launches, visits to named screens, sign-in, onboarding progress, partner connections, and commitment actions. These events can include the app version, operating system and device information, permission state, selected commitment preset, and protected-time duration. A random installation identifier connects activity before sign-in; after sign-in, events can be linked to your River account identifier.

On our public website, we record page visits, selected link clicks, page performance, and whether a waitlist submission succeeds. These events include the form placement, browser and device information, and referring website domain. PostHog uses your IP address to estimate your country, region, and city so we can understand where website visitors come from. This is approximate location information; we do not request your device's GPS location. We store a random browser identifier in local storage to connect visits; we do not identify website visitors by their waitlist email. Analytics exclude admin pages, URL query strings, and the code in invitation links. You can clear this browser identifier by clearing site data, and website analytics respect your browser's Do Not Track setting. We also use session replay on public marketing pages to understand navigation, scrolling, and usability. Form inputs are masked. Admin and invitation pages are not recorded, and we do not capture network request bodies, headers, or console logs. Recordings are retained for 30 days.

We do not send your name, email, partner's name, commitment text, reflections, private invite codes, or Screen Time selections to PostHog. We do not record screens or session replays in the River app. We do not collect text input or advertising identifiers. IP-based location analytics apply only to the website; they remain disabled in the River app.

How we use information

• Authenticate your account and keep it available across your devices.
• Connect partners and deliver invitations and shared commitments.
• Calculate and display protected-time progress.
• Understand onboarding and feature use through product analytics.
• Manage the waitlist and send early-access and launch updates.
• Secure, operate, troubleshoot, and improve River.
• Review safety reports, enforce our Community Standards, answer support requests, and comply with legal obligations.

We do not use your data to monitor another person, for behavioral advertising, or the sale of personal information.

When information is shared

Your connected partner receives only the relationship and commitment information needed for shared River features. They do not receive your private Screen Time selection or device activity.

We use service providers to operate River, including Apple for sign-in, Family Controls, and app distribution; Supabase for authentication and database infrastructure; Railway for application and queue hosting; Amazon Web Services and CloudFront for web delivery; Slack for private team notifications; PostHog for product analytics; and Google Workspace for support email. They process information for us under their own security and privacy terms. We may also disclose information when legally required or to protect users, River, or the public.

Retention and deletion

We keep active account and commitment data while your account exists. In River, open Account settings and choose Delete account to start permanent deletion without contacting support. River revokes its Sign in with Apple authorization where available, deletes your authentication account and associated account and commitment data, disconnects the partnership, and clears local Screen Time state on that device.

Historical product analytics are stored separately and are not automatically erased by deleting your River account. To request removal of those records, email privacy@rivercouple.com. We may need to verify your request so we can locate the correct records.

River 1.0 has no App Store subscription or in-app purchase to cancel. Deleted records may persist in encrypted backups until normal rotation, generally no more than 30 days. Short-lived delivery or error queues expire within 7 days. We may retain de-identified records and fraud or security evidence for up to 90 days when needed to protect River and its users.

Your choices and rights

You can unsubscribe from waitlist updates using a link in any email. You can also update your profile, leave Screen Time access disabled, disconnect from a partner, block a partner, or ask us for access, correction, or deletion of personal information. Email privacy@rivercouple.com. We may need to verify the request before acting on it.

River is not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it.

Security, transfers, and changes

We use encryption in transit, access controls, and encrypted storage for sensitive Apple authorization tokens. No service can guarantee absolute security. River and its providers may process information in Canada, the United States, and other countries where they operate.

We may update this policy as River changes. We will post the revised date here and provide additional notice when a material change requires it.