Privacy

Riffle is a small reading and study app. This page says exactly what it keeps about you, why, and how to remove it. There is no advertising, no analytics, and nothing is sold or shared for marketing.

What Riffle stores

• Your account. Your email address. If you sign in with Google, the name and profile picture URL Google sends. These identify your account and show your initial in the app.
• What you add. The pages you scan or upload (images and PDFs), the text taken from them, pasted text, your notes, flashcards, quiz answers, comprehension-check answers and chat messages, plus the summaries, terms, cards, quizzes and chat replies the AI writes for you. This is the product: it exists so you can read and study it.
• Reading settings and progress. Your pace, type size, colors, where you stopped in each text, and when you last read it.
• AI usage counts. For each AI request: the kind of request, the model used, token counts and a timestamp. This enforces the daily limits that keep the service affordable.
• Server logs. Our hosting provider keeps standard request logs (IP address, browser type, time, page requested) for a short period to run and debug the service.

Riffle does not read your contacts, location, or anything on your device other than the photos you choose to scan. The camera is used only while the scan screen is open and nothing is recorded.

Cookies and local storage

Riffle sets only the cookies needed to keep you signed in. They are essential, so there is no consent banner. Your light or dark theme choice is kept in your browser's local storage and never sent anywhere.

Who processes your data

Riffle runs on three services. Each sees only what it needs to do its job.

• Vercel hosts the app and runs its server code. Requests pass through Vercel.
• Supabase stores your account, your texts and everything listed above, and your scan files in a private bucket. Only you can read your rows and files; every table is protected by row-level security keyed to your account.
• Google provides two things. Google Sign-In, if you choose it. And the Gemini API, which receives the pages you scan to turn them into text, and the text of a document when you ask for a summary, terms, flashcards, a quiz, grading, comprehension checks or a chat reply. Your name, email and account details are not sent with those requests; only the document content and your question are. Google's handling of API requests is governed by its Gemini API terms; the paid tier does not use requests to train its models, while the free tier may.

How long it is kept

Until you delete it. Deleting a text removes its scans and everything built from it. Deleting your account removes your sign-in, every row and every file immediately. Supabase and Vercel may hold backups and logs for a limited period after that under their own retention rules.

Your choices

• Download everything from Settings as a JSON file.
• Delete your account from Settings. It takes effect at once.
• Sign in without Google by using an email link instead; then Google learns nothing about your account.

If you live in the European Economic Area, the United Kingdom, or California, you have the rights to access, correct, export and erase your personal data, and to object to or restrict processing. The download and delete options above fulfil most of these on the spot; for anything else, use the contact below.

Age

Riffle is not directed at children under 13 and does not knowingly keep data about them. If you believe a child under 13 has an account, contact us and it will be removed.

Changes

If this page changes in a way that matters, the date at the top moves and signed-in users will see a note in the app.

Contact

No contact address has been published for this instance of Riffle yet.