Privacy Policy

Last updated: October 1, 2026

You can buy a one-time export without an account. If you create an account, we store a little more. Here's exactly what we collect and why.

What we collect

• Email address: when you provide one to receive your export download links or order confirmations, or to sign in. Used to deliver your files, order updates and sign-in links.
• Account details: if you create an account, we store your email and the profile details you enter (your name, workspace name, what you use Rivioo for, and the client app you connect). You sign in with a link we email you. If you set a password, we store only a salted hash of it, never the password itself. If you sign in with Google, we store the account identifier Google gives us.
• Sign-in sessions: when you sign in, we set a session cookie that lasts up to 30 days. For each session we store when it was created and last used and your browser's user agent, so your account can list where you are signed in and let you sign out of other sessions.
• API keys and API usage: if you subscribe, we store your API keys only as hashes, along with the last four characters and the time each key was last used. For each API and MCP request we log the time, the endpoint, the response status, the number of reviews counted, the key used and the IP address. These request logs are deleted after 90 days. Monthly usage totals are kept with your billing records.
• Order and payment records: for paid exports we store the order details (app, export size, amount, payment reference) needed to deliver your export and process refunds. Card and payment details are handled by Razorpay, our payment processor; Rivioo never sees or stores your full card number. For subscriptions we keep your plan, your subscription status, and the card brand and last four digits, so your account can show which card is on file. We also keep the payment confirmations Razorpay sends us, which can include your email address and, if you gave one at checkout, your phone number.
• IP address: used for rate limiting and abuse prevention, and stored with each export order and each API request.
• Usage analytics: we use Google Analytics and Mixpanel to understand how the site is used (pages viewed, exports started, device and browser type, referring site, approximate location). When you enter your email to receive an export, Mixpanel links your activity on the site to that email. We also record completed payments there (amount, payment method type and payment reference, never card details).

What we don't do

• We don't sell or rent your data to anyone.
• We don't require an account for one-time exports. Passwords are optional: you can always sign in with an emailed link.
• We don't send marketing email. Emails from Rivioo relate to your exports and your account, such as order updates, sign-in links and API keys.

Exported review data

The reviews you export are publicly available content from the Apple App Store and Google Play Store, written by their respective users. Rivioo processes this public data to build your export file.

Services we rely on

A few services process data on our behalf: Razorpay (payments, see their privacy policy), Resend (sending your download, order and sign-in emails), Railway and Vercel (hosting), Google (Google sign-in, if you choose it, and Google Analytics), Mixpanel (usage analytics), and Slack (internal operational alerts to us, which can include your email address and order or plan details). Our pages also load fonts and scripts from Google Fonts, unpkg and the Socket.IO CDN, which see your IP address when your browser fetches them. Each handles data under its own privacy policy, and servers may be located outside your country.

Cookies and local storage

We use browser local storage to remember small conveniences (like the email you entered for delivery) and, only if you accept analytics in the cookie banner, analytics identifiers and cookies from the services listed above. You can change your choice any time with the Cookie settings link at the bottom of each page. If you sign in, one essential cookie keeps you signed in for up to 30 days, and a short-lived cookie is used while a Google sign-in is in progress. No advertising cookies.

Data retention and deletion

Export files and the per-order copy of the reviews are kept for 30 days after your export completes so your download links keep working, and are deleted shortly after that. Separately, we keep a shared store of public reviews (review text, rating, date, and the public reviewer name shown by the store) so that later exports and API requests are faster. It is not linked to your order and is not deleted after 30 days.

Order and payment records, including the IP address an order came from and the payment confirmations our payment processor sends us, are retained as required for accounting. API request logs are deleted after 90 days. Sign-in sessions expire after 30 days. Account details are kept until you ask us to delete them. You can request a copy of the data we hold about you, or ask us to delete your email and associated data, by contacting admin@rivioo.app from the address in question.

Contact

Privacy questions: admin@rivioo.app.