Privacy Policy

Last updated: 18 August 2026 · Effective: 18 August 2026

Riveloa turns the runs, walks, rides and lifts you already record into a fairly matched, competitive league. To do that we handle some of your data — including activity and health data. This policy explains what we collect, why, how we protect it, and the rights and choices you have.

In short: we read only the activity data we need to keep competition fair, we never sell your data, we never expose GPS routes or your precise location, and you can delete your account and data from inside the app at any time.

1Who we are

Riveloa (“Riveloa”, “we”, “us”) provides the Riveloa mobile app and this website. Questions about this policy or your data: privacy@riveloa.com.

2Information we collect

Account & profile

Email address, and the display name, username, competitive country and city you choose.
An optional profile photo you upload.
Authentication identifiers when you sign in with Apple, Google or an email link.

Activity & health data

Workout sessions you already recorded — sport type, start/end time, duration, distance, elevation gain, active energy (calories) and step or workout counts — imported with your permission from Apple Health (HealthKit) on iOS or Health Connect on Android.
Activities you enter manually.
We do not collect GPS routes or maps, raw heart-rate streams, clinical/medical records, or your home/precise location.

Competitive data

Data the service derives from your activity: competitive rating, battle and rivalry results, league position, leaderboard ranks and achievements.

Subscription data

Your Riveloa PRO status. Payments are handled by the Apple App Store or Google Play — we never receive or store your card or bank details.

Technical data

A push-notification token for your device, basic device/app info, and — if enabled — anonymised product analytics and crash reports to help us fix problems.

3How we use your data

Run the core service: import activity, compute fair matchmaking and ratings, build leaderboards, and let you compete, follow and join communities.
Keep competition honest (fraud and anti-cheat checks).
Send competition notifications (invites, results, reminders) — which you can turn off in settings.
Manage your Riveloa PRO entitlement.
Keep the app secure, debug issues, and understand aggregate usage.

4Health data — how we treat it

Permission first. We read from Apple Health / Health Connect only after you grant access, and only the data types listed above. You can revoke access anytime in your phone's Health settings.
Read-only & minimised. We never write to your health store and store only what competition needs.
Never sold, never advertised against.
Not medical data. Riveloa is a fitness and competition product, not a medical device, and does not provide medical advice.

5How we share data

We do not sell your personal data. We share it only with service providers who help us run Riveloa, under contract and for that purpose only:

Supabase — database, authentication and backend hosting.
Apple & Google — sign-in, the app stores, and push delivery (APNs / FCM).
RevenueCat — subscription management (status only, no payment details).
Expo — relaying push notifications.
PostHog and Sentry — product analytics and crash monitoring when enabled, minimised and scrubbed of health values and credentials.

Other athletes see only what your privacy settings allow (e.g. your public profile, ranks and results). We may also disclose data where required by law or to protect the rights and safety of our users and the service.

6Your rights & choices

Depending on where you live — including under Brazil's LGPD and the EU/UK GDPR — you can:

Access, correct or update your data (most is editable in the app).
Delete your account and data.
Request a copy of your data (portability).
Withdraw permissions — revoke Health access, turn off notifications or analytics.

For anything we can't handle in-app, email privacy@riveloa.com.

7Deleting your data

Delete your account from Settings → Delete account in the app. Your health and activity data is erased, your content is anonymised, and your authentication and push tokens are revoked. Some records may be kept where required by law or for fraud prevention, and backups are purged on a rolling schedule.

8Security

Data is encrypted in transit, access is governed by row-level security so athletes reach only what they're allowed to, and privileged keys never ship inside the app. No system is perfectly secure, but we work to protect your data and to minimise what we hold in the first place.

9Children

Riveloa is not intended for children under 13 (or the minimum age of digital consent in your country, such as 16 in parts of the EU). We do not knowingly collect data from children below that age.

10International transfers

We operate globally, so your data may be processed in countries other than your own, with appropriate safeguards for the transfer.

11Changes to this policy

We may update this policy as the product evolves. We'll revise the “Last updated” date above and, for material changes, notify you in the app.

12Contact

Questions or requests: privacy@riveloa.com.