Privacy Policy

Effective date: August 6, 2026

Last updated: August 14, 2026

This Privacy Policy describes how Rivet Innovation Technologies ("Rivet," "we," "us," or "our"), a Delaware corporation, collects, uses, and shares information when you use the Rivet mobile application, its Apple Watch app, widgets, and related services (together, the "Service").

If you do not agree with this Policy, please do not use the Service.

Contact: bakirhaljevac@gmail.com · 45 S French Broad Ave Ste 170, Asheville, NC 28801

1. Summary (the short version)

• We collect only what the app needs to work: your account details, your trips and prep activities, calendar events you connect, your onboarding answers, and — when you choose to use those features — your location, voice recordings, and photos.
• Onboarding includes one optional question about ADHD. Answering is entirely your choice, you can skip it, and the answer is used only to personalize the app — see Section 2.4.
• We use a small set of anonymous-style usage statistics (which features are used, how long prep steps take in coarse ranges) to improve the product. Your onboarding answers are never included in analytics.
• The app is currently free while in its testing (beta) period, and we collect no payment information. A subscription may be introduced in a future update; see Section 6a.
• We do not sell your personal information, we do not share it for advertising, and we do not track you across other apps or websites.
• You can delete your account and all associated data at any time from inside the app (Settings → Delete Account).

2. Information we collect

2.1 Information you provide

2.2 Information collected automatically

How location tracking works during a trip. When you start a tracked trip, your device position is processed on your device to update your estimated arrival time and to detect when you have reached your destination (so the trip can complete automatically). Your minute-by-minute movement is not uploaded to our servers and no location history or trail is stored — only the trip's origin and destination coordinates are sent to our server to compute travel-time estimates. Location is never accessed outside an active trip, and you can decline location access entirely (trips then work without live tracking).

2.3 Information we do NOT collect

We do not collect: contacts, payment or financial information (the app is currently free — see Section 6a), browsing history, advertising identifiers, location history or movement trails, or background location outside an active trip. Apart from the optional ADHD onboarding question described in Section 2.4, we do not collect health information, and we never access Apple HealthKit data. Our analytics events never contain calendar titles, addresses, coordinates, activity names, voice transcripts, photos, names, email addresses, or your onboarding answers.

2.4 The optional ADHD question

During onboarding, Rivet asks whether you have ADHD (with a follow-up about formal diagnosis if you answer yes). We ask because Rivet is designed to help with time management challenges that are common with ADHD, and your answer helps us personalize the experience and understand who the app serves. Please know:

• Answering is entirely optional. A visible Skip button lets you pass the question, and "Prefer not to say" is an accepted answer. Skipping changes nothing about how the app works.
• It is used only to personalize the Service and improve the product. It is never used for advertising, never sold, never shared with third parties for their own purposes, and never included in analytics events.
• It is not a medical record and Rivet is not a medical service. Your answer does not create a diagnosis, treatment, or provider relationship of any kind.
• You control it. The answer is stored in your account profile, is removed from your device when you sign out, and is permanently deleted when you delete your account. You can also ask us to delete it at any time (Section 10).
• For EEA/UK users, we process this answer only on the basis of your explicit consent (GDPR Art. 9(2)(a)), which you may withdraw at any time.

3. How we use information

We use the information described above to:

• Provide, maintain, and improve the Service;
• Create and manage your account;
• Sync your trips across your iPhone, Apple Watch, and widgets;
• Display and update your connected calendars;
• Compute travel times, departure alerts, and arrival estimates, and detect arrival at your destination during a tracked trip;
• Personalize the experience based on your onboarding answers (for example, tailoring in-app messaging to how often you run late);
• Convert your voice or photos into trips and events, when you use those features;
• Send you the notifications you configure (e.g., "time to start preparing," "time to leave");
• Enforce fair-use limits on AI-powered features;
• Detect, prevent, and respond to fraud, abuse, security incidents, and technical issues;
• Comply with legal obligations.

We do not use your personal information for third-party advertising, and we do not "sell" or "share" personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).

4. AI features and how your content is processed

Some features use artificial intelligence:

• On-device processing. On devices that support Apple Intelligence, trip planning suggestions are generated on your device and the content never leaves it.
• Server processing. On other devices, or for voice transcription and photo-based event extraction, your input is sent over an encrypted connection to our own backend, which forwards it to our AI provider (currently OpenAI) solely to generate the response you requested. We instruct our AI provider not to use this data to train its models pursuant to its API data-usage terms. Inputs are processed to answer your request and are not used by us to build advertising or marketing profiles.

5. Analytics

We use Amplitude, a product analytics service, to understand how features are used. Our implementation is deliberately restrictive:

• Events are limited to a fixed, reviewed list (e.g., "app opened," "trip created," "prep step completed," "onboarding completed").
• Event details are coarse (e.g., duration ranges like "3–5 minutes," counts, on/off flags) — never free text you typed, spoke, or photographed, and never your onboarding answers (including the ADHD answer).
• Events are identified only by your account identifier — no name, email address, device fingerprint, or advertising identifier is attached.
• All analytics traffic passes through our own server, which verifies your identity, strips any unexpected fields, and only then forwards the event. The app never talks to Amplitude directly.
• Session replay, screen recording, tap tracking, location tracking, and advertising attribution are disabled.

Analytics events are associated with your account identifier so we can understand usage patterns. After you delete your account, we stop sending new analytics events for that account; residual historical events may remain with our analytics provider until their retention period expires (see Section 9).

6. How we share information

We share personal information only with:

We may also disclose information: (a) to comply with law, regulation, legal process, or enforceable governmental request; (b) to enforce our Terms of Use; (c) to protect the rights, property, or safety of Rivet, our users, or the public; or (d) in connection with a merger, acquisition, or sale of assets, in which case this Policy will continue to apply to your information and we will notify you of any change in ownership or use.

We do not sell personal information and have not done so in the preceding 12 months.

6a. Payments and the free testing period

The Service is currently free of charge while it is in its testing (beta) period, and we collect no payment or billing information of any kind.

We plan to introduce a subscription in a future update. When that happens:

• Purchases will be processed by Apple through the App Store; we never see or store your card details.
• We may use a subscription-management provider (such as RevenueCat) to validate purchases. Such a provider would receive purchase receipts and subscription status tied to your account identifier — not your name, card number, or bank details.
• We will update this Policy before any payment-related data collection begins, and the subscription will be presented clearly in the app before you are ever charged.

Using the app during the free testing period creates no payment obligation — see the Terms of Use for details.

7. International data transfers

We are based in the United States and process data on servers located in the United States. If you use the Service from outside the United States — including the European Economic Area (EEA), the United Kingdom, or Switzerland — your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction.

Where required, we rely on appropriate safeguards for such transfers, including our service providers' participation in the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission.

8. Legal bases for processing (EEA/UK users)

If you are in the EEA or the UK, we process your personal data on the following legal bases:

• Performance of a contract (GDPR Art. 6(1)(b)): account creation, trips, calendar sync, notifications — everything necessary to provide the Service you signed up for.
• Consent (Art. 6(1)(a)): location access, microphone access, camera/photo access, and calendar access — each requested through iOS permission prompts, and each revocable at any time in iOS Settings.
• Explicit consent (Art. 9(2)(a)): the optional ADHD onboarding answer, which you may decline to give and may withdraw at any time (Section 2.4).
• Legitimate interests (Art. 6(1)(f)): restricted product analytics, service security, and abuse prevention, balanced against your rights through the minimization described in Section 5.
• Legal obligation (Art. 6(1)(c)): where processing is necessary to comply with applicable law.

9. Data retention and deletion

• Account data, trips, and calendar links are retained while your account is active.
• Onboarding answers (including the optional ADHD answer) are retained in your account profile while your account is active, are removed from your device when you sign out, and are permanently deleted when you delete your account.
• Live location during a trip is processed on your device in real time and is not retained — no location history is stored on the device or on our servers.
• Voice recordings and photos are processed to fulfill your request and are not retained by us as stored files after processing.
• Analytics events are retained in accordance with our analytics provider's retention settings.
• Server logs are retained for a limited period for security and debugging.

When you delete your account (Settings → Delete Account), we delete your profile, trips, prep history, saved places, onboarding answers (including the ADHD answer), and calendar connections; revoke stored Google and Microsoft calendar tokens; and delete your authentication record. Residual copies may persist in encrypted backups for a limited period before being purged. Historical analytics events associated with your former account identifier may remain until our analytics provider’s retention period expires.

10. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information;
• Port your information to another service;
• Object to or restrict certain processing;
• Withdraw consent at any time (e.g., by disabling a permission in iOS Settings), without affecting processing that occurred before withdrawal;
• Not be discriminated against for exercising any of these rights.

How to exercise these rights: most can be exercised directly in the app (edit profile, disconnect calendars, delete account). For anything else, contact us at bakirhaljevac@gmail.com. We will respond within the timeframe required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

California residents: the rights above correspond to your rights under the CCPA/CPRA, including the rights to know, delete, and correct. We do not sell or share personal information for cross-context behavioral advertising, so there is no need for a "Do Not Sell or Share" opt-out.

11. Children

The Service is not directed to children. You must be at least 16 years old to create an account. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from a child under 16 (or under the age of digital consent applicable in your country), we will delete it promptly. If you believe a child has provided us personal information, contact us at bakirhaljevac@gmail.com.

12. Security

We protect your information using encryption in transit (TLS) and at rest, authenticated API access (every backend request requires a verified sign-in token), per-user data isolation in our database security rules, and device-level protections (iOS Keychain and Data Protection). No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard measures appropriate to the sensitivity of the data.

13. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you through the app or by other reasonable means before the changes take effect. The "Last updated" date at the top shows when this Policy was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

14. Contact us

Rivet Innovation Technologies

45 S French Broad Ave Ste 170, Asheville, NC 28801

bakirhaljevac@gmail.com

If you are in the EEA or UK and wish to contact our representative or data protection contact, use the same email address with the subject line "Data Protection."