Privacy Policy
Rivfun Stories is operated by Maksim Prokhorov, an individual based in Finland, who is responsible for the personal information described here. This notice covers the app, account services and support. Contact info@rivfun.com with privacy questions or requests.
Information we handle
- Your account: name, email address, account identifier, sign-in provider identifier, sign-in method, age confirmation and preferences. Email sign-in uses a protected password representation, not a readable copy of your password. Password-reset requests involve your email address and a time-limited reset link.
- Your listening: story selections, listening progress, completion, history, streaks and milestones. Saved playback positions and playback preferences are also held on your device.
- Your purchases: purchase and subscription records, plan, status and expiry. Your app account identifier links purchases to your account. We do not receive your full payment-card details from App Store purchases.
- Your messages: the contact details and information you choose to send when asking for support or exercising your rights.
- Technical information: service providers can process network and device identifiers, IP addresses, request and usage information to deliver, secure and operate their services.
Information comes from you, your use of the app, and the sign-in, purchase and technical services you use. We do not request access to your microphone, contacts or device location services. This does not prevent service providers from processing approximate location derived from network information.
Apple and Google sign-in
These are optional alternatives to email sign-in. We receive verified account identifiers and, when supplied by the provider, your name and email address. For Sign in with Apple, we also protect the credentials needed to revoke the app’s authorization when you delete your account.
Google’s sign-in service declares processing of name, email address, phone number, approximate location, user and device identifiers, usage information and other technical information for sign-in, security and service operation or analytics. This describes Google-side processing; our account database does not store a phone number or profile photo from Google sign-in. Google and Apple also handle information under their own privacy notices.
Why we use information
We use account and listening information to provide the service you request: signing in, delivering stories, keeping your place and displaying listening history and milestones. We use purchase information and identifiers to grant Premium access, restore purchases, manage subscriptions and understand subscription performance. Support information lets us respond to you. Technical information helps operate the service, detect misuse and resolve faults.
Where European data-protection law applies, providing your account and purchased service is based on performing our contract with you. Service security, support and subscription analytics rely on our legitimate interests in running a dependable service, balanced against your rights. We process information where necessary to meet legal obligations. When a particular activity requires consent, you may withdraw it; this does not affect processing that was lawful before withdrawal.
Account details needed for registration and sign-in are required to use an account. Without purchase verification, we cannot establish Premium access. Using Apple or Google sign-in and contacting support are your choices. We do not use this information to track you across other companies’ apps or websites for advertising.
Who receives information
- Apple: App Store payments, subscriptions and optional Apple sign-in.
- Google: optional Google sign-in.
- RevenueCat: purchase verification, subscription management and subscription analytics, linked to your account identifier.
- Railway and MongoDB Atlas: hosting account services and storing account and listening records. Our Railway account service runs in the United States.
- Cloudflare: delivering website and story media and protecting delivery services.
- Resend: delivering password-reset email.
We may also disclose information when required by law or necessary to establish, exercise or defend legal claims. Service providers may process information outside your country, including outside the European Economic Area. Such transfers are subject to applicable data-protection rules. The published data-processing terms of MongoDB, Cloudflare and Railway describe safeguards for relevant international transfers, including standard contractual clauses where applicable. You can consult those terms or contact us for a copy of the relevant safeguards and information about which transfer arrangements apply to your information.
How long information is kept
Account and listening records support your use of the service while your account exists. Retention of technical logs, backup copies, email and support correspondence depends on the purpose of the record: resolving the request or incident, maintaining service security and recovery, and satisfying applicable legal or dispute-handling requirements. An account-deletion request does not mean every backup or independently held provider record disappears at the same moment. Contact us for information about records relevant to your request.
Once provider-cleanup requests have been accepted, the minimal deletion-status record is scheduled for removal after 30 days. Unfinished cleanup requests remain available for retries and resolution. This 30-day period concerns the status receipt, not a guarantee that every copy of personal information is erased within 30 days.
Deleting your account
In the app, open You → Settings → Delete account, or contact us. On acceptance, your account and listening history are removed from the primary account database. We request deletion of the associated RevenueCat customer and revoke stored Apple sign-in authorization. Failed provider requests are retried; providers may continue processing after accepting a request.
For older Apple sign-ins where we cannot revoke authorization directly, we explain how to remove Rivfun Stories under Sign-In & Security → Sign in with Apple in your Apple Account. This does not prevent deletion of your app account.
App versions supporting a deletion receipt clear the deleted account’s saved listening position and offer a private status link on the sign-in screen. Keep that link private. You can remove the receipt from the device. If your app does not show a receipt, contact us for help.
Deleting your account does not cancel an App Store subscription. Manage subscriptions in your Apple account. Apple may retain payment records under its own responsibilities.
Your choices and rights
Depending on applicable law, you can request access to or a copy of your information, correction, deletion, restriction of processing or portability. You can object to processing based on legitimate interests and withdraw consent where consent is used. Contact info@rivfun.com; we may need proportionate information to confirm your identity. Do not send your password.
You may complain to a competent data-protection authority, including Finland’s Office of the Data Protection Ombudsman. In Malaysia, you may contact the Personal Data Protection Commissioner; in the Philippines, the National Privacy Commission. Contacting us first is not a condition for making a complaint.
Teenagers and story content
Rivfun Stories is for adults and teenagers and includes mature or frightening themes. Follow the age rating shown in your App Store. Registration currently requires confirmation that you are at least 13; this is a self-declaration, not age verification, and does not replace local age or parental-consent requirements. The app is not directed to children under 13. Contact us if you believe a child has supplied information contrary to these requirements.
Security and updates
We use encrypted network connections and access controls for account services. No service can guarantee absolute security. We may update this notice as the service changes and will provide additional notice where required. The date above identifies this version.
Privacy contact
Maksim Prokhorov · Rivfun Stories · Finland
Maksim Prokhorov also acts as data protection officer.
info@rivfun.com