Privacy Policy

The part that matters most: this app is mostly about other people

Rivaj plans a wedding, and a wedding is made of other people. The neondra and salami register records, by name, who gave money and how much. The guest list holds names and phone numbers. The commitments list records which relative promised to pay for what.

Almost none of those people installed Rivaj, agreed to anything, or know the record exists. If you use Rivaj you are the one deciding to keep that information, and this page is written so you can decide knowingly.

What we collect

Your account: your name, your email address and a hashed password. If you sign in with Google we also store the Google account identifier.

The wedding: bride and groom names, the date, the cities, and each function with its own date and city.

The neondra and salami register: for each entry, the giver's name, their relation to you, the amount, the currency, which function they gave at, whether it was cash or bank, and any note you add. Entries can also carry a marker recording that you consider the money owed back, and a history of gifts exchanged with that person in earlier years.

Guests: name, party size, which side they are from, city, phone number and a note, plus their acceptance and attendance per function.

Vendors: name, kind, city, phone number, quoted price and your notes.

Budget: commitments by named person, contributions actually received, and expenses including the name of whoever paid.

Gettogethers, playlists and your notification preferences.

Your phone's contacts

When you add a guest you can pick someone from your contacts. That uses the phone's own contact picker, which runs outside Rivaj and hands back one contact at a time. Rivaj copies only that person's name and first phone number.

Rivaj does not hold the contacts permission and cannot read your address book in bulk. There is no route on our server that would accept a bulk upload of contacts.

Where it is held

On our server, over HTTPS, at deplyra.com/rivaj-api. The server is in the European Union.

Rivaj keeps no copy on your phone beyond your sign-in token and a cached copy of your own account. The register itself lives only on the server, so an entry you type is written straight there.

The database is not encrypted at rest. The disk is ordinary storage with no encrypted volume and no transparent database encryption. Your password is hashed, but the register, the guest list and the phone numbers are stored as ordinary text. We would rather say that than imply protection we have not built.

The database is copied to off-site backup storage each night.

Who can see it

You, and anyone you invite as a collaborator. Collaborators do not see the neondra register unless you tick that permission for them specifically, and that permission is off by default.

Anyone you invite can see every other collaborator's email address.

An invite code is short. Someone who guessed a live code could join a wedding and see the guest list, the budget and the vendors, though not the neondra register unless the neondra permission were also granted. We are treating that as something to fix rather than something to describe as safe.

Ads

Rivaj carries Google AdMob. In the current build the banner slots have no unit assigned, so no banner loads, and the one ad that does appear is a single full-screen ad after adding a song to a playlist. Requests are marked non-personalised, but AdMob still receives your device's advertising identifier, its IP address and app information.

Google's consent form runs before the first ad request. If it fails or times out, the app proceeds with a non-personalised ad rather than holding it back.

Deleting your account, stated exactly

Settings has a Delete account control, and a wedding can be deleted too. Both mark the record as deleted and revoke your sessions. Neither actually removes anything from the database.

The app currently tells you that data is gone from our servers within 30 days. That is not true today: no job exists that carries it out. We are correcting the app, and in the meantime this page is the accurate one.

Deleting your account does not delete the neondra register, the guest list, the commitments, the contributions or the vendor records. Those rows stay.

Owed-back markers cannot be removed at all, by you or by us. The database refuses to delete or change them by design, so a marker recorded against a named person can only be added to, never taken back. If you need one gone, email [email protected] and we will tell you honestly what we can and cannot do.

To have your data actually removed, email [email protected] from the address on your account and a person will do it by hand.

If you are named in someone's register

You may be in Rivaj without knowing: your name, your relation to the account holder, the money you gave and a note about it. You have no account and no way to look.

Email [email protected] and we will tell you what is held and remove what we are able to remove. We will also tell you where we cannot, rather than pretending otherwise.

Children

Rivaj is for adults planning an event. It is not directed at children and it has no age check. Children may be named in a guest list by the person who wrote it.