Privacy Policy

Riff is a public performance platform. Your username, display name, avatar, bio, country, published bits and ranking are visible to everyone. Your email, password and payment details are not.

• Account. Your email address, and a password held in hashed form by our authentication provider. If you sign in with Google we receive your basic profile and email, never your Google password.
• Profile. Username, display name, avatar image, bio and country, all optional beyond the username.
• Content. The bits you write, the audio and video generated from them, and any thumbnails produced along the way.
• Voice recordings. If you use voice cloning, the sample you record and the synthetic voice created from it.
• Activity. Likes, comments, follows, bookmarks and which bits have been viewed, which together drive reputation, venue tier and the leaderboard.
• Payments.Our payment processor's customer and subscription identifiers plus your plan status. Card numbers go to Stripe directly and are never stored by us.
• Technical. Standard server and security logs, and the cookies needed to keep you signed in.

To run your account, turn your bits into performances, show them to other people, calculate reputation and rankings, take payment for credits, keep the platform safe, and fix things when they break. We [DO / DO NOT] use your content to train our own models — state this plainly and make sure it matches what the vendors below are permitted to do with it.

A voice sample is unusually sensitive: in some places it counts as biometric information with specific consent and deletion rules. Your recording is stored in our storage bucket and sent to the vendor that generates the synthetic voice.

We keep samples for [VOICE SAMPLE RETENTION PERIOD] and delete the cloned voice when you delete it or close your account. You can ask us to delete a sample at any time at [PRIVACY CONTACT EMAIL].

We don't sell your personal information. We share it with the service providers that make Riff work, each acting on our instructions:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and delivery.
• Stripe — payment processing and subscription billing.
• Our generation backend and the AI voice and video vendors behind it, which receive the text of your bit and, for cloning, your voice sample.

We may also disclose information where the law requires it, or to protect the rights and safety of our users. [ADD ANY ANALYTICS OR EMAIL VENDORS ONCE ADDED.]

Your username, display name, avatar, bio, country, published bits, reputation, venue tier, leaderboard position, and your likes, comments and follows are visible to other people. Treat anything you publish as public and permanent enough that others may have copied it.

Account and content data is kept while your account is open. When you delete your account we remove your profile and content within [ACCOUNT DELETION WINDOW], though copies can persist in encrypted backups for up to [BACKUP RETENTION PERIOD], and records we must keep for tax or legal reasons are retained for as long as the law requires.

Depending on where you live you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can edit or delete most of this yourself in settings; for anything else, write to [PRIVACY CONTACT EMAIL] and we'll respond within [RESPONSE WINDOW]. You can also complain to your local data protection authority.

Riff is not intended for children under [MINIMUM AGE]. We don't knowingly collect their information, and if we learn we have, we delete it.

Our providers operate in [PRIMARY DATA LOCATION] and elsewhere, so your information may be processed outside the country you live in, under appropriate safeguards where required.

If we make a significant change to this policy we'll give notice in the product or by email. Questions, requests and complaints go to [PRIVACY CONTACT EMAIL], [COMPANY LEGAL NAME], [COMPANY ADDRESS].