← Back to RiffDaily

Privacy

Plain language, no legal filler. This is a small app run for friends, and this is everything it actually does with your data.

What's collected

  • Username and password — your password is stored as a one-way hash; nobody, including the person running this app, can see the original.
  • Email — required at signup, used only to send you a verification code and, if you request it, a password reset code. It's shown to you (not other users) in Settings.
  • What you post — your Daily round's words, transcript, and timing stats, if you choose to send them to the board. Every post is visible to any signed-in user on the Public board — there's no way to post "to a group only." A group's board is just the Public board filtered down to that group's members; it doesn't hide your post from anyone else on Public.
  • Upvotes and group membership — who upvoted what, and who's in which group, so the app can enforce one-vote-per-person and show member lists.

What's not collected

  • No ads, no ad trackers, no analytics scripts.
  • No third-party logins (Google/Apple/etc.) — just a username and password.
  • Your IP address is used only transiently, in memory, to rate-limit abuse (e.g. someone hammering the login form) — it isn't stored in the database or logged long-term.

Who else sees it

Resend delivers the verification/reset emails on this app's behalf — they receive the email address and code being sent, nothing else. The app and its database run on Railway. None of this data is sold, shared for advertising, or given to anyone else.

Sharing a Daily post publicly

Tapping the 🔗 icon on your own board post copies a public link to that one post (its words, transcript, and time) — anyone with that link can view it without an account, no sign-in required. The link uses a random, unguessable code rather than the post's normal ID, so it can't be found by browsing or guessing. Only you can generate this link for your own posts. This doesn't change anyone's privacy exposure much, though — as above, every post is already visible to any signed-in user on the Public board regardless of group.

Control over your data

You can delete any Daily post you've sent to a board yourself, or delete your account entirely (Settings → Delete Account), at any time — both are self-serve and take effect immediately.