Privacy Policy

Last updated: August 22, 2026

Rivalto ("we", "our", or "us") is operated by Gino Falcone / Road to Jesus Ministry. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service"). Please read this policy carefully. If you do not agree with its terms, please discontinue use of the Service.

1. Information We Collect

We collect the following categories of information:

Account information: your username, email address, and optional profile photo when you register.
Profile data: timezone, country code, bio, and account settings you provide.
Habit & activity data: habits you create or save, daily completions, streaks, milestone badges, duel matchmaking results, win streaks, and category statistics.
Photo Log content: daily progress photos you choose to upload (Pro feature). Photos are stored in our secure cloud storage and linked to your account.
Community data: any content you post in the community bulletin board, comments, or reactions within the Service.
Device & technical information: device type, operating system, app version, and diagnostic data collected for crash reporting and app stability purposes.
Payment information: subscription status and transaction history. All payment processing is handled by Apple App Store or Google Play Store. We do not store credit card numbers or full payment details on our servers.

2. How We Use Your Information

To create, authenticate, and manage your account.
To operate core app features: habit tracking, 1v1 daily duels, milestone badges, photo logs, and community boards.
To send transactional communications such as OTP verification codes via Resend.
To manage and verify your subscription status via RevenueCat.
To improve the Service through aggregated, anonymized analytics.
To investigate and prevent abuse, fraud, or violations of our Terms of Service.
To respond to support requests sent to support@rivalto.app.
To comply with applicable legal obligations.

3. How We Share Your Information

We do not sell your personal information to third parties. We may share your data with trusted service providers who operate under strict confidentiality agreements:

Supabase: our database, authentication, and file storage provider (data stored in EU/US data centers).
Resend: transactional email delivery (OTP codes only).
RevenueCat: subscription status management across iOS and Android platforms.
Apple / Google: in-app purchase processing and subscription billing.
Law enforcement or legal authorities: if required by applicable law, court order, or valid legal process.

Public profile information (username, profile photo, badges, trophies, category streaks, and public photo log posts) is visible to other users of the Service by design.

4. Data Retention

We retain your account and activity data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as fraud prevention). Aggregated, anonymized data may be retained indefinitely for analytics purposes.

5. Your Rights & Data Deletion

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your account and associated personal data.
Opt out of non-essential communications at any time.
Where applicable under GDPR or CCPA, request data portability or restriction of processing.

To exercise any of these rights, use the in-app account deletion feature or contact us at support@rivalto.app. We will respond within 30 days.

6. Photo Log & User Content

Daily Photo Log images you upload are stored in our secure cloud storage (Supabase Storage) and associated with your account. Photos marked as public are visible to other users on your profile. You may delete your own posts at any time. If you delete your account, all photo log content associated with your account will be deleted within 30 days.

7. Children's Privacy

Rivalto is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at support@rivalto.app and we will take steps to delete it promptly.

8. Security

We implement industry-standard security measures to protect your data, including encrypted connections (HTTPS/TLS), secure authentication via Supabase Auth, and row-level security policies on all database tables. While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

9. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing any personal information.

10. International Users

Rivalto is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using the Service, you consent to this transfer and processing.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we may notify you through the app or by email. Continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or how we handle your data, please contact us at: support@rivalto.app