River — Privacy Policy

Version: 2026-07-09 Effective date: 2026-07-09

River ("we," "our," "the app") is a personal wellness companion. This Privacy Policy explains what information River handles, how it's stored, and what we do (and don't do) with it.

We are not a HIPAA-covered entity and we are not a healthcare provider. River is not a medical device under FDA regulations and does not diagnose, treat, cure, mitigate, or prevent any disease or condition. River is a low-risk general wellness product as described in FDA's September 2019 General Wellness Policy. If something in the app worries you about your health, please contact a licensed healthcare professional.

1. What information River handles

River is designed so that the data you log stays on your device. Depending on which modules you turn on, that may include:

• Profile information you enter (display name, pronouns, identity, chosen name)
• Medications, doses, and injection sites
• Cycle and symptom logs
• Hormone and lab tracking
• Photos you take or import for body change tracking
• Voice memos you record for voice training, and pitch measurements derived from them
• Surgery plans and post-op notes
• Appointments
• Insurance card details
• Legal documents you record (name change, gender marker, etc.)
• Journal entries
• Goals, clothing logs, chest binding logs, social milestones, coming-out logs

You may also set an app PIN or enable biometric unlock. Your PIN is verified against a salted hash. If you enable biometric unlock, your PIN is additionally stored in your device's secure hardware keystore, accessible only after successful biometric authentication, so Face ID / fingerprint can unlock the app. Disabling biometric unlock deletes that stored copy.

2. Where your data lives

Your data is stored on your device only, in a local encrypted database and local encrypted files.

• The whole local database is encrypted at rest with SQLCipher (AES-256 page-level encryption). Without the device key, the file is indistinguishable from random bytes.
• Photo and voice files are individually encrypted with AES-256-CBC + HMAC-SHA256 (encrypt-then-MAC) and stored under the app's private documents directory.
• The Data Encryption Key (DEK) is held in your device's secure hardware storage (iOS Keychain or Android Keystore) so the encrypted database can be opened when the app starts. If you set a PIN, a second copy of the DEK is wrapped with a key derived from your PIN (PBKDF2-SHA256, 600,000 iterations). The PIN acts as an access gate to the app; your at-rest protection comes from your device's hardware keystore plus full-database encryption.
• We do not have a server that stores your data, and we cannot read it.

3. What we don't do

• We don't sell your data.
• We don't share your data with advertisers.
• We don't share your data with data brokers.
• We don't transmit your health information to any third party.
• We do not require an account, email, or phone number to use the app.
• Production builds of River do not include analytics, crash reporting, or any third-party SDK that receives information about your use of the app. (Beta builds distributed to testers include a tester-triggered feedback channel that you control — it only sends anything when you actively submit feedback, and what you submit may include a screenshot of the screen you are on; see the in-app beta tester notice.)

4. Optional, opt-in analytics

River does not currently send any usage data or analytics. There is no diagnostics backend wired into the app today, so nothing is transmitted, even if the "Allow anonymous usage data" toggle in Settings is on. That setting only records your preference for a possible future update.

If opt-in diagnostics are added in a future version, this policy will be updated before any data is sent, and the data would be limited to anonymous, non-health signals only:

• A randomly generated install ID (not tied to your device or identity)
• Counts of which modules you have enabled (not the contents)
• Counts of screen views (not what you logged)
• Crash and error counts

We would never send the contents of any field you logged, encrypted blobs, file paths, photos, voice recordings, pitch measurements, or notes. Any such feature would be off by default.

5. Crash reporting

River does not currently send crash reports. No crash-reporting service is wired into the app today. If crash reporting is added in a future version, this policy will be updated first, and reports would be filtered to strip out fields that could contain health or personal data (notes, content, pitchHz, encryptedFilePath, and all cycle/hormones/voice/photo/journal payloads) before anything is sent.

6. Purchases and subscriptions

Optional River Plus subscriptions are billed by Apple (App Store) or Google (Google Play) directly. We never receive your name, email address, or payment details — Apple or Google is the merchant of record and handles all payment information under their own privacy policies.

• The app receives only an anonymous purchase entitlement (a signed receipt from the store) confirming that this device has an active subscription. It is not tied to your identity by us.
• That entitlement is cached in your device's secure storage so subscription features work offline. It is excluded from your encrypted backups.
• We do not use any third-party payment processor or subscription analytics service. No purchase information leaves the Apple/Google ecosystem.

7. Your rights

You can at any time:

• Export your data to a JSON or PDF file you control (Profile → Export Data or Track → Doctor Export).
• Delete your data by uninstalling the app or by deleting your profile, which cascades the deletion to all dependent data and removes encrypted media files.

Because we don't have a server, we don't need a separate "request your data" or "deletion request" flow — both are done in the app.

Depending on where you live, additional rights apply:

• California residents (CCPA / CPRA): right to know, delete, correct, and limit the use of Sensitive Personal Information.
• Washington residents (My Health My Data Act): see our separate Consumer Health Data Notice.
• Nevada residents (SB 370): see our Consumer Health Data Notice.
• Connecticut residents (CTDPA): see our Consumer Health Data Notice.
• Colorado residents (CPA): right to opt out of sensitive-data processing.
• Canadian residents (PIPEDA): right of access, correction, and to challenge our compliance.
• Quebec residents (Law 25): rights of access, rectification, and erasure; right to data portability.
• UK and EEA residents (GDPR / UK GDPR): because your data is stored only on your device and we operate no server that holds it, we do not process your personal data in the ordinary course of you using the app. If you use a beta build and actively submit feedback, we process that submission on the basis of your explicit consent (Articles 6(1)(a) and 9(2)(a)), and you can ask us to delete a submission at any time. Your GDPR rights of access, rectification, erasure, and portability are satisfied directly in the app.
• Brazil residents (LGPD): rights of confirmation, access, correction, and deletion — satisfied directly in the app.
• Australia residents (Privacy Act 1988 / APPs): rights of access and correction — satisfied directly in the app.

Because River runs entirely on your device, most rights are satisfied directly by your control of the app — for example, data portability is available via Export to JSON or the Doctor PDF Export.

California residents (CMIA): River may hold information covered by California's Confidentiality of Medical Information Act, including mental-health, reproductive-health, and gender-affirming care information. River does not disclose this information to any third party except as you direct via the Export features. River does not respond to requests for your information from third parties (including subpoenas concerning your gender-affirming care) because River does not hold any copy of your information on a server.

8. Children's privacy

River is for adults only. You must be 18 or older to use River. We do not knowingly collect data from anyone under 18.

9. Breach notification

Although we don't store user data on a server, we treat any actual or suspected security incident as serious. In accordance with the FTC's Health Breach Notification Rule (16 CFR Part 318), if we ever discover a breach of unsecured personally identifiable health information that we hold, we will notify affected users within 60 days of discovery and notify the Federal Trade Commission as required.

10. Changes to this policy

If we change this policy in a meaningful way, we will bump the version above and surface the change to you the next time you open the app. Your continued use after that change indicates acceptance of the updated policy.

11. Contact

Questions? privacy@river.lgbt

Privacy Officer (Quebec Law 25 § 3.1 / PIPEDA Principle 1): Carrera, reachable at privacy@river.lgbt.