Legal publisher: Merthan Kavak (MKavak Apps)
Age eligibility: Ritmola is intended for desk-based working adults aged 18 and over. The App Store age rating or local law may set a higher minimum. The app does not collect date of birth for age verification.
Business contact: [email protected]
Stored on this device
Ritmola keeps app profile data—including preferences, work plans, session history, saved movement favourites, and any programmes or habit paths—in an app-specific file encrypted with AES-256-GCM. Its key is held in the device's secure-storage service (iOS Keychain or Android secure storage). This applies only to that profile file. Separate iOS App Group widget and Live Activity display state is outside this profile-file encryption and contains current session and timer fields and generic display text, not session history, movement notes, account IDs, or the encryption key. This implementation has not had an independent security audit. Saved programs and workspace presets, plus personal habit paths with check-ins and weekly reflections, are also stored in the encrypted local profile.
Data kept by the app
- Preferences such as language, theme, and reminder choices
- Your work and break plans
- Session and break history
- Movement favorites
- Saved programs, including routines and workspace presets
- Personal habit paths, including check-ins and weekly reflections
How data is used
The app uses local preferences, plans, session history, and favorites to provide the features you choose. It does not create a clinical profile or make a diagnosis. Optional external features may send limited data to the enabled services listed on the Privacy & Data screen.
Separate profile storage
Guest and signed-in profiles use separate encrypted local storage scopes. Signing in does not merge, upload, or sync guest preferences, work plans, session history, favorites, saved programs, or habit paths. After the erasure service durably accepts a confirmed account-deletion request, the app clears the signed-in local profile and switches to the separate guest profile; a processing response is not provider-deletion completion. An encrypted local erasure tracker retains a SHA-256 account-scope hash, request ID, and status while processing is pending or uncertain and after completion, preventing a later sign-in from recreating that RevenueCat identity. A server-confirmed cancellation removes that tracker record.
iOS widgets and Live Activities
If you enable an iOS widget or Live Activity, its separate display state is outside the AES-256-GCM encryption of the local profile file. The App Group widget snapshot contains only the active session phase, timer/remaining time, appearance, generic localized labels, and update time; it contains no session history, movement notes, account ID, or encryption key. Live Activity state also uses a session identifier to update the active session.
External services enabled in this build
Configured account, email-delivery, and purchase services process the data described in this notice as needed to provide their features. When RevenueCat is configured on iOS, it may refresh customer and offering state at app startup, including for guest users before a paywall or purchase. They do not receive local plans or session history. This build does not use advertising, Firebase Analytics, crash reporting, Firebase Remote Config, HealthKit, or camera, and does not sync app history to the cloud.
Firebase Authentication
Used for account creation and sign-in, session refresh, email verification and password reset, and to authenticate account-deletion requests. Firebase Authentication processes your account ID, email address, sign-in provider and password. It uses request IP addresses and user-agent strings for authentication security and abuse prevention. When you sign in with Apple, the app asks Apple for your email address and name. Firebase may process your name if Apple provides it. If Apple or Google sign-in is enabled, the provider you choose processes that sign-in transaction under its own privacy terms; Firebase receives the provider identifier and account details needed for authentication. Firebase Authentication keeps logged IP addresses for a few weeks. It keeps other authentication information until the Firebase customer initiates deletion of the associated user. Firebase says that information is removed from live and backup systems within 180 days after deletion is initiated. This statement covers Firebase Authentication data, not separate provider logs. Account deletion in Ritmola is available only when the configured deletion flow is active.
Account email delivery
Account verification and password-reset requests go through Ritmola’s Worker: Firebase creates the one-time action link and Resend delivers the email. Verification sends the Worker a Firebase ID token, an App Check token and your app language; password-reset sends your email address and language with an App Check token. The Worker receives each request’s IP address and temporarily stores the email and IP in encrypted outbox jobs for both actions. It stores the Firebase ID token only during the verification stage. Firebase creates the action link, and Resend receives the email message and link. Your password and local plans or session history are not sent. When account email delivery is enabled, the app-specific Worker temporarily handles the request IP address, email address, and one-time Firebase action link/security token. The D1 delivery queue stores the pending payload encrypted with AES-256-GCM. After 15 minutes, a pending job is no longer eligible for delivery; the next scheduled cleanup removes its row. If the service is interrupted or no cleanup run occurs, removal can be delayed. A completed job is removed after delivery. Rate-limit records use HMAC-SHA-256 identifiers rather than raw IP/email. A later quota check removes records older than 48 hours; if no later check runs, a record can remain longer. Resend receives the email and message for delivery; its provider-side log retention applies. Worker Logs, Traces, and Logpush are disabled in the checked configuration. Cloudflare may still process platform security or service data. Its Privacy Policy and Customer DPA retention criteria, including stated purposes and legal obligations, still apply; no fixed platform-log period is stated.
Apple App Store and RevenueCat
RevenueCat checks, purchases and restores Ritmola Plus access. It uses purchase data for receipt validation and entitlement access, and for purchase analytics such as Customer History and charts. RevenueCat receives an environment-scoped App User ID, App Store purchase/transaction/entitlement data, and device and app request details. Its iOS SDK can send IDFV (when available), device and OS, app/build version, bundle, locale and store headers. RevenueCat records last-seen activity and may derive country from request IP; its docs say the raw IP is dropped after country is determined. Local plans and session history are not sent. When you delete your account, Ritmola asks RevenueCat to delete the linked customer. RevenueCat processes customer deletion asynchronously; it does not publish a fixed completion time or backup-deletion period. Information may be retained as necessary for legal obligations, disputes, or agreement enforcement. Apple billing records are separate.
Account-erasure processing and retained data
When account deletion is enabled and you confirm it, the app-specific Worker stores a durable erasure job in encrypted D1 storage. Its encrypted payload contains the Firebase UID and, when RevenueCat cleanup is enabled, the environment-specific RevenueCat customer ID derived from that UID. The D1 row uses a SHA-256 hash of the random request receipt and an environment-scoped HMAC-SHA-256 user index; the raw Firebase ID token and email address are not stored in erasure fields or Worker logs. Pending jobs do not expire and are retried until Firebase Authentication confirms the account is absent and, when enabled, a readback confirms that the exact RevenueCat customer is absent in the validated project. A queued provider response is not completion. After completion, the encrypted target and receipt are retained for seven days and rechecked every 15 minutes; scheduled cleanup then removes them. A cancellation tombstone contains no UID or customer payload and expires after 24 hours. This erasure job does not include local plans, session history, or Apple billing data. Provider logs and records kept outside this job follow the applicable provider policies or legal retention requirements.
Account-erasure processing and retained data
The encrypted local erasure tracker keeps a SHA-256 account-scope hash, request ID, and status while a request is pending or uncertain and after it completes. This minimum local fence prevents the same sign-in identity from recreating its RevenueCat customer. It does not contain the raw Firebase UID, email address, or authentication tokens. A server-confirmed cancellation removes the erasure record.
Retention and removal
The local file has no automatic expiry. It remains until you clear it here or the operating system removes the app data. An exported copy is outside Ritmola's control. If the device's secure-storage key is lost or unavailable, the encrypted file may become unreadable. Any enabled external service has separate retention, described below.
Export or remove local data
Choose exactly which categories to export. Plans and history may reveal personal routines; review the selection before continuing. Ritmola does not attach logs, tokens, or movement notes automatically.
Retention, export, and deletion
Local data stays on this device until you use the confirmed deletion action or the operating system removes app data. The export flow lets you select categories. Data held by an enabled external service follows the retention listed on the Privacy & Data screen and that service's applicable terms.
Manage subscription separately
Account deletion does not cancel an Apple App Store subscription or erase Apple's billing records. Manage or cancel a subscription separately in your Apple account. RevenueCat/Apple may keep transaction records under their own policies.
Website preferences and technical data
The studio site stores an optional light/dark theme choice in this browser's local storage; the system theme is the default when no choice is saved. The choice is not sent as a tracking cookie. The website host receives technical request data needed to serve and protect pages; host and log-retention details are listed separately. Cloudflare Pages hosts this site. Cloudflare applies purpose-based and legal-obligation retention criteria. Under its Customer DPA, processing lasts until it is no longer needed for the agreement or the agreement ends, subject to deletion terms. No fixed technical-log period is stated.
Health data and tracking
Ritmola does not use HealthKit, camera, advertising, Firebase Analytics, crash-reporting, or a clinical profile in this build. Movement and posture content is general wellness information, not diagnosis or treatment.
Ritmola support
Review the draft before sending. Only details you select are added. No logs, tokens, session content, movement notes, or health details are attached automatically. Avoid sending sensitive information. When you send a message, your email provider and the studio support mailbox receive it. Support mailbox provider and retention: Cloudflare Email Routing forwards support messages to Google Gmail. We retain correspondence only as needed to handle the request, necessary follow-up, and applicable legal obligations. Messages remain in the Gmail mailbox until deleted. Applicable provider deletion and backup criteria apply; deletion may not be immediate or remove every backup.
Policy version: 2026-11-03