Privacy Policy

Last updated: October 29, 2026

Rivory is operated by Kleos Labs LLC, a Nebraska limited liability company.

1. Information We Collect

We collect information you provide directly to us when you:

• Sign in with Apple, Google, or an email one-time code. We receive your email address and, if your Apple or Google account shares it, your name, which becomes your starting display name
• Choose a display name or handle
• Make picks or bracket predictions in a competition
• Join or create groups and crews
• Send group or direct messages, including photos, captions, polls and reactions, or report content
• Purchase or restore Rivory Plus — purchase history and subscription status are linked to your Rivory account ID
• Contact us for support
• Send a problem report from the app (Report a problem, in Settings). A report includes your account email, your message, your device model, operating system and network status, the app version, build and update, the screen and competition you were on, your analytics session ID and recent activity in the app, and a screenshot if you choose to attach one

We also collect some information automatically:

• Usage analytics — features used and screens visited
• Approximate location — the city, region and country estimated from your IP address, used only for analytics. We never request or collect your precise location.
• Crash and error diagnostics if the app fails unexpectedly
• A push notification token, if you enable notifications
• Your device’s time zone, saved with your notification settings so that quiet hours follow your local time
• Your IP address and basic device or browser information, which our hosting and app-update providers log when the app or website connects to them

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the app
• Process your picks and calculate scores
• Display leaderboards and group or crew rankings
• Verify purchases, restore Rivory Plus access, and understand subscription activity
• Send you push notifications about your account, groups, and competitions
• Respond to your comments, questions, and support requests
• Review reports of abuse or safety concerns and enforce our community rules

Kleos Labs LLC is the controller of your personal data. If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Contract: to provide the Service you signed up for, including your account and sign-in, picks and scores, leaderboards, groups and crews, messages, Rivory Plus purchases, and support for your account
• Legitimate interests: to keep the Service secure and reliable (crash and error diagnostics, request logs), to understand how the app is used so we can improve it (usage analytics), and to keep the community safe (reviewing reports and screening uploaded crew logos). You can object to this processing, as described in Section 5.
• Legal obligation: to keep records the law requires and to respond to lawful requests
• Consent: to send push notifications, which you turn on in your device settings and can turn off at any time

3. Information Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

• With your consent: when you join a group or crew, other members can see your display name and picks, and your NFL Power Rankings for weeks that have already locked. Your current week’s board, notes and confidence are never shown, and you can turn locked-week sharing off in Settings › Privacy & safety
• On leaderboards: your display name and scores may appear on public and group leaderboards. Your email address is never shown to other users.
• Service providers: we use the following third-party services to operate the app:
  • Supabase — authentication, data storage (including photos and images posted in chats, and problem-report screenshots), and the server functions that run the app
  • Resend — sending sign-in code emails, replies to support requests and other service emails, and receiving email sent to our support address
  • Google Workspace — our company email, including messages you send to our support address
  • RevenueCat — purchase verification, subscription management and analytics, using your Rivory account ID, purchase history and subscription status
  • PostHog — usage analytics and error tracking
  • Sentry — crash and error diagnostics, and the problem reports you send from the app
  • Expo — delivering app updates and relaying push notifications. When the app checks for an update, Expo receives your IP address and basic device and app information, such as the platform and app version.
  • Apple Push Notification service — delivering push notifications
  • Vercel — hosting rivory.app. Vercel keeps request logs, including your IP address and browser information, when you visit the website.
  • Amazon Web Services (Amazon Rekognition) — when you upload a crew logo, automated screening of the image for unsafe content and text

These providers process your data only to provide their services to us, and they are bound by terms that require them to give your data the same or equal protection as this policy.

Payments are handled by Apple through the App Store. Rivory and RevenueCat do not receive your full payment card details.

4. Data Security

We implement appropriate security measures to protect your personal information. Your data is stored securely using industry-standard encryption. However, no method of transmission over the Internet is 100% secure.

We keep a security record of sign-in and account events, such as signing in or deleting an account (the account, the event, its time and the IP address), for 90 days, then delete it.

5. Your Rights

You have the right to:

• Access your personal information
• Update or correct your display name and preferences in the app
• Delete your account and associated data in the app: open You, tap the gear for Settings, then tap Delete account
• Get a copy of your personal data, including your picks, by emailing support@kleoslabs.dev
• Object to processing based on our legitimate interests, or ask us to restrict it
• Withdraw your consent at any time, for example by turning off notifications
• Ask us about the analytics and diagnostics data described in Section 7

To use any of these rights, email support@kleoslabs.dev. We will respond within the time the law requires.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to lodge a complaint with a data protection supervisory authority, in particular where you live or work, or where you believe your data was mishandled.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service.

When you delete your account in the app, we delete it at once, together with the data linked to it in our database. Copies in our database backups are overwritten within 7 days. The security record in Section 4 is kept for its 90 days.

Within 30 days, we also delete the copies held elsewhere: your analytics and error-tracking data in PostHog, your customer record in RevenueCat, screenshots you attached to problem reports, photos and images you posted in chats, and your support emails with us.

Error and problem reports in Sentry expire within 90 days.

The exception is purchase records. Apple keeps its own records of App Store purchases, and we keep a record of your purchase and subscription events (an account ID, the product and the dates, but not your name or email), which we may need for accounting, tax or refund questions. We may also keep data where the law requires us to.

If deleting a reported message or account also deletes its report, authorized moderators may retain a restricted copy of the reported text and report details to review abuse or safety concerns. That copy, and decisions recorded with it, are deleted within 30 days of the report being deleted. This copy does not include attached media or the rest of the conversation.

Aggregated, anonymized data that cannot identify you may be retained indefinitely to improve our services.

Deleting your Rivory account does not cancel an app-store subscription. Manage or cancel it in the store where you subscribed.

7. Analytics and Diagnostics

This section covers analytics and diagnostics in the Rivory app and website.

We use PostHog to understand how users interact with the app — for example, which features are used and how often. PostHog collects usage data tied to your account; it is not sold to third parties. PostHog also estimates an approximate location (city, region and country) from the IP address each request comes from, which we use in aggregate analytics. Rivory does not ask for location permission or read your device’s GPS. PostHog also records errors the app runs into, so we can fix them.

On the rivory.app home page, PostHog records which sections visitors reach, which examples they open and use, and which links they tap, along with the site that sent them, any campaign tag in the link and their screen size. It stores a random ID in your browser to connect those visits, and it does not record anything you type on the page. If you sign in or create an account in this browser, that earlier home-page activity can be linked to your account. The home page records none of this when your browser sends Global Privacy Control or Do Not Track. That opt-out covers only the home page, not the Rivory web app.

We use Sentry to capture crash reports and error diagnostics so we can find and fix reliability issues. Sentry may receive device and app diagnostic information at the time of a crash or error. Sentry also receives the problem reports you send from the app, including your message, your account email and the screen you were on.

These services are part of how the app operates and are not behind a separate in-app toggle today. If you have questions about this data or want to request its deletion, contact us at the address in Section 12.

8. Children’s Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at support@kleoslabs.dev so we can take steps to delete such information.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. Our service providers (Supabase, Resend, Google, RevenueCat, PostHog, Sentry, Expo, Apple, Vercel, and Amazon Web Services) may store and process data in various regions.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and their UK and Swiss equivalents) in our providers’ data processing terms, or on the provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, where it holds one. Contact us for more information about these safeguards.

10. Third-Party Links and Content

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

Some images in the app, such as team crests and TV show artwork, load directly from other websites, and Google sign-in on rivory.app loads a script from Google. Those sites receive your IP address and basic device or browser information when they load.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the “Last updated” date at the top of this page and, where appropriate, via email or an in-app notice. Your continued use of the Service after any changes indicates your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at support@kleoslabs.dev.