Privacy Policy
Last updated: October 11, 2026
Rivo is an iOS app that estimates your body composition from photos and helps you reach a fitness goal. This policy explains what we collect, why, who helps us process it and how you can delete it.
In this policy “Rivo”, “we” and “us” mean the operator of the Rivo app and the rivoai-app.com website. You can reach us at [email protected].
The short version
- We collect only what the app needs to work: your account, the photos you take for a scan, the profile and health data you choose to share, and what you log.
- Your body photos are never public. They are stored on our servers and shown only to you, through short-lived private links.
- We do not sell your data. Apple Health data is never used for advertising or shared with advertisers.
- You can delete your account in the app at any time (Settings → Delete account).
What we collect
Account
You sign in with Apple. We receive a unique Apple user identifier and, if you allow it, your name and email address (which may be an Apple private relay address). We do not receive your Apple ID password.
Body scan photos
When you run a scan, you take or upload photos of your body. We use them to estimate body composition and measurements, to check that a photo is suitable for a scan, and to generate a picture of your possible future shape. The photos and generated images are stored so you can see your progress over time.
Profile and goals
Gender, age, height, weight, your goal, training preferences, available equipment and app settings such as units and language.
Apple Health
Only with your permission, the app reads steps, active energy, walking and running distance, weight, height, body fat percentage, dietary energy and water from Apple Health, and writes your weight and water intake back to it. You can change these permissions at any time in the Health app. Health data is used only to provide the app’s features, is never used for advertising or marketing, and is never sold or shared with advertisers or data brokers.
What you log
Meals (including meal photos you take for recognition and barcodes you scan), water, measurements, workouts and activities, and your conversations with the in-app AI coach.
Purchases
Subscriptions in the app are processed by Apple. We receive the transaction details needed to unlock premium features (product, status, renewal and expiry dates), not your payment card. If you subscribe on our website, the payment is processed by Stripe and we likewise do not receive your full card details.
Device and technical data
A push notification token (if you allow notifications), device model, operating system version, app version, language and basic server logs such as IP address and request time, which we keep for security and troubleshooting.
Advertising attribution
To understand which ads bring people to Rivo, we report a few in-app events — starting a trial, a purchase and a subscription renewal — to Meta (Facebook and Instagram) from our server, together with device model, OS version and language. If you allow tracking in the iOS “Allow apps to track” prompt, we also include your device’s advertising identifier (IDFA); if you decline, we do not. We never send photos, health data or the content of your logs to advertising partners.
How we use your data
- To provide the app: scans, goals, plans, nutrition and activity tracking, the AI coach and progress charts.
- To manage your account and subscription.
- To send reminders and updates you have enabled.
- To keep the service secure, prevent abuse and fix problems.
- To measure the effectiveness of our advertising, as described above.
Where the law requires a legal basis, we rely on performing our contract with you (providing the app), your consent (Apple Health access, notifications, tracking, processing of photos and health-related data), and our legitimate interest in keeping the service secure and improving it.
AI processing
Rivo uses artificial intelligence services provided by OpenAI to analyse body scan and meal photos, generate goal images and power the AI coach. The photos and text needed for each request are sent to OpenAI for processing. Under OpenAI’s API terms, data sent through the API is not used to train their models. Results are estimates, not medical measurements — see our Terms of Use.
Who processes your data
We share data only with service providers that help us run Rivo, and only what each of them needs:
| Provider | Purpose | Data |
|---|---|---|
| DigitalOcean | Server hosting (Netherlands, EU) | All app data stored by us |
| Cloudflare | Network security and delivery | Traffic passing to our servers |
| OpenAI | AI analysis and coaching | Scan and meal photos, profile context, coach messages |
| Apple | Sign in, in-app purchases, push notifications | Account identifier, transactions, push token |
| Stripe | Website payments | Payment and billing details |
| Meta | Ad attribution | Purchase events, device info, IDFA if allowed |
| Open Food Facts | Product lookup by barcode | The barcode only |
We may also disclose data if required by law or to protect the rights and safety of our users and of Rivo. If Rivo is involved in a merger or acquisition, your data may be transferred as part of it, subject to this policy.
International transfers
Our servers are in the European Union. Some providers, such as OpenAI, Apple, Stripe and Meta, may process data in the United States or other countries. Where required, these transfers rely on appropriate safeguards such as standard contractual clauses.
How long we keep data
We keep your data while your account is active. When you delete your account, we erase your profile, photos, scans and logs within 30 days; until then, signing in again with the same Apple ID restores them. Server logs are kept for a limited time for security. We may keep records of transactions where the law requires it.
Your rights and choices
- Delete your account: in the app, Settings → Delete account.
- Apple Health, notifications, camera, photos and tracking: change these at any time in iOS Settings or the Health app.
- Access, correction, export or objection: write to [email protected]. Depending on where you live (for example in the EU, UK or California), you may have additional rights under local law, including the right to complain to a data protection authority.
We will answer requests within 30 days and may ask you to confirm you own the account.
Security
Data is encrypted in transit. Body photos are stored privately and are available only through signed links that expire. Access to our servers is restricted to a small number of authorised people. No system is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires it.
Children
Rivo is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
Changes
We may update this policy. We will change the date at the top and, for significant changes, let you know in the app.
Contact
Questions about privacy: [email protected].