Privacy Policy

Riff is an AI music-generation service ("Riff," the "App," "we," "us," or "our"), available as an app for iPhone and as a web app at theriff.app. Riff is operated by OneClick Commerce LLC (the "Company"). This Privacy Policy explains what information Riff handles, how we use it, and the choices and rights you have.

1.Who we are

This policy applies to the Riff iOS app, the Riff web app at theriff.app, and the pages under our website. By downloading or using Riff on any platform, you acknowledge the practices described here. If you do not agree, please do not use the App.

OneClick Commerce LLC is the data controller for the information described here — the company that decides why and how it is processed — and is reachable at:

OneClick Commerce LLC
hey@theriff.app

We do not use your content to train AI models. We do not sell personal information, we run no advertising, and we have no interest in building a profile of you — Riff makes money from subscriptions and credits, which is the whole business model.

2.Accounts: optional on iOS, required on the web

On iOS, Riff does not ask you to sign up. You do not create a username and password, and you do not give us your email, phone number, or real name to use the iOS app. When you first open Riff, the App creates an anonymous identifier that is stored on your device and used to keep your credits and subscription attached to you across launches. This identifier is not linked to your real-world identity, and we do not attempt to re-identify you from it.

You can optionally create a Riff account — with an email address and password, Sign in with Apple, or Google — to keep your library safe beyond a single device. One account syncs your songs, credits, and subscription across the iOS app and the web app. If you forget your password, recovery works by a one-time code sent to your account email.

The web app requires an account. You can browse pages at theriff.app without one, but you must sign in to generate music, so that your songs and credits have somewhere to live.

Any display name, @username, or profile photo you set is optional and, by default, is stored only on your device — we do not receive it on our servers.

3.Information we collect

a. Content you create with, and provide to, the App

• Prompts and creative inputs — the text descriptions, moods, genres, style tags, and lyrics you type or generate to make a song.
• Voice recordings — if you use voice features, the microphone recordings you make so a song can be sung in a voice you create (see Section 5).
• Images you choose — if you pick a photo from your library to use as cover art or a profile picture, that image is processed to create your cover or avatar.
• Songs and cover art generated for you — the finished audio, lyrics, and artwork Riff produces from your inputs.

b. Account information (only if you create an account)

If you create a Riff account, we collect your email address and a hashed form of your password, or — if you use Sign in with Apple or Google — the identifier and email address those providers share with us to sign you in. We use your email to authenticate you, to send one-time codes for password recovery, and to respond when you contact us. If you use Riff anonymously on iOS, none of this applies — we hold no email or name for you.

c. Information stored to keep your library durable

So your library isn't lost if you change or reinstall, we store a minimal copy of your song details (such as title, lyrics, style description, tags, duration, and a reference ID) and your generated cover art on our backend, associated with your anonymous identifier or your account — never shared with anyone else, and for anonymous users never linked to a name or email.

d. Purchases, subscriptions & credits

On iOS, transactions are processed by Apple through in-app purchase. We do not receive or store your credit-card number. We receive from Apple a signed receipt confirming your purchase so we can activate your subscription and grant credits.

On the web, payments are processed by Stripe through Stripe-hosted checkout. Your card details are entered directly with Stripe — we never see or store your card number. We receive only transaction metadata from Stripe (such as the product purchased, amount, currency, transaction identifiers, and payment status) so we can activate your subscription or add the credits you bought.

On both platforms we store your current credit balance and subscription status, associated with your anonymous identifier or your account.

e. Information collected automatically

To operate and secure the service, we and our infrastructure providers process a limited amount of technical information, such as your anonymous identifier or account ID, app version, general request logs, and error/diagnostic signals. The website and web app use privacy-respecting, aggregate analytics that do not track you across other sites. In the iOS app we use the Apple-provided app-privacy manifest and do not track you across other apps or websites.

What we do not collect: We do not collect your contacts, precise location, browsing history on other apps, or advertising identifiers. Riff contains no third-party advertising SDKs and no analytics trackers that identify you, and we do not buy or sell personal information.

4.Cookies & similar technologies

The web app uses cookies, but only to keep you signed in. When you sign in at theriff.app, we set a small number of strictly necessary cookies that hold your session so you are not asked to log in on every page, and that protect the sign-in flow against cross-site attacks. These are set by us and by our authentication provider, Supabase. They are essential to a service you asked for, so we do not ask for consent to use them — but you can clear or block them in your browser at any time, with the consequence that you will be signed out and unable to generate music.

We set no advertising, profiling, or cross-site tracking cookies. Our website and web app use Vercel Web Analytics, which counts page views without cookies and without any identifier that follows you to other sites; we see aggregate figures, not individuals. There are no third-party advertising SDKs, no pixels, no session recorders, and no data brokers anywhere in Riff. The iOS app uses no tracking technologies and does not request App Tracking Transparency permission, because it has nothing to track you with.

Because we use no non-essential cookies, you will not see a cookie consent banner on our sites. If that ever changes, we will ask for your consent before setting anything that requires it.

5.Voice recordings & voice cloning

Riff offers optional features that let you create a synthetic voice from short microphone recordings, so songs can be sung in that voice. Because voice data is sensitive, we treat it with particular care:

• Consent. Voice recording only happens when you actively choose to record and grant microphone permission. You can withdraw permission at any time in iOS Settings or your browser's site settings.
• Purpose. Your recordings are used solely to validate and create a synthetic voice model and to generate songs you request. We do not use your voice to identify you, to build advertising profiles, or for any purpose unrelated to the feature you asked for.
• Processing. Recordings are transmitted to our AI generation provider (see Section 7) to produce the voice model. A reference to your resulting voice is stored on your device so you can reuse it.
• Retention. We retain your voice recording and the derived voice model only as long as needed to provide the feature. Creating a new voice replaces the previous one, and deleting your data in the App removes the voice reference from your device. You may also email us to request deletion of any associated server-side data.
• Your responsibility. You may only create a synthetic voice from your own voice, or from a voice you have explicit permission to use. Cloning another person's voice without consent, or using synthetic voice to impersonate or deceive, is prohibited by our Terms of Use.

If you are located in a jurisdiction with specific biometric-privacy laws, note that we do not use voiceprints for identification and do not sell, lease, or trade voice data. Where such laws apply, this section serves as our notice of collection, purpose, and retention schedule for that data.

6.How we use information

We use the information described above to:

• Generate the songs, lyrics, cover art, and voices you request;
• Create, secure, and maintain your account (if you have one), and sync your library, credits, and subscription across the iOS app and the web app;
• Keep your library durable and restore it across app launches and reinstalls;
• Track and apply your credits, purchases, and subscription entitlements;
• Provide customer support, handle refund requests for web purchases, and respond to your requests;
• Detect, prevent, and respond to abuse, fraud, security incidents, and violations of our Terms — including reviewing content that is reported to us;
• Maintain, debug, and improve the App; and
• Comply with law and enforce our agreements.

We rely on the following legal bases where required (e.g., under GDPR): performance of a contract (to provide the App you request), consent (e.g., microphone access and voice features), legitimate interests (to secure and improve the service and prevent abuse), and legal obligation.

7.AI processing & the third parties who help run Riff

Riff itself does not build the underlying generative models. To create your content and run the service, we share the minimum necessary information with the service providers below, who act on our behalf and are bound to use it only to provide their services to us:

We describe our AI model providers by category rather than naming them, because the models behind Riff change as the technology does. If you want to know which providers process your information, email us at hey@theriff.app and we will tell you.

Each provider maintains its own privacy and security practices. We take reasonable steps to ensure these providers protect your information consistently with this policy. We do not permit them to use your information for their own independent purposes such as advertising.

8.How your information is shared

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

• Service providers — the vendors in Section 7, acting on our instructions.
• Legal and safety — when we believe in good faith that disclosure is required by law, legal process, or to protect the rights, safety, or property of Riff, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your direction — when you choose to export or share a song you created (for example, saving to Files, sharing to another app, or creating a share link that makes that song viewable by anyone with the link), that action is under your control.

9.Where your data lives & security

On iOS, your primary library is stored locally on your device, with the limited backup described in Section 3 stored with our backend provider. If you create an account, your library is stored with our backend provider so it can sync across your devices and the web app. We protect information in transit using industry-standard encryption (HTTPS/TLS), route all AI requests through a secured server-side proxy so third-party keys never ship inside the App, and apply access controls scoped to your anonymous identifier or account. Web payments take place on Stripe's hosted checkout pages — your card details go to Stripe, not to our servers.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for protecting the device on which your Riff library is stored and, if you have an account, for keeping your login credentials confidential.

If something goes wrong. If we discover a breach affecting your personal information, we will investigate, take steps to contain it, and notify you and the relevant regulators where the law requires it — under the GDPR that means notifying the supervisory authority within 72 hours of becoming aware, and notifying you without undue delay where the risk to you is high. If you think you have found a security problem in Riff, please tell us at hey@theriff.app; we will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

10.Retention & deleting your data

We keep information only as long as needed for the purposes in this policy, to comply with legal obligations, resolve disputes, and enforce our agreements. In practice that means:

• Your account, songs, and credit balance — until you delete them, or until an account has been inactive long enough that we retire it, whichever comes first. Deletion is immediate in the live system; encrypted backups roll off within 30 days.
• Voice recordings and voice models — only while the feature is in use. Creating a new voice replaces the previous one, and deleting your data removes it.
• Transaction records — receipts, amounts, dates, and refund history are kept for as long as tax, accounting, and anti-fraud law requires, generally seven years. See the note below.
• Security and request logs — a short rolling window, typically 30 days, then discarded or aggregated beyond recognition.
• Content reports and enforcement records — as long as needed to act on the report, to keep a banned user out, and to defend the decision if it is challenged.

You are in control. On iOS, go to Settings → Privacy & Data → Delete My Data. On the web, use the delete option on your account page. Deleting your account removes your account, your songs, your shared links, and your credits from both the iOS app and the web app. If you use Riff anonymously and would like us to delete backup information associated with your anonymous identifier, or any voice data, email us at hey@theriff.app and we will act on your request as required by applicable law.

What deletion cannot remove. We are legally required to keep records of purchases and refunds, so a minimal transaction history — what was bought, when, for how much, and whether it was refunded — survives account deletion, held separately from your creative content and used only for accounting, tax, and fraud purposes. Stripe and Apple keep their own records of your payments under their own policies. Songs you shared or exported before deleting, and copies other people already downloaded, are outside our reach.

Note: deleting your data or account does not cancel a paid subscription. Apple subscriptions are managed through Apple (your device's Settings → Subscriptions); web subscriptions should be cancelled via Manage billing on your account page (see the Terms of Use).

11.Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. If you use Riff anonymously on iOS, we often hold no information that identifies you personally; where that is the case, we may be unable to associate a request with a specific person, and we may ask you to exercise your controls directly in the App. If you have a Riff account, we can verify and act on requests made from your account email.

United States (including California)

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) or similar state laws, and we do not use sensitive personal information (such as voice data) for purposes requiring a right to limit. California residents and residents of other U.S. states with privacy laws may request access or deletion and will not be discriminated against for exercising these rights. You may use an authorized agent to make a request on your behalf; we will ask for proof that you authorized them, and for enough information to confirm the request is really yours.

EEA / UK

If you are in the European Economic Area or the United Kingdom, you may exercise the GDPR rights described above and have the right to lodge a complaint with your local supervisory authority.

To exercise any right, contact us at hey@theriff.app. We may need to verify your request — via your account email if you have an account, or to the extent possible given the App's anonymous design if you do not.

12.International data transfers

We and our service providers may process information in the United States and other countries where our providers operate. These countries may have data-protection laws that differ from those in your country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

13.Children's privacy

Riff is not directed to children under 13, and we do not knowingly collect personal information from them. In the European Economic Area and the United Kingdom, where the minimum age for consenting to online services on your own is set locally between 13 and 16, a user below that age needs the consent of a parent or guardian. If you believe a child has provided us information, contact us at hey@theriff.app and we will delete it. The iOS app is rated and offered consistent with the App Store age rating shown on its product page, and the same age requirements apply to the web app.

14.Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide a more prominent notice in the App or on this page. Your continued use of Riff after an update means you accept the revised policy.

15.How to contact us

Questions, requests, or concerns about privacy? Contact us at:

Riff — OneClick Commerce LLC
Email: hey@theriff.app