Riff Privacy Policy

1. Information We Collect

1.1 Account Information

When you create a Riff account, we collect:

• Authentication identifiers from Apple Sign-In (such as your Apple user ID and, if you choose to share it, your email address) or from email-and-password sign-up.
• Your email address, used to send a one-time confirmation code during sign-up and to identify your account.
• Display name (if provided through Apple Sign-In).

We do not require or store your real name, postal address, or phone number.

1.2 Song Inputs

To generate chord charts, you can provide content in three ways. We collect the following depending on which path you use:

• Links to videos. When you submit a link from a supported video platform, we collect the link itself and process the audio from that source to identify chords and lyrics.
• Camera-roll uploads. When you choose to upload a video from your camera roll, we collect the audio from that video together with any title and artist you supply on the upload form.
• Song identification via microphone. When you use the song-identification feature, your device captures a short audio sample and sends it to Apple's ShazamKit service to match against Apple's catalog. We receive only the resulting song identifier and metadata returned by Apple. We do not store the captured audio.

1.3 Tuner Audio

The in-app tuner uses your microphone to detect pitch in real time. Tuner audio is processed entirely on your device. Nothing captured by the tuner is recorded, stored, or transmitted off your device.

1.4 Generated Charts and Catalog

When Riff produces a chord chart from your input, we store:

• The generated chord chart and synced lyric data.
• Associated metadata such as title, artist, source platform, and thumbnail image (where available).

Charts produced from public video links are added to a shared community catalog so other Riff users can access them as well. Charts produced from camera-roll uploads are kept private to your account and are not visible to other users.

1.5 Activity and Usage

We collect a record of which songs you have played within the app and when, so we can show your “Continue Playing” list and provide a personalized experience.

1.6 Onboarding Responses

During the onboarding flow we ask a few optional questions about your guitar experience and preferences (e.g., what genres you enjoy, what you struggle with). These responses are kept on your device and are not associated with any external profile.

1.7 Subscription Information

If you subscribe to Riff Pro, we collect:

• Your subscription tier, status, and trial eligibility, managed through RevenueCat, our subscription management provider.
• Anonymized purchase events tied to a stable identifier so we can recognize your subscription across reinstalls and devices.

We do not directly collect or store your payment card details. All payment processing is handled by Apple through the App Store.

1.8 Device and Usage Information

We automatically collect basic technical data, including:

• Device type, operating system version, and app version.
• Crash logs, performance data, and general usage analytics.

1.9 Advertising and Measurement Data

Riff includes the Meta (Facebook) SDK to measure and attribute the performance of our advertising campaigns. Through this SDK we may collect and process:

• The device advertising identifier (IDFA), but only if you grant permission through Apple's App Tracking Transparency (ATT) prompt.
• App activity events, including app installs, app opens and sessions, and in-app product interactions.
• Subscription events, including when you start a free trial and when you subscribe, along with the price and currency of the plan.

This data is shared with Meta to measure and attribute our advertising, as described in Section 5. If you decline the ATT prompt, we do not collect your IDFA and do not use your data to track you across other apps or websites.

2. How We Use Your Information

We use the data we collect to:

• Generate chord charts and synced lyrics from the inputs you provide.
• Maintain the song catalog, search results, and your personal play history.
• Manage your account, subscription, and access to premium features.
• Improve the app's performance, stability, and quality of generated charts.
• Communicate with you about your account or important updates.
• Detect and prevent fraud, abuse, or violations of our Terms of Service.
• Measure and attribute the performance of our advertising campaigns, optimize ad delivery, and analyze app usage.
• Comply with legal obligations.

3. Audio Analysis and Chord Generation

When you submit a link or upload a video, Riff processes the resulting audio to identify chords and synchronize lyrics. This processing involves third-party AI service providers used internally for chord recognition and lyric transcription. Only the audio and minimal metadata necessary to perform the analysis are sent to these providers, and the providers act on our behalf under contractual obligations to protect your data.

We do not use your inputs to train our own AI models.

4. Sharing Your Information

We do not sell your personal data. We share information only with:

• Apple, for Sign in with Apple, App Store payments, and song identification through ShazamKit. Apple's handling of this data is described in Apple's privacy policy.
• Meta Platforms, Inc. (through the Meta/Facebook SDK), to measure and attribute the performance of our advertising campaigns, optimize ad delivery, and for analytics, as described in Section 5. Meta's handling of this data is described in Meta's Privacy Policy and the Meta Business Tools Terms.
• Cloud infrastructure providers that host our database and file storage and that operate our backend. These providers access your data only to perform services on our behalf.
• Subscription management providers (RevenueCat) that help us operate subscriptions, free trials, and entitlement checks across devices.
• AI processing partners as described in Section 3, used internally to perform chord recognition and lyric transcription.
• Legal authorities when required by law, to protect our rights, or to prevent fraud or abuse.
• In connection with a business transfer such as a merger, acquisition, or sale of assets, in which case we will notify you before your data is transferred.

5. Advertising, Attribution, and Tracking

We use the Meta (Facebook) SDK to attribute and measure the performance of our advertising campaigns, optimize ad delivery, and for analytics. How this works depends on the choice you make at Apple's App Tracking Transparency (ATT) prompt.

5.1 App Tracking Transparency

iOS presents an ATT prompt asking whether you allow Riff to track you across apps and websites owned by other companies. If you grant permission, the Meta SDK may access your device advertising identifier (IDFA) and share the events described in Section 1.9 with Meta to measure and attribute our campaigns, optimize ad delivery, and for analytics.

If you decline, attribution is performed in a privacy-preserving, aggregated way using Apple's SKAdNetwork. In that case we do not collect your IDFA and there is no user-level cross-app tracking.

5.2 Your Choice and Control

You can decline tracking at the ATT prompt, and you can change your decision at any time in iOS Settings → Privacy & Security → Tracking. Declining means we do not collect your IDFA or use your data to track you across other apps and websites.

5.3 Data Used to Track You

Per Apple's definitions, the following data types may be “used to track” you across apps and websites owned by other companies: your advertising identifier (IDFA), purchase history, and product interaction (usage) data. This tracking only occurs if you grant permission through the ATT prompt.

6. Data Storage and Security

Your data is stored on cloud servers located in the United States. We use access controls to ensure that private content (such as your account information, play history, and camera-roll uploads) is only accessible to you. Generated chord charts produced from public sources are accessible to authenticated Riff users.

We use reasonable technical and organizational safeguards to protect your data, but no system is completely secure. Please use strong passwords and notify us at ian@razelabs.app of any suspected unauthorized access.

7. Data Retention and Deletion

We retain your data for as long as your account is active and as needed to provide the service.

You can delete your account at any time from Settings → Delete Account within the app. When you delete your account, we permanently remove:

• Your account credentials and sign-in identifiers.
• Your personal play history.
• Active sessions on every device.

Chord charts you contributed to the public catalog remain available to other Riff users with your attribution cleared.

You may also request deletion of any specific data by contacting us at ian@razelabs.app.

Some data may be retained in encrypted backups for a limited period before being permanently deleted, as required for fraud prevention and legal compliance.

8. Your Rights and Choices

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Delete your personal data.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent where we rely on it as a legal basis.

To exercise these rights, contact us at ian@razelabs.app. We may need to verify your identity before fulfilling your request.

9. Children's Privacy

Riff is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has created an account, contact us at ian@razelabs.app so we can remove it.

10. International Data Transfers

We operate in the United States and your data is processed and stored in the US. If you are located outside the United States, your data will be transferred to the US for processing. By using Riff, you consent to this transfer.

11. California Privacy Rights

If you are a California resident under the California Consumer Privacy Act (CCPA), you have the right to:

• Know the categories of personal information we collect and how we use it.
• Request access to or deletion of your personal information.
• Not be discriminated against for exercising your rights.
• Opt out of the “sharing” of your personal information for cross-context behavioral advertising.

We do not sell your personal information for money. However, if you grant permission through the App Tracking Transparency prompt, our use of the Meta SDK (described in Section 5) may involve “sharing” certain information, such as your advertising identifier (IDFA), purchase history, and product interaction data, for cross-context behavioral advertising as those terms are defined under California law. You can opt out of this sharing at any time by declining the ATT prompt or turning off tracking in iOS Settings → Privacy & Security → Tracking. To exercise these rights, contact us at ian@razelabs.app.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by updating the “Last updated” date above. Continued use of Riff after changes take effect means you accept the revised policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or your data, contact us at:

Raze Labs, LLC
Seattle, Washington, USA
ian@razelabs.app