Rivet privacy policy

Most of what you add to Rivet stays on your devices and in your own iCloud. This policy explains what leaves them, who receives it, why, how long it’s kept, and the choices you have.

Rivet (“Rivet,” “we,” “us”) is a planning app for iPhone, iPad and Mac, made by James Whelan in Ireland. James Whelan is responsible for the personal information this policy describes, and you can reach him at support@rivetcal.app. By using Rivet, you agree to this policy.

The short version

Your to-dos, notes, projects, saved things and the rest of your timeline are kept on your device and synced through your own private iCloud database. Rivet’s server doesn’t keep a copy of them.
Your Apple Health data, medications and workouts are not synced through iCloud. If you turn on Show on your Mac, your health data and medications go to your Mac end-to-end encrypted.
If you turn on Ask’s answers (Claude, made by Anthropic), the features that use Claude send Anthropic what they need, through Rivet’s server. Nothing goes to Anthropic before you choose Allow.
Claude, film and show search, Trakt, Fitness’s exercise videos and suggested workouts, your health on your Mac, and quick Google Calendar updates go through Rivet’s server, so they need a Rivet sign-in. Everything else works without one.
The app has no ads and no third-party analytics or advertising code. To measure its own App Store ads, Rivet sends a few dates and Apple’s attribution token, never what you add.
This website loads Google Analytics only after you allow it.
Rivet changes your calendars and reminders only when you add, edit, complete, move or delete something in Rivet or through Siri, or tap Add, Apply or Use in Ask.
We don’t sell your information.

How your data is stored

Rivet keeps what you add in its storage on your device, and most of Rivet works with no network connection. To keep your iPhone, iPad and Mac in step, it syncs your to-dos, notes and their attachments, projects, saved things, what you’ve watched, your listening and viewing summaries and your lists through your private iCloud database. Apple stores this under its iCloud terms. Rivet’s server can’t read it and keeps no copy.

Some things are never synced through iCloud: your Apple Health data, your medications and doses, your workouts and training, your conversations in Ask, and Rewind’s written stories. They stay on the device where they were made, except your health data and medications when you turn on Show on your Mac (see Apple Health below). If you used Rivet before 16 September 2026, when it stopped syncing medications and health summaries through iCloud, an older copy of them can remain in your private iCloud data. Deleting your account removes it.

Website analytics

Rivet’s website can use Google Analytics to measure page visits, referral sources, and clicks that lead to the App Store. Google Analytics does not load until you choose Allow analytics. If you choose No thanks, no Google Analytics request is made and the website works normally.

After you allow analytics, Google may set first-party analytics cookies such as _ga in your browser. We disable advertising signals and do not use this information for advertising or cross-site tracking. You can change your choice at any time through Analytics settings in the website footer. Withdrawing consent stops future measurement and removes Rivet’s Google Analytics cookies from your browser.

You can use Rivet without signing in. Some features go through Rivet’s server, which has to know whose request it is, so they need you to sign in with Sign in with Apple or Google: Claude, film and show search, Trakt, Fitness’s exercise videos and suggested workouts, your health on your Mac, and quick Google Calendar updates. Google Calendar and Meet connect with your Google account from Rivet’s Settings. We use your sign-in only to identify your account and provide the features you ask for, never for advertising or tracking.

For a signed-in account, Rivet’s server stores an account identifier, hashed Apple or Google sign-in identifiers, installation and session identifiers, and, encrypted, the provider tokens a feature needs, such as the Sign in with Apple token it uses to revoke that sign-in when you delete your account. It doesn’t store your name or email address. If you link Apple and Google, we keep their identifiers together so either sign-in reaches the same Rivet account. We do not combine accounts merely because their email addresses match. Linking Rivet sign-ins does not merge separate Apple iCloud libraries.

Like any server, Rivet’s server sees your device’s IP address with each request. It uses the address only to limit how many requests can come from one place in a minute, and doesn’t store it with your account.

How Rivet measures its own ads

Rivet advertises on the App Store with Apple Ads. To learn which ads bring people who use Rivet, the app on iPhone and iPad sends Apple’s attribution token after its first launch, with a random ID made for this install, to Rivet’s server, which asks Apple about it. Apple tells us the campaign, ad group, keyword and ad that led to the install, if any, and the country or region and the date of the tap.

The app also sends the date it was first opened, and the date and kind (event, to-do or note) of the first thing you add. Never what you added, and never a time. When you sign in, the install’s ID is linked to your account, so we can count how many of the people an ad brought went on to start a trial or buy Rivet. We only look at totals per campaign. Rivet on the Mac sends none of this.

Rivet doesn’t use your device’s advertising identifier, doesn’t ask to track you, and shares none of this with anyone.

Claude by Anthropic (optional)

Some Rivet features use Claude, an AI model made by Anthropic. The first time a feature could use Claude, Rivet asks: “Turn on Claude?” Nothing goes to Anthropic until you choose Allow, and one answer covers every feature below. Claude works only while you’re signed in to Rivet. To stop, turn off Ask’s answers in Rivet’s Settings. Without Claude, Rivet uses what your device can do on its own, including Apple Intelligence where your device has it.

Each feature sends Anthropic only what it needs:

Ask: what you type or say, Rivet’s own reading of it, any pictures and PDFs you add, today’s date, and the names of your lists and projects. To answer a question about your own things, Rivet finds the matching events, to-dos and notes on your device and sends up to 10 of them, each as a short snippet. Asking about a workout also sends its exercises, sets and reps. Sometimes Rivet also sends your previous message and its reply, but never when either names something of yours.
Meeting write-ups: the transcript, the meeting’s title and date, and the names of the attendees on its calendar event.
Rewind stories: a summary of the week, month or year: the titles of what you watched, listened to, read, cooked or went to; how many workouts you did and for how long; how many to-dos you finished, and how many in each project; and the titles and text of your meetings and notes. Nothing from Apple Health.
Saved: an article’s title, site and text, to summarise it; and the titles of what you’ve saved but not read, with any summaries Rivet already made, and of what you saved or finished lately, to pick what to read next.
Project plans: the project’s name, notes, start date and deadline, its to-dos, and your busy times with their event titles.
The Fitness coach: your message, sometimes your previous message and its reply, your training level, your equipment, the exercises you avoid, how many workouts you’ve done this week, the days you trained in the last 2 weeks, the workout you’re changing, and a short list of exercises to choose from. Nothing from Apple Health.

Every request also carries your language and time zone, and goes through Rivet’s server with your account’s token. Rivet doesn’t send Anthropic your name, email or account details. Rivet’s server doesn’t keep what you sent or Claude’s answer. It keeps, with your account ID, a count of what each request cost, and, for 30 days, a record of each Ask request with the action Claude chose and its short details, such as the date you named or the words to look for, so that a repeated request isn’t sent twice.

Under its commercial terms, Anthropic doesn’t train its models on what Rivet sends. It deletes it within 30 days, unless it must keep it longer to enforce its Usage Policy or by law (Anthropic’s retention policy).

Your AI (optional)

You can connect your own AI, such as ChatGPT or Claude, in Rivet’s Settings under Your AI. You approve each connection on your phone.

A connected AI can only add things: to-dos and events, steps for your projects, and things to save for Anytime. It can’t see your calendar, your to-dos, your projects, your notes, or anything else in Rivet.

What your AI sends is locked on arrival with keys that only your devices hold, so Rivet’s server can’t read it. It’s deleted once you’ve added or dismissed it, or after 14 days. Your AI’s own company handles your chat under its privacy policy.

When you use Ask your AI, Rivet opens your AI with the message already written. It goes from your phone straight to your AI; Rivet’s server never sees it.

To disconnect, turn your AI off in Settings, under Your AI. Its access ends at once, and anything waiting for you is deleted.

Permissions you can grant

Each of these is optional, asked for in context, and can be turned off in your device’s Settings app:

Apple Calendar: to show your events, and to add, change, move or delete the events you ask Rivet to.
Apple Reminders: to import the reminders you choose and to send to-dos to Reminders. A to-do that came from or went to Reminders stays linked: completing, moving or deleting it in Rivet does the same to the reminder.
Contacts: to suggest names and email addresses when you invite people to events.
Notifications: to remind you of timed to-dos, medication doses, rest between sets and meetings that are starting, and to tell you when your trial ends.
Microphone and Speech Recognition: to record a meeting you start and to turn what you say into text. Meetings are transcribed on your device. Other speech is too where your language allows; otherwise Apple’s speech recognition service does it.
Camera and Photos: to take a photo for a note or scan a page for Ask, and to save an image to your photo library when you choose Save Image.
Location: to follow the sun where you are, to set an event’s location to where you are, and to sort saved places by distance. Rivet doesn’t send your location to its server. Place searches go to Apple Maps.
Apple Health: to show your sleep, activity, heart rate, workouts and medications beside your schedule, and, in Fitness, to suggest how hard to train. Rivet reads only the categories you approve. If you use Fitness and allow it, Rivet also saves the workouts you finish to Apple Health. Your health data stays on your device: Rivet doesn’t sync it through iCloud or send it to Anthropic. If you turn on Show on your Mac (Settings › Your Mac), Rivet sends your health data and medications from your iPhone or iPad to your Mac through Rivet’s server, end-to-end encrypted: they’re encrypted on your device with a key only your devices hold, and the server stores only the encrypted copy, which it can’t open. Adding a Mac needs a fresh Sign in with Apple, and both devices show a six-digit code to compare. One limit, until we change how pairing works: that code wouldn’t stop someone who had taken control of Rivet’s server from pairing a key of their own in place of your Mac’s.
Apple Music: to count what you play and show it on Today and in Rewind. Your listening summaries sync through your iCloud, and if you allow Claude, Rewind stories send Anthropic the titles of what you played.
Google Calendar & Meet: to show your Google events, and to create and change events and Meet links when you ask (see Google data below).

Google data

When you connect Google, Rivet’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use Google Calendar data only to provide the calendar and Meet features you ask for. We don’t sell it, use it for advertising, or use it to train AI models.

Your Google Calendar events go straight between your device and Google; they don’t pass through Rivet’s server. So that changes reach your device quickly, Google tells Rivet’s server when one of your calendars has changed, never what changed, and the server asks Apple to wake Rivet on your device. For this, the server keeps your device’s notification token and the details of that channel. If you allow Claude, your Google events can be among what Ask and project plans send to Anthropic, as described above, and Anthropic doesn’t train on them.

Trakt viewing data

When you connect Trakt, Rivet’s server exchanges the viewing information needed for your watch history, watchlist, viewing summaries and recommendations with Trakt, and keeps your Trakt tokens, encrypted, so it can do so. Trakt associates this information with the Trakt account you connected and keeps it under Trakt’s terms and privacy policy. Disconnecting Trakt in Rivet’s Settings, or deleting your Rivet account, asks Trakt to revoke Rivet’s access and deletes the tokens from Rivet’s server. You can manage or delete the viewing data Trakt holds from your Trakt account.

Films, shows, books, music and links

When you look for a film or show, or save one, Rivet’s server sends the words you searched for, or the title’s ID, to TMDB (The Movie Database) and OMDb, without your account details. Book searches go from your device straight to Open Library, and the cover of music you save is looked up with Apple’s iTunes Search, also straight from your device. Posters and covers load from TMDB’s, Open Library’s and Apple’s image servers, and from the site a saved link comes from. When you save a link, Rivet opens the page to read its title, picture and text, as your browser would. Like any website, these services see your device’s IP address.

Fitness’s exercises and workouts

Fitness’s exercise library, its exercise videos and the workouts it suggests come from YMove. Rivet’s server asks YMove for them without your account details; for a suggested workout, it sends only the muscle groups, equipment, level and length you chose. Exercise videos download to your device from YMove’s video service, which sees your device’s IP address. Your workouts stay on your device, apart from the ones you save to Apple Health and the counts described under Claude above.

Purchases

Rivet is one purchase through Apple, after a free 3-day trial. Apple processes your payment; we never see your card details. When you’re signed in, Rivet’s server receives from Apple, and keeps with your account, the Apple transaction IDs, the product (the trial, Rivet, or a plan bought earlier) and whether it is active, expired or refunded, so your access follows you to each device you sign in on. If you test Rivet through TestFlight, the server records a week of test access for your install.

What we do not do

We don’t sell your personal information.
We don’t show ads or use cross-app or cross-site advertising profiles.
The Rivet app doesn’t embed third-party advertising or analytics SDKs.
The website doesn’t load Google Analytics unless you allow it.

Service providers

We share information only with the providers that make a feature you use work, and only for that purpose:

Apple: Sign in with Apple, App Store purchases and the trial, Apple Ads attribution, your private iCloud sync, push notifications, Apple Maps place searches, speech recognition where your language has no on-device model, App Attest checks when you add a Mac, iTunes Search for music covers, and Health, Music, Calendar and Reminders on your device.
Google: Google sign-in, Google Calendar and Meet, and, only if you allow it, this website’s analytics.
Anthropic: the Claude features you allow, as described above.
Trakt: your viewing history and watchlist, if you connect Trakt.
TMDB and OMDb: the words or IDs of the films and shows you look for or save, sent by Rivet’s server without your account details, and the posters TMDB’s image server sends to your device.
Open Library: the words of the books you look for, and their covers, straight from your device.
YMove: Fitness’s exercises, videos and suggested workouts, asked for by Rivet’s server without your account details, with videos downloaded to your device.
Vercel: hosts this website and Rivet’s server, so it handles every request to them, including your device’s IP address.
Neon: hosts Rivet’s account database, which holds what this policy says Rivet’s server keeps.

We require the providers that handle Rivet data for us to protect it consistently with this policy and applicable law. Apple, Google, Trakt, TMDB, OMDb, Open Library and YMove also handle what they receive under their own terms and privacy policies.

Why we can use your information

To provide Rivet and the features you choose, such as sign-in, sync, purchases, connected services, Fitness and your health on your Mac: because it’s needed to provide the app you asked for under our terms of use.
Claude, Apple Health and website analytics: your consent, which you can withdraw at any time in Rivet’s Settings, your device’s Settings or the website footer. For health data, it’s your explicit consent, given through Apple’s Health permission and the Show on your Mac question.
Keeping Rivet secure and measuring its own App Store ads in totals: our legitimate interests in protecting the service and knowing which ads work. You can object by emailing us.
Keeping purchase and deletion records where the law requires it: our legal obligations.

Data retention

On your devices and in your iCloud: until you delete it in Rivet, delete your account, or remove the app and its iCloud data.
On Rivet’s server: your account, sign-in identifiers, purchase records, encrypted provider tokens, your device’s notification token, the encrypted copies for your Mac and your Claude cost counts are kept until you delete your account. Ended sessions are deleted after 30 days, and Ask request records after 30 days. Ad measurement records are kept against the install’s random ID, with no link to you unless you sign in; if you did, deleting your account deletes them.
At Anthropic: deleted within 30 days, as described above.
At other providers: Apple, Google (including Google Analytics), Trakt and Vercel keep information under their own policies.

Removing the app does not by itself erase your private iCloud library or your Rivet account. Account deletion removes Rivet’s account and everything its server keeps for it: linked sign-in identifiers, sessions, purchase records, provider tokens, the encrypted copies for your Mac, Ask request records and the ad measurement records of the installs you signed in on. Its Claude cost counts are kept only inside monthly totals with no account attached. We keep a deletion receipt containing hashed request proofs, without your content or a plaintext account identifier, so an interrupted deletion can be safely retried. Deleting your Rivet account does not cancel an earlier Apple subscription or erase Apple’s own purchase records.

Your rights and choices

Delete your account: in Rivet’s Settings, tap your account at the top, then Delete account. This removes your Rivet account and its data on Rivet’s server, and your Rivet data in the private iCloud database connected to the app, including notes and attachments. It also clears Rivet’s local store, preferences, app-group data, account Keychain items, notifications and search entries, revokes Sign in with Apple, disconnects Google, and asks Trakt to revoke Rivet’s access. Deletion needs access to that iCloud account and the network; an interrupted deletion stays pending and is tried again. It doesn’t delete unrelated iCloud data or events held by your calendar providers.
Export your data: in Rivet’s Settings, tap your account, then Export your data to save a copy of what Rivet holds on your device.
Permissions: grant or revoke Calendar, Reminders, Contacts, Notifications, Microphone, Speech Recognition, Camera, Photos, Location, Health and Music access in your device’s Settings; disconnect Google or Trakt, and turn off Show on your Mac, in Rivet’s Settings.
Turn off Claude: turn off Ask’s answers in Rivet’s Settings at any time.
Website analytics: choose Analytics settings in the website footer to allow or refuse Google Analytics.
Depending on where you live, laws such as the GDPR or the CCPA give you the right to access, correct, delete, restrict, move or object to the use of your data, and to withdraw your consent. Email us to use them. You can also complain to a data protection regulator; in Ireland, that’s the Data Protection Commission. We do not sell personal information or use it for cross-context behavioral advertising.

Children

Rivet is not directed to children under 13 (or under the minimum age required in your country), and we don’t knowingly collect their information.

Security

We use reasonable measures to protect your information, including encryption in transit for anything that leaves your device and encryption of the provider tokens Rivet’s server keeps. No method of storage or transmission is completely secure, so we can’t guarantee absolute security.

International transfers

Rivet’s server and many of the providers above process information in the United States and other countries outside the European Economic Area. Where required, we put appropriate safeguards in place for those transfers. Email us for details.

Changes to this policy

We may update this policy as Rivet evolves. We’ll change the “last updated” date above and, for material changes, give you notice in the app.

Contact

Questions about privacy? Email us at support@rivetcal.app.