Privacy Policy

Rinora · Last updated: July 22, 2026

This Privacy Policy describes how Rinora ("we", "us", or "the App") handles your information when you use our iOS application. We built Rinora to be privacy-first and local-first: every feature works without an account, your notes live on your device by default, and the data we do collect is the minimum required to provide the AI features you opt into.

The honest summary: Notes you sync to our servers are end-to-end encrypted in transit and at rest, so we cannot read those stored copies. Locally, notes live in your device's app sandbox (protected by your device passcode / Face ID) in plaintext, the same way Apple Notes and most local apps work. When you use AI features (Ask, auto-tagging, summarization, search embeddings, image OCR, scene description), the relevant note text or image is decrypted by our proxy at the moment you invoke the feature and forwarded to the routed AI provider in plaintext. We prefer providers that offer no-training and zero-retention terms for API calls where contractually available; the specific terms vary by provider.

1. Information We Collect

1.1 Information You Provide

Notes (text, voice transcripts, images, PDFs, shared URLs) — content you type, dictate, share, or capture. Stored locally in SwiftData and, if iCloud sync is enabled, in encrypted form on our servers.
Voice recordings — processed by Apple's SFSpeechRecognizer. By default, recognition runs on-device. If you toggle "Prefer server-side recognition" in Settings, audio is sent to Apple's speech servers (not ours) for higher accuracy.
Account information — when you sign in via Apple, Email/password, or Google, we receive the provider's identifier (Apple's relay or real email, your Google email, or the email you chose) and a stable user ID. Guest mode requires no account at all.
Subscription state — if you purchase Premium, Apple sends us a transaction notification (via App Store Server Notifications v2) so we can mark your account as Premium. Apple processes all payments; we never see your payment information.

1.2 Information Collected Automatically

Coarse location — if you grant the "When In Use" location permission, the App attaches a city/region tag (e.g., "San Francisco, CA") to new notes so you can recall where a memory happened. Exact coordinates never leave your device — only the reverse-geocoded city/region string is stored with the note.
AI usage counters — to enforce free-tier limits and prevent abuse, our backend counts how many AI requests you make per class (fast / standard / vision / advanced) per month. For guest users (no account), counters are keyed by IP address; for signed-in users, by account ID.
Crash reports — if you opt in to share with developers via iOS Settings, Apple sends us anonymized crash logs through TestFlight or App Store Connect.
App Account Token — a per-device UUID generated locally and passed to Apple at subscription purchase time so we can correlate the Apple transaction with your account.

1.3 Information We Do NOT Collect

We do not use advertising identifiers (no IDFA).
We do not embed any third-party analytics SDK (no Sentry / Firebase / Mixpanel / PostHog / AppsFlyer / etc.).
We do not access your contacts, photos, files, microphone, camera, or calendar unless you explicitly grant permission for that specific feature.
We do not sell, rent, or trade your information for marketing.

2. How We Use Information

To store and sync your encrypted notes across your devices.
To process AI features you invoke: auto-tagging, summarization, intent classification, long-note splitting, semantic search, the natural-language "Ask" tab, OCR for image notes, and scene description.
To authenticate your account and enforce subscription / quota state.
To respond to your support requests.

2.1 Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the legal bases on which we process your personal data are:

Performance of a contract (Art. 6(1)(b) GDPR) — to provide the App's core features once you create an account or purchase Premium: authentication, encrypted note sync, subscription management, and customer support.
Consent (Art. 6(1)(a) GDPR) — for optional features you opt into: location tagging on notes, server-side speech recognition, Apple Calendar import / export, and submitting note content to AI providers via the AI features. You can withdraw consent at any time by disabling the relevant feature in Settings; withdrawal does not affect prior processing.
Legitimate interests (Art. 6(1)(f) GDPR) — for AI usage counters and IP-keyed Guest-tier rate limits, used solely to prevent abuse, manage quota, and operate the service. Our legitimate interest is balanced against your privacy because the counters do not contain note content.
Legal obligation (Art. 6(1)(c) GDPR) — to respond to lawful requests from authorities of competent jurisdiction.

3. Third-Party Services

Rinora relies on the third-party services below. Each receives only the minimum data necessary.

3.1 Authentication

Apple — Sign in with Apple. Subject to Apple's Privacy Policy.
Google — Sign in with Google. Subject to Google's Privacy Policy.

3.2 Backend and Sync

Supabase (hosted in the United States) — stores your encrypted note envelopes, account record, and AI usage counters. Supabase cannot decrypt your notes. Supabase Privacy Policy.

3.3 AI Providers

Your explicit consent is required before any content reaches an AI provider. AI features are off by default. The App asks for your permission on a dedicated consent screen during onboarding (or, if you are updating from an earlier version, in a one-time prompt on first launch), which identifies each provider by name and explains what is sent. You can grant or withdraw consent at any time in Settings → Privacy → AI features. While AI features are off, the App works fully with on-device processing and none of your content is sent to any AI provider.

When AI features are enabled and you invoke an AI feature, your prompt and the relevant note content are temporarily decrypted in transit on our proxy and forwarded to the AI provider routed to your task. We prefer providers that offer no-training and zero-retention terms for API calls where contractually available; the specific terms vary by provider and may include short-term retention for abuse detection or operational logging. Consult each provider's API data-use policy for current terms. The active set is:

OpenAI (GPT family + text-embedding-3-small for vector search) — Privacy Policy
Google (Gemini family) — Privacy Policy
Anthropic (Claude family) — Privacy Policy
DeepSeek — Privacy Policy

We will update this list before routing any content to an additional provider.

The routing decision is made by our proxy based on your task class, language, and quota; you can see and adjust the routing preference in Settings → AI Model.

What this means in plain English: If you ask Rinora "what did I do yesterday", the question plus the small set of notes the App believes are relevant are sent in plaintext to whichever model is routed. If you use the OCR or scene-description feature on an image, the image bytes are sent in plaintext to the chosen vision model. If you never enable AI features — or turn them off in Settings — your notes are never decrypted off-device.

3.4 Subscriptions and Payments

Rinora offers an optional Premium subscription via Apple In-App Purchase. Available plans:

Rinora Premium Monthly — US $4.99 per month, auto-renewing.
Rinora Premium Yearly — US $39.99 per year, auto-renewing.

Prices are shown in the App in your local currency, as set by Apple's regional pricing matrix. Subscriptions automatically renew at the end of each billing period unless cancelled at least 24 hours before the renewal date. Your Apple ID account is charged at the price displayed at purchase.

You can view, change, or cancel your subscription anytime from iPhone Settings → [Your Name] → Subscriptions. Cancelling stops the next renewal; the current period continues until its end date.

All purchases are governed by Apple's Standard EULA for App Store apps and our Terms of Use. Refund requests are handled by Apple per their App Store refund policy.

Payment information: all charges are processed by Apple. We do not collect, store, or have access to your credit card, billing address, or other payment information. Apple sends our backend a signed App Store Server Notification (ASSN v2) when your subscription starts, renews, or ends so we can update your Premium status. See Apple's Privacy Policy for how Apple handles payment data.

4. Encryption and Data Security

Note storage: Each note is encrypted with AES-256-GCM (Apple CryptoKit) on your device before being uploaded to our servers. Per-field subkeys are derived via HKDF-SHA256 from a per-user master key.
Master key derivation:
- For passphrase accounts: derived locally from your passphrase via Argon2id (OWASP 2024 parameters — 65 MiB memory, 3 iterations, parallelism 4).
- For Sign in with Apple, Google, and Email: a random master key is generated on first sign-in and stored in the device's iCloud Keychain (synchronizable) so other devices on the same Apple ID can sync your notes. The key is never transmitted to our servers.
In transit: all network traffic uses TLS 1.2+ (HTTPS).
At rest on your device: notes are stored in iOS's app sandbox (protected by your device passcode / Face ID / Touch ID) as plaintext, as is standard for most local-first apps.
At rest on our servers: we hold only the encrypted envelopes. Without a copy of your master key (which we do not have), we cannot decrypt them.
AI features: when you invoke an AI feature, note text and images are transmitted over HTTPS in plaintext to our AI proxy and the routed model provider, as described in Section 3.3. Our proxy does not persistently store these payloads. Provider retention terms vary; see Section 3.3.

5. Local-Only Features

The following features run entirely on your device and never transmit data to any server:

Local notifications & reminders — scheduled via UNUserNotificationCenter. No push notifications.
Apple Calendar import / export — if you enable it, Rinora reads (and optionally writes) Apple Calendar via EventKit. Calendar event data stays in Rinora's local database and is only synced to our servers if you also enable iCloud sync (in which case it is encrypted like any other note).
Share Extension — URLs, text, RTF, images, and PDFs shared into Rinora from other apps are handed off via the App Group container directly to the main app. The Share Extension itself has no network access.
On-device speech recognition — the default path. Audio buffers stay on-device.
Local search index — BM25 + on-device embeddings cache used by the in-app search drawer.

6. Guest Mode

Every feature in Rinora works without signing in. In Guest mode:

No account is created and no email is collected.
Notes stay on the device (no cloud sync).
AI requests are still routed through our proxy, with rate limits enforced by IP address rather than account ID.

7. Data Retention and Deletion

Notes are kept until you delete them or delete your account.
You can delete any individual note at any time from inside the App (right-swipe).
To delete your account and all associated data, email harley510396@gmail.com from the address linked to your account, or use the in-app "Delete Account" option (where available). Account deletion is irreversible and removes all encrypted notes within 30 days.
AI usage counters are retained for the rolling 30-day quota window and then expire automatically.

8. Children's Privacy

Rinora is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

9. Your Rights

Depending on your jurisdiction (EU / UK / California / etc.), you may have the right to:

Access the personal data we hold about you.
Request correction or deletion.
Object to processing or request data portability.
Lodge a complaint with your local data protection authority.

To exercise any of these rights, email harley510396@gmail.com. Because notes are end-to-end encrypted, your portable data export consists of the plaintext notes you can already see on your device, plus your account metadata.

10. International Data Transfers

Our backend servers (Supabase) are located in the United States. AI providers may operate servers in the United States, the European Union, China, or other regions; the routing decision is made by our proxy per request and may change over time for redundancy and quota.

For users located in the European Economic Area, the United Kingdom, or Switzerland, transfers of personal data to recipients outside those regions are made under one or more of the following transfer mechanisms:

Standard Contractual Clauses (SCCs) approved by the European Commission, as incorporated into our agreements with Supabase and applicable AI providers.
EU–US Data Privacy Framework (and the UK and Swiss extensions thereof) where the relevant recipient is self-certified under the framework.
Adequacy decisions by the European Commission where applicable to the recipient's country.

For AI providers based in jurisdictions without an adequacy decision or self-certification (e.g., certain China-based providers), we rely on your explicit consent (Art. 49(1)(a) GDPR) given when you invoke the AI feature, and we route requests to such providers only when no alternative provider is available for your task.

You can request a copy of the relevant safeguards by contacting us at the address below.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated through the App or by email.

12. Data Controller and Contact

The data controller responsible for your personal data under this Privacy Policy is:

Hao Li (sole proprietor, doing business as Rinora)
United States of America
Email: harley510396@gmail.com

For a postal mailing address or to exercise any of the rights described in Section 9, please contact us by email and we will respond within 30 days.

12.1 EU / UK Representative

Rinora is operated from the United States and is not specifically targeted at users in the European Economic Area or the United Kingdom. If you are an EEA or UK resident with a privacy question or request, you may contact us at the email above and we will assist you. We have not currently designated a representative under Article 27 of the GDPR; we will appoint one if and when we begin offering the App with substantial volume to EEA / UK markets.

12.2 California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA / CPRA), including the right to know what personal information we collect, the right to delete that information, the right to correct inaccurate information, and the right to opt out of the "sale" or "sharing" of personal information. We do not "sell" or "share" your personal information as those terms are defined under the CCPA, and we do not use sensitive personal information (which includes your notes' contents) for purposes other than providing the requested service. To exercise any CCPA right, email us at the address above.