Privacy Policy

Rinora · Last updated: October 14, 2026

This Privacy Policy describes how Rinora ("we", "us", or "the App") handles your information when you use our iOS application. We built Rinora to be privacy-first and local-first: every feature works without a Rinora account, your notes are stored on your device (and, if you use iCloud, in your own iCloud account), and AI features that send note content off your device stay off until you turn them on.

1. Information We Collect

1.1 Information You Provide

• Notes (text, voice transcripts, images, PDFs, shared URLs) — content you type, dictate, share, or capture. Stored on your device; synced through your own iCloud account if iCloud is on (see Section 5); and, if you sign in to a Rinora account, uploaded to our servers in end-to-end encrypted form (see Section 4).
• Voice input — the App uses Apple's speech recognition (SFSpeechRecognizer) to turn your voice into text. The setting "Use server recognition when online" is on by default: Apple may then send your audio to Apple's speech servers (not ours) to transcribe it, under Apple's Privacy Policy. If you turn the setting off, recognition runs on your device and audio stays on it; the one exception is a language other than Chinese or English for which on-device recognition is not available on your device, in which case Apple's servers are still used. We do not receive or store your audio; only the resulting text becomes part of your note.
• Profile facts — optional facts about yourself that you add in Settings so AI answers can be personalized. They are stored like notes (on your device and in your iCloud), and facts you mark as visible to AI are included in AI requests that use personalization.
• Account information — when you sign in via Apple, Email/password, or Google, we receive the provider's identifier (Apple's relay or real email, your Google email, or the email you chose) and a stable user ID. Guest mode requires no account at all.
• Subscription state — if you purchase Premium, Apple sends us signed transaction notifications (App Store Server Notifications v2). We store the transaction identifiers, product, expiry date, and status needed to mark your account as Premium, together with a log of the notifications Apple sends us. Apple processes all payments; we never see your payment information.
• Redemption codes — if you redeem a promotional code, we receive the code, an identifier for your device (Apple's identifierForVendor, which is specific to our apps on your device), your IP address, the time, and, if you are signed in, your user ID. We use these to apply the benefit and prevent abuse.

1.2 Information Collected Automatically

• Coarse location — if you grant the "When In Use" location permission, the App attaches a city/region tag (e.g., "San Francisco, CA") to new notes so you can recall where a memory happened. To turn your approximate position (accurate to about a kilometer) into a city name, the App uses Apple's geocoding service, which receives that approximate position. Only the city/region text is stored with the note; it is encrypted when uploaded to our servers and is included with a note's text when that note is sent to an AI provider.
• IP address and request information — like any online service, our servers receive your IP address when the App contacts them (for example, to check your AI quota or load configuration, to process AI requests, or to sync).
• AI usage counters — to enforce free-tier limits and prevent abuse, our backend counts your AI requests per day, per calendar month, and per request class (fast / standard / vision / advanced), plus a one-time trial allowance. For guest users (no account), counters are keyed by your IP address — some stored as-is and some as a one-way hash of it; for signed-in users, by account ID.
• AI request log — for each AI request we record metadata only: time, account ID (or, for guests, a one-way hash of your IP address), region, app version, request class, input language, which model and provider handled it, token counts, latency, cost, and whether it succeeded (with the provider's error message if it failed). The log does not contain your note content or your questions.
• Crash reports — if you opt in to share with developers via iOS Settings, Apple sends us anonymized crash logs through TestFlight or App Store Connect.
• App Account Token — a random identifier generated by the App and stored in your iCloud Keychain (so it is the same on your devices that share an Apple ID). It is passed to Apple when you purchase a subscription so we can match the Apple transaction to your account.

1.3 Information We Do NOT Collect

• We do not use advertising identifiers (no IDFA).
• We do not embed any third-party analytics SDK (no Sentry / Firebase / Mixpanel / PostHog / AppsFlyer / etc.).
• We do not access your contacts, photos, files, microphone, camera, location, or calendar unless you explicitly grant permission for that specific feature.
• We do not sell, rent, or trade your information for marketing.

2. How We Use Information

• To store and sync your encrypted notes across your devices when you sign in.
• To process AI features you turn on and use: auto-tagging, summarization, long-note splitting, semantic search, the natural-language "Ask" tab, AI text recognition for images, and image description.
• To authenticate your account and enforce subscription, redemption, and quota state.
• To operate the service: prevent abuse, and monitor the reliability and cost of AI requests (using the metadata described in Section 1.2).
• To respond to your support requests.

2.1 Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the legal bases on which we process your personal data are:

• Performance of a contract (Art. 6(1)(b) GDPR) — to provide the App's features you use: authentication, encrypted note sync, subscription management, code redemption, voice input, and customer support.
• Consent (Art. 6(1)(a) GDPR) — for optional features you opt into: location tagging on notes, Apple Calendar import / export, and submitting note content to AI providers via the AI features. You can withdraw consent at any time by disabling the relevant feature in Settings; withdrawal does not affect prior processing.
• Legitimate interests (Art. 6(1)(f) GDPR) — for AI usage counters, IP-keyed Guest-tier rate limits, and the AI request log, used to prevent abuse, manage quota, and operate the service. Our legitimate interest is balanced against your privacy because these records do not contain note content.
• Legal obligation (Art. 6(1)(c) GDPR) — to respond to lawful requests from authorities of competent jurisdiction.

3. Third-Party Services

Rinora relies on the third-party services below. Each receives only the data needed for its part.

3.1 Apple

• iCloud (CloudKit) — syncs your notes, attachments, and profile facts through your own private iCloud database (see Section 5).
• Speech recognition — transcribes voice input; may process audio on Apple's servers (see Section 1.1).
• Geocoding — turns your approximate position into a city name, if you enable location tagging.
• Sign in with Apple and the App Store (purchases, subscriptions, crash reports).

Apple's handling of this data is governed by Apple's Privacy Policy.

3.2 Authentication

• Google — Sign in with Google. Subject to Google's Privacy Policy.
• Email/password accounts are handled by our backend provider, Supabase (Section 3.3).

3.3 Backend and Sync

• Supabase (hosted in the United States) — hosts our database and server functions. It stores your encrypted notes and the unencrypted information listed in Section 4, your account record, subscription and redemption records, AI usage counters, and the AI request log. Supabase cannot decrypt your notes. Supabase Privacy Policy.

3.4 AI Providers

Your explicit consent is required before any content reaches an AI provider. AI features are off by default. The App asks for your permission on a dedicated consent screen during onboarding (or, if you are updating from an earlier version, in a one-time prompt on first launch), which explains what is sent and, before you agree, names the providers: Google, OpenAI, and Anthropic (United States). The screen also tells you that you can withdraw anytime by turning off AI in Settings → AI & Privacy. You can also turn AI features on later in Settings → AI & Privacy or from the Ask tab; both places name the same providers. While AI features are off, none of your content is sent to any AI provider.

When AI features are on and you use them, your device sends the relevant content in plaintext over HTTPS to our proxy, which forwards it to the AI provider routed to your task. Depending on the feature, this can include: your question; the text of the notes the App selects as relevant, with each note's date and city/region tag; profile facts you marked as visible to AI; the text of a new or edited note (for tagging, summaries, splitting, and computing its search index); and an image, only when you tap AI text recognition or image description on it. Notes you exclude from AI, individually or by category, are not sent.

Our proxy does not store this content. We prefer providers that offer no-training and zero-retention terms for API calls where contractually available; the specific terms vary by provider and may include short-term retention for abuse detection or operational logging. Consult each provider's API data-use policy for current terms. The providers that may receive your content are:

• Google (Gemini models; Google LLC, United States) — text and images. Privacy Policy
• OpenAI (GPT models, and text-embedding-3-small for the AI search index; OpenAI, United States) — text and images. Privacy Policy
• Anthropic (Claude models; Anthropic, United States) — text and images. Privacy Policy

We will update this list before routing any content to an additional provider.

How a provider is chosen. For each request, our proxy uses a fixed priority order of models for that type of task. The request goes to the first available model; if that provider returns an error, times out, or is otherwise unavailable, the proxy retries with the next model in the order. Every model in these orders is provided by Google, OpenAI, or Anthropic. Some requests from older parts of the App go directly through our proxy to OpenAI or Anthropic.

AI search index (embeddings). If you are signed in and AI features are on, the text of each note is sent to OpenAI to compute a numeric representation of its meaning (an "embedding"). The embedding is stored unencrypted with the note on our servers so Ask can find relevant notes; your question is turned into an embedding the same way. An embedding is not the note's text, but it is derived from it.

3.5 Subscriptions and Payments

Rinora offers an optional Premium subscription via Apple In-App Purchase. Available plans:

• Rinora Premium Monthly — US $4.99 per month, auto-renewing.
• Rinora Premium Yearly — US $39.99 per year, auto-renewing.

Prices are shown in the App in your local currency, as set by Apple's regional pricing matrix. Subscriptions automatically renew at the end of each billing period unless cancelled at least 24 hours before the renewal date. Your Apple ID account is charged at the price displayed at purchase.

You can view, change, or cancel your subscription anytime from iPhone Settings → [Your Name] → Subscriptions. Cancelling stops the next renewal; the current period continues until its end date.

All purchases are governed by Apple's Standard EULA for App Store apps and our Terms of Use. Refund requests are handled by Apple per their App Store refund policy.

Payment information: all charges are processed by Apple. We do not collect, store, or have access to your credit card, billing address, or other payment information. Apple sends our backend a signed App Store Server Notification (ASSN v2) when your subscription starts, renews, or ends so we can update your Premium status. See Apple's Privacy Policy for how Apple handles payment data.

4. Encryption and Data Security

• Notes on our servers: when you are signed in, each note's content, summary, tags and topic, location tag, and search text are encrypted with AES-256-GCM (Apple CryptoKit) on your device before upload. Per-field subkeys are derived via HKDF-SHA256 from a per-user master key.
• Master key: a random master key is generated on your device the first time you sign in (with Apple, Google, or Email) and stored in your iCloud Keychain (synchronizable), so your other devices on the same Apple ID can decrypt your notes. The key is never transmitted to our servers.
• Not encrypted on our servers: to make sync and search work, our servers also hold, for each note, unencrypted information that does not include its text: identifiers, creation and update times, the kind of note (typed, voice, image, or shared), processing and archive status, whether it is excluded from AI or deleted, and — if AI features are on — its embedding (Section 3.4).
• In transit: all network traffic uses TLS 1.2+ (HTTPS).
• On your device: notes are stored in iOS's app sandbox (protected by your device passcode / Face ID / Touch ID) as plaintext, as is standard for most local-first apps.
• In your iCloud: the iCloud copy (Section 5) is protected by Apple's iCloud security. It is not encrypted with Rinora's key.
• AI features: when you use an AI feature, note text and images are transmitted over HTTPS in plaintext to our AI proxy and the routed model provider, as described in Section 3.4. Our proxy does not store these payloads. Provider retention terms vary; see Section 3.4.

5. iCloud Sync

If you are signed in to iCloud on your device, Rinora uses Apple's CloudKit to keep your notes, attachments (such as photos), and profile facts in sync across your Apple devices. This works with or without a Rinora account.

• The data is stored in your own private iCloud database, counts toward your iCloud storage, and is managed under your Apple ID.
• It is protected by Apple under Apple's privacy terms. It is not part of Rinora's end-to-end encrypted sync, and Rinora cannot read it.
• It is separate from Rinora's own sync (Section 4). Excluding a note from AI does not remove it from iCloud.
• You can stop it by turning off iCloud for Rinora in iOS Settings (“Manage in System Settings” in the App's Settings → Sync & Encryption).

6. Features That Stay on Your Device

The following features run on your device and do not send data to our servers:

• Local notifications & reminders — scheduled via UNUserNotificationCenter. No push notifications are sent by us.
• Apple Calendar import / export — if you enable it, Rinora reads (and optionally writes) Apple Calendar via EventKit on your device. Imported events become notes, which are then stored, synced, and (if AI features are on) processed like any other note.
• Share Extension — URLs, text, RTF, images, and PDFs shared into Rinora from other apps are handed off via the App Group container directly to the main app. The Share Extension itself does not connect to the network.
• On-device speech recognition — when you turn off "Use server recognition when online" (see Section 1.1 for the one exception).
• Image text recognition — text in photos is first recognized on your device. An image is sent to an AI provider only if you tap AI text recognition or image description.
• Local search — keyword search runs on your device. (Ask's semantic search uses the AI search index described in Section 3.4.)

7. Guest Mode

Every feature in Rinora works without a Rinora account. In Guest mode:

• No account is created and no email is collected.
• Your notes are not uploaded to our servers. They stay on your device and, if you use iCloud, sync through your own iCloud account (Section 5).
• If you turn on AI features, AI requests are routed through our proxy as described in Section 3.4, with rate limits enforced by IP address rather than account ID.

8. Data Retention and Deletion

• Notes are kept until you delete them or delete your account.
• Deleting a note in the App removes it from your device and, through iCloud sync, from your other devices and your iCloud. If you are signed in, the note's encrypted copy on our servers is marked as deleted so your other devices remove it too; that encrypted copy and its metadata stay on our servers until you delete your account.
• Deleting your account (in the App: Settings → Account → Delete account, or by emailing harley510396@gmail.com from the address linked to your account) immediately and permanently deletes your account and all notes stored on our servers, including their embeddings. Data that was included in our hosting provider's database backups before deletion may remain in those backups for a limited period, until they are overwritten under the provider's backup schedule. Account deletion is irreversible.
• Account deletion does not delete notes on your device or in your iCloud; you can delete those in the App. It also does not cancel an App Store subscription; cancel it in your Apple subscription settings.
• Records kept after account deletion: subscription records and redemption records are kept without the link to your account (for accounting, refunds, and abuse prevention); the AI request log, usage counters, and Apple's subscription notifications remain keyed by your former account ID, which no longer links to any account or email.
• Usage counters and the AI request log are used to operate quotas, prevent abuse, and monitor costs. We do not currently delete them on a fixed schedule. You can ask us to delete those linked to you by contacting us.

9. Children's Privacy

Rinora is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

10. Your Rights

Depending on your jurisdiction (EU / UK / California / etc.), you may have the right to:

• Access the personal data we hold about you.
• Request correction or deletion.
• Object to processing or request data portability.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email harley510396@gmail.com. Because notes are end-to-end encrypted on our servers, your portable data export consists of the plaintext notes you can already see on your device, plus your account metadata.

11. International Data Transfers

Rinora is operated from the United States, and your information may be processed outside your country:

• United States — our backend (Supabase) is located in the United States. The AI providers we use, Google, OpenAI, and Anthropic, are U.S. companies; they may process requests in the United States and in other countries where they or their service providers operate.
• Apple — iCloud sync, speech recognition, and geocoding are provided by Apple under its own terms (Section 3.1).

If you are located in the European Economic Area, the United Kingdom, or Switzerland, this means your personal data is transferred to the United States. Where a transfer mechanism applies to a transfer to one of these service providers, it is the one provided for in our agreement with that provider.

You can ask us which safeguards apply to a transfer by contacting us at the address below.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated through the App or by email.

13. Data Controller and Contact

The data controller responsible for your personal data under this Privacy Policy is:

Hao Li (sole proprietor, doing business as Rinora)
United States of America
Email: harley510396@gmail.com

For a postal mailing address or to exercise any of the rights described in Section 10, please contact us by email and we will respond within 30 days.

13.1 EU / UK Representative

Rinora is operated from the United States and is not specifically targeted at users in the European Economic Area or the United Kingdom. If you are an EEA or UK resident with a privacy question or request, you may contact us at the email above and we will assist you. We have not currently designated a representative under Article 27 of the GDPR; we will appoint one if and when we begin offering the App with substantial volume to EEA / UK markets.

13.2 California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA / CPRA), including the right to know what personal information we collect, the right to delete that information, the right to correct inaccurate information, and the right to opt out of the "sale" or "sharing" of personal information. We do not "sell" or "share" your personal information as those terms are defined under the CCPA, and we do not use sensitive personal information (which includes your notes' contents) for purposes other than providing the requested service. To exercise any CCPA right, email us at the address above.

See also our Terms of Use.