Riia — Privacy Policy

Effective 5 November 2026

Riia ("Riia", "we", "us") is a mobile app that helps you track your skin over time, with photos, quick daily check-ins, a diary, and AI-assisted insights. We take the privacy of your skin and health information seriously. This policy explains what we collect, why, who we share it with, and the choices you have.

Riia is sold on the App Store by Maria Fitzpatrick, an individual trader of April Cottage, Mushroom Castle, Winkfield Row, Bracknell, England, RG42 7PL, until it moves to Universal Strategic Arts Ltd. Universal Strategic Arts Ltd (company number 16700907, registered office April Cottage, Mushroom Castle, Winkfield Row, Bracknell, England, RG42 7PL), registered with the UK Information Commissioner's Office under number ZC113206, provides the service that runs Riia and is the controller of your diary data. Maria Fitzpatrick is responsible for sales, tax and billing support records. Questions: info@riia.app.

1. Information we collect

Information you give us

• Account details: your email address, used to create and sign in to your account.
• About you: things you tell Riia when you set up, such as your skin type, age, gender (optional) and what you want to work on.
• Skin photos: pictures you take or add, to track your skin over time.
• Skin and health information: the conditions or concerns you choose, your daily skin ratings, diary entries and notes, goals, routines and products, and any medications or possible triggers you log. This is health data, and we treat it as sensitive.
• Voice: if you talk to Riia or record a voice note, your recording is sent to our speech provider to be turned into text. We keep the text, not the recording; a copy of the recording also stays on your phone.
• Your area: the postcode or town you type, turned into rough coordinates, so Riia can show local weather. Riia does not use your phone's GPS.
• Survey answers: if you answer one of the short in-app surveys.

Information collected automatically

• Diagnostics and usage: crash reports and basic usage analytics, linked to an app user ID, never your name or email.
• Notifications: if you allow them, a device token so we can send the reminders you chose.
• Subscription status: whether you have Riia+ and when it renews. We never see your card details.

2. How we use your information, and why we're allowed to

• To run the app: keep your photos, logs and diary, and show your history and trends (to provide the service you signed up for).
• To reply to you, spot possible patterns, and build your doctor's note, using AI (with your explicit consent; see section 3).
• To keep and use your health information at all (with your explicit consent, which you give when you create an account and add it).
• To show local weather, UV, air quality and pollen next to your skin notes.
• To send the notifications you turned on, and to manage your Riia+ subscription.
• To send you the Monday email, only if you said yes: your own recent skin photos, a short line from your diary and a tip for your skin condition (with your consent). It never advertises anything. Switch it off or pause it from any email, or in Profile → Notifications.
• To fix bugs, prevent abuse and improve the app (our legitimate interest in a working, safe app).

We do not sell your personal information, and we never use your photos or health data for advertising. The Monday email sends your own photos and diary back to you, and only if you ask for it.

3. AI, and asking you first

Riia's replies, patterns, product checks and doctor's note are made by AI services run by other companies. Before anything you share is sent to them, Riia asks your permission and names each company. If you choose "Not now", you can still write, rate and add photos; Riia just won't reply, talk or spot patterns. You can change your answer at any time in the app under Profile → AI and your data.

These companies use what Riia sends only to produce Riia's reply. Under its commercial terms, Anthropic does not train its models on it.

4. Who we share it with

We use a small number of service providers ("subprocessors") to run Riia. They handle your data only to provide their service to us:

Provider	What it handles	Why
Supabase	Your account, diary, logs and stored photos	Secure database, sign-in and file storage
Anthropic (Claude)	Your notes, photos, questions and the history they need (only if you said yes to AI)	Riia's written replies, daily summaries, patterns, product checks, photo reads and doctor's note
ElevenLabs	Your voice and the text of what you say; Riia's spoken replies (only if you said yes to AI)	Turning speech into text and speaking replies
Google (Gemini, through ElevenLabs)	What you say in a spoken conversation (only if you said yes to AI)	Running spoken conversations
LiveKit	Live audio during a spoken conversation (only if you said yes to AI)	Carrying your voice between your phone and Riia
Open-Meteo, OpenUV, OpenAQ, OpenCage, Google (Pollen)	Your rough area only, never your notes	Local weather, UV, air quality and pollen
Resend	Your email address; your sign-in codes; and, if you said yes to the Monday email, that email (your photos and a line from your diary)	Sending sign-in codes and the Monday email
Apple	Riia+ payments; delivering notifications	Subscriptions and reminders
RevenueCat	Your subscription status and an app user ID	Knowing who has Riia+
Expo	Your notification token and the reminder text	Sending reminders
Unity (App Feedback)	An app user ID, simple app events (like "note saved") and your survey answers	Short optional in-app surveys
Sentry	Crash reports, linked to an app user ID	Finding and fixing crashes
PostHog (EU)	Usage analytics, linked to an app user ID	Understanding and improving the app

We choose providers that are bound by data protection terms, and we require them to protect your data to the same or an equal standard as this policy. Our weather and air quality services receive only an approximate location, never your name, account or diary.

We may also disclose information if the law requires it, or to protect the safety of our users and Riia.

5. Storage and security

Your data is stored on our providers' secure infrastructure and sent over encrypted connections. Access to your account data is limited to you (through row-level security) and to the processing described above. No method of storage or transmission is 100% secure, but we take reasonable measures to protect your information.

6. How long we keep it, and deleting it

We keep your information for as long as your account exists. Records of AI requests, kept to track cost and fix problems, are deleted after 30 days.

You can delete your account at any time in the app (Profile → Delete account & data). This deletes your account, diary, logs and photos from our systems, and the copy on that phone. Backups and records we must keep by law may last a short while longer before they are overwritten. The providers in section 4 may keep what they processed for a limited time under their own retention policies (for example for security and abuse checks) before deleting it; none of them may use it for anything other than providing their service to us. Deleting your account does not cancel a Riia+ subscription: cancel it in your iPhone's Settings → your name → Subscriptions.

7. Riia+ subscriptions

Riia+ is bought through Apple. Apple takes the payment, handles billing and refunds, and lets you manage or cancel in your iPhone's Settings. We only receive whether you have Riia+ and when it renews.

8. Your rights and choices

• Access and a copy: ask for the data we hold about you.
• Correction: edit your logs, diary and profile in the app at any time.
• Deletion: delete single entries, or your whole account, in the app.
• Withdraw consent: turn AI sharing off in Profile → AI and your data, or delete your account to withdraw consent for your health data.
• Monday email: switch it off or pause it from the links in any email, or in Profile → Notifications.
• Permissions: camera, microphone, photos and notifications are all optional and controlled in your iPhone's Settings.

Under UK data protection law you also have rights to object, to restrict how we use your data, and to take it with you. Email info@riia.app to use any of them. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

9. Children

Riia is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child has given us information, contact us and we will delete it.

10. Not a medical service

Riia is a personal tracking and information tool. It is not a medical device and does not provide diagnosis or treatment. Its insights are informational and are not a substitute for professional medical advice. Always check with your GP or another qualified clinician about your skin.

11. International transfers

Some of our providers process data outside the UK, including in the United States. Where they do, we rely on the safeguards UK law approves, such as the UK–US data bridge or standard contractual clauses.

12. Changes to this policy

We may update this policy from time to time. We'll change the "Effective" date above and, for important changes, tell you in the app. If we start using a new AI company, Riia will ask you again.

13. Contact

Questions or requests: info@riia.app.
Governing law: England and Wales.