Privacy Policy

Effective as of August 6, 2026.

This Privacy Policy describes how The Creative League Company ("Riff," "we," "us," or "our") handles personal information that we collect through our website at theriffapp.com, our Riff mobile application, and our online services that link to this Privacy Policy (collectively, the "Service"), as well as through our communications with you and other activities described in this Privacy Policy.

State Law Privacy Rights: See the State Law Privacy Rights section below for important information about rights you may have under applicable U.S. state privacy laws.

Questions or concerns? Reading this Privacy Policy will help you understand our privacy practices. If you do not agree with our policies and practices, please do not use our Service. If you still have any questions or concerns, please contact us at admin@theriffapp.com.

Summary of Key Points

This summary provides key points from our Privacy Policy. We encourage you to read the full policy for important details.

What personal information do we collect? When you create an account and use Riff, we collect the information you provide (like your email, username, and the songs, votes, messages, and photos you share) and a limited amount of technical information needed to run the Service.

Do we use tracking, analytics, or advertising? No. Riff does not use third-party analytics or advertising SDKs, does not show ads, does not track you across other apps or websites, and does not sell your personal information.

How do we use your information? To provide and operate the game, deliver social features, send notifications you've enabled and transactional emails, keep the Service secure, and comply with law.

Who do we share it with? A small set of service providers that help us run the app, other users where you choose to share content, and others as described below or required by law.

How can you exercise your rights? You can update or delete your account in the app at any time, and residents of certain states have additional rights described in the State Law Privacy Rights section.

Scope of This Privacy Policy
Personal Information We Collect
How We Use Your Personal Information
How We Share Your Personal Information
Your Choices
Other Sites and Services
Security and Retention
Children
International Data Transfers
Changes to This Privacy Policy
How to Contact Us
State Law Privacy Rights

1. Scope of This Privacy Policy

Riff provides a music league app where you join leagues with friends, submit songs for themed rounds, and rank each other's picks. This Privacy Policy applies to personal information we handle in connection with the Service. It does not apply to personal information about Riff's personnel or job candidates that we process in our capacity as an employer. We may provide additional or supplemental privacy notices at the time we collect personal information.

2. Personal Information We Collect

Information you provide to us

You may provide us with the following categories of personal information:

Account data: Information you provide to create a Riff account, including your email address, username, display name, and password (which we store only as a salted bcrypt hash — we never see or store your plaintext password).
Profile data: Information you choose to add to your profile, such as a profile photo, pronouns, a short bio, and your account privacy setting (public or private).
Content data: Content you create in the Service, including your song submissions, votes and rankings, league chat messages, direct messages, stories (a song, an optional photo, and a caption), league names and images, round themes, liked songs, and your social connections (follows, friends, follow requests, league invites, and accounts you block).
Gameplay data: Records tied to your account such as all-time points, wins, and submission counts, used to show standings, results, and profile stats.
Communications data: The contents of your communications with us, including support requests and feedback.

Information about others

You should never submit another person's personal information to the Service without their permission. For example, if you invite a friend to a league, you should make sure they're comfortable being invited.

Information from other users

Some information about you may reach us through other users — for example, when another user submits or ranks a song in a league you're part of, or invites you to a league.

Automatic data collection

When your device communicates with the Service, we and our hosting providers automatically log basic technical information needed to operate and secure the Service, such as:

Server log data: IP address, request timestamps, and diagnostic information (such as error and crash information) generated when your device connects to our servers.
Push notification tokens: If you enable notifications, your device generates a push token that we store so we can send you round updates, results, and messages. You can decline notifications entirely.

What we do not collect

To be clear about what Riff does not do: we do not use third-party analytics or advertising SDKs, we do not use cookies, pixels, or session-replay technologies to track you, we do not show ads, we do not collect your precise geolocation, and we do not access your device's contacts. Photos are accessed only when you choose to upload one, using your device's permission prompts.

3. How We Use Your Personal Information

We use your personal information to:

Provide the Service: create and secure your account, run the core game (rounds, submissions, voting, scoring, standings, and results), and deliver social features such as leagues, chat, direct messages, stories, follows, and the Discover feed.
Communicate with you: send notifications you've enabled and transactional emails such as password-reset codes, and respond to your support requests and feedback.
Operate our business: maintain, troubleshoot, secure, and improve the Service and our IT systems.
Comply with law and protect rights: comply with applicable laws and legal requests, enforce our Terms of Service, and protect against fraud, abuse, and harm to our users or the public.

We do not sell your personal information, and we do not share it with third parties for their own advertising or marketing.

4. How We Share Your Personal Information

We may share your personal information with the following parties:

Other users and the public. When you participate in a league, other members can see your submissions, results, and chat messages. Other Riff users can see your username, display name, profile photo, bio, and pronouns, subject to your privacy setting. Note that your username, avatar, and all-time points may appear on app-wide leaderboards visible to other signed-in users, even if your account is set to private. Stories are visible to your connections for 24 hours. Share cards and invite links you generate can be seen by anyone you send them to, and we cannot prevent recipients from copying or screenshotting them.

Service providers. Third parties that process data on our behalf to help us operate the Service:

We use trusted third-party service providers to help us operate the Service and process data on our behalf. These include Railway, which hosts our servers and processes all app data through our backend; MongoDB, which securely stores database information including account, gameplay, and message data; Cloudinary, which hosts images such as profile, league, and story photos you upload; Resend, which delivers transactional emails such as password-reset codes to your email address; Expo, which manages push notifications and app updates using push tokens and notification content; and Deezer, which powers song search, previews, and artwork using your unlinked song search queries.

Third-party music services. When you tap out to Spotify, Apple Music, or YouTube to hear a full song, you leave Riff and those services' own privacy policies apply. Riff does not connect to your accounts on those services.

Professional advisors. Advisors such as lawyers, auditors, and insurers, where necessary for the services they provide to us.

Authorities and others. Law enforcement, government authorities, and private parties where we believe in good faith it is necessary or appropriate to comply with law, respond to legal process, or protect the rights, property, and safety of Riff, our users, or the public.

Business transferees. Parties to a corporate transaction such as a merger, acquisition, financing, reorganization, or sale of assets (including in bankruptcy or similar proceedings). This policy will continue to apply to your information until updated.

With your consent or at your direction. We may share your personal information for other purposes with your consent or at your direction.

5. Your Choices

Access or update your information. You can review and update your account information within the app.

Delete your account. You can delete your account at any time in Settings → Danger Zone → Delete Account. This permanently deletes your account, profile, messages, and social connections. Because Riff is a multiplayer game, some gameplay records cannot be erased without breaking other players' results — if you delete your account mid-season, your past submissions in active leagues are anonymized (shown as "[deleted user]") rather than removed. These records are no longer linked to your identity. You can also use Clear Account Data in Settings to reset your gameplay history while keeping your account.

Notifications. You can turn push notifications on or off in your device settings or in the app.

Marketing. Riff does not currently send marketing emails. If that ever changes, every marketing message will include a way to opt out.

6. Other Sites and Services

The Service may link to or integrate with websites and services operated by third parties, such as Spotify, Apple Music, and YouTube. These links are not an endorsement of, or representation that we are affiliated with, any third party. We do not control third-party services and are not responsible for their actions or their privacy practices. We encourage you to read the privacy policies of the other services you use.

7. Security and Retention

We employ technical and organizational safeguards designed to protect your personal information, including bcrypt password hashing, encryption of traffic between the app and our servers, and restricted access to production data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security, so please use a strong, unique password.

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Account data is kept while your account is active; chat and direct messages are kept until you delete your account; stories leave general visibility after 24 hours; and password-reset codes expire after 15 minutes. When we no longer need personal information, we delete or anonymize it.

8. Children

Riff is not intended for anyone under 13 years of age, and you must be at least 13 to create an account. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at admin@theriffapp.com and we will delete it.

9. International Data Transfers

Riff is operated from the United States, and we and our service providers store and process your personal information in the United States and other locations where privacy laws may not be as protective as those where you live. If you use Riff from outside the United States, you understand your information will be transferred to and processed in the United States.

10. Changes to This Privacy Policy

We may modify this Privacy Policy from time to time. If we make material changes — for example, if we ever introduce advertising — we will update the effective date above and notify you through the Service or other appropriate means before the changes take effect. Your continued use of the Service after the effective date indicates your acknowledgment of the modified Privacy Policy.

11. How to Contact Us

If you have questions or concerns about this Privacy Policy or our practices, please contact us at admin@theriffapp.com.

The Creative League Company [Company mailing address]

12. State Law Privacy Rights

Scope. Except as otherwise provided, this section applies to residents of U.S. states with privacy laws that grant the rights described below or require the disclosures made below ("Applicable State Privacy Laws"). Privacy laws change frequently, and some may not currently apply to us. You may contact us to ask whether these rights apply in your state. The Creative League Company is the controller of your personal information for purposes of Applicable State Privacy Laws. For purposes of this section, "personal information" has the meaning given to "personal data" or "personal information" under the Applicable State Privacy Laws. The rights below do not apply to you if you are not a resident of a state that grants them.

Privacy rights. Depending on your state, Applicable State Privacy Laws may grant you the right to:

Confirmation — to confirm whether we are processing your personal information.
Access — to request a copy of the personal information we have collected about you.
Correction — to correct inaccurate personal information about you.
Deletion — to ask us to delete personal information about you.
Portability — to obtain a copy of the personal information you provided to us in a portable, readily usable format, to the extent technically feasible.
Opt out of the sale of personal information, processing for targeted advertising, and certain profiling.

Our practices. Riff does not sell your personal information, does not process personal information for targeted advertising, and does not engage in profiling that produces legal or similarly significant effects. Because we do not engage in these activities, there is nothing for you to opt out of, but you retain all other rights described above.

Nondiscrimination. You are entitled to exercise these rights free from discrimination.

How to exercise your rights. You may submit a request to confirm, access, correct, delete, or port your personal information by contacting us at admin@theriffapp.com or by writing to us at the mailing address above. We cannot process your request without sufficient detail to understand and respond to it.

Identity verification. We may need to verify your identity, and confirm your state of residency, before responding to certain requests.

Authorized agents. An authorized agent may submit a request on your behalf once we verify the agent's identity and authority as permitted by law.

Appeals. If we deny your request, you may appeal by contacting us at admin@theriffapp.com within 45 days of our decision (or any longer period required by law). Please include your name, contact information, details of the original request, and why you believe the denial should be reconsidered. We will respond in writing within the timeframe required by law.

Sensitive data. We do not require you to provide data classified as "sensitive" under Applicable State Privacy Laws.