Privacy Policy

1. Who is responsible

The controller for Rivals and berivals.app is:

2. This website

Hosting

berivals.app is hosted by Vercel. When you visit, Vercel processes your IP address and basic request data (browser, time, page) to deliver the site and protect it from abuse. These logs are kept briefly and are not used to identify you.

Beta waitlist

If you join the beta, we store your email address with our email provider Resend, send you a confirmation and your TestFlight invite, and occasionally tell you about updates to Rivals. Every email has an unsubscribe link, and you can ask us to delete your address at any time.

Analytics

We measure visits with privacy-friendly analytics (Vercel Web Analytics, Vercel Speed Insights and Visitors) to see which pages are read, where visitors come from, and how fast the site loads. We don’t use advertising cookies, and we don’t build profiles or sell data.

3. The Rivals app

Rivals is in beta on iPhone. What follows describes that app. An Android version is in the works; when it arrives it will use the equivalent Google services, and this policy will say so before it ships.

Account

To create an account we collect your name, username, phone number and date of birth. The phone number is stored as a one-way hash, so we can’t recover it. Your date of birth confirms you meet the minimum age.

Profile

You can add a photo, a bio, social links and a profile colour. Your rivals and people you challenge can see them. You can change or delete them at any time.

Health data

With your permission, Rivals reads steps, distance, active calories, workouts and sleep from Apple Health, only to score the challenges you take part in. It reads; it never writes anything back to Health. Screen Time challenges use Apple’s Screen Time framework, which tells the app when you pass a threshold, not which apps you used. Health data is never used for advertising, never sold, and never shared except with the rivals in your challenge, as scores.

Location

Some challenges are settled by being somewhere — the gym, the office. For those, and only for those, Rivals asks for location while you use the app. When you check in, it takes a reading of where you are and how precise that reading is, and compares it against the place and radius the challenge was set to. If your phone is set to approximate location, it asks once per check-in for a precise one; decline and the check-in simply can’t be judged.

Rivals does not track you. There is no background location, no location while the app is closed, and no record of your movements — only the single reading taken at a check-in you started yourself. Your rivals see whether the check-in was at the agreed place and how precise it was, not a map of where you are. Challenges without a place never ask for location, and you can refuse or withdraw the permission in iOS Settings at any time.

Camera and photos

Photo challenges are proved with a photo taken in the app, in the moment. Rivals asks for the camera for that and nothing else. It cannot read your photo library — the only library permission it holds is the one tosave a win or badge card you asked it to save.

Finding friends

If you let Rivals look at your contacts, it does so to find people you know who already use the app. The phone numbers never leave your phone: each one is turned into an irreversible SHA-256 hash on the device, and only those hashes are sent, to be matched against the equally hashed numbers of existing accounts. We cannot read a number back out of a hash, and the app itself cannot read the stored hashes. We do not keep your address book, and we never message anyone in it. You can decline, and revoke it later in iOS Settings.

Challenges and proof

We store your scores, check-ins, chat messages, reactions, and the photos you submit as proof. Everyone in the same challenge can see them. Proof photos are taken live through the camera in the app, never picked from your library. Votes on proofs show who voted; reasons for a “no” are anonymous.

Notifications

If you allow notifications, we store a push token from the Apple Push Notification service to tell you about challenges, results and reminders. You can turn them off in your device settings.

Purchases

Rivals PRO is sold through the App Store. We receive your subscription status, never your payment details.

Diagnostics and support

Crash and performance reports are collected by the operating system and sent to us with your app version and device model, to fix bugs. When you report a problem, we receive what you write and your app version.

4. Legal basis

• Contract (GDPR Art. 6(1)(b)): your account, profile, challenges and purchases.
• Consent (Art. 6(1)(a) and 9(2)(a)): health data, location, camera, contacts, notifications and the beta waitlist. You can withdraw it at any time, in your device settings or by writing to us.
• Legitimate interest (Art. 6(1)(f)): security logs, diagnostics and website analytics.

5. Who processes data for us

• Supabase: database, authentication and file storage, hosted in the EU.
• Vercel: hosting and analytics for this website.
• Resend: sending emails and storing the beta waitlist.
• Visitors: website analytics.
• Apple: app distribution, purchases, push notifications, and the Health, Screen Time and location frameworks on your device.

Where a provider processes data outside the EU, the transfer is covered by the EU Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

We keep your data while your account is active. When you delete your account (Settings → Delete account), your profile, health data, challenges and photos are permanently deleted within 30 days. Beta waitlist addresses are deleted when you unsubscribe or ask us to. Technical logs are deleted after 90 days. Anonymous, aggregated statistics that can’t be linked to you may be kept.

7. Your rights

You can ask for access to your data, a copy in a machine-readable format, correction, deletion, restriction, and object to processing based on legitimate interest. Write to support@berivals.app; we answer within 30 days. You can also complain to a data protection authority, such as the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the one where you live.

8. Children

Rivals is for people aged 16 and over. We don’t knowingly collect data from younger children. If you think a child under 16 has an account, tell us and we’ll delete it.

9. Changes

When this policy changes in a meaningful way, we’ll tell you in the app or by email. The date at the top shows the latest version.

10. Contact

Questions about your data: support@berivals.app. Company matters: hello@board.ly.