This policy covers every version of Riva: the Android and iOS apps, the web app, the Chrome extension and the riva.sh website.
In short
- Riva has no accounts and never asks for your name, phone number, email or ID.
- Private keys and the recovery phrase are created on your device and never leave it.
- Riva does not collect your wallet addresses, balances, transaction amounts or list of assets.
- Only anonymous usage events, such as installing or opening the app, are recorded.
- Riva sells no data.
Keys and recovery phrase
Private keys and the recovery phrase are created on your own device and stored there encrypted: on phones, in the system’s secure storage (Keychain on iOS, Keystore on Android); in the web app and the Chrome extension, in the browser’s storage, encrypted with a passkey, a password or both. Riva has no server that holds them and never has access to them.
Information that stays on your device
Wallet names, public addresses, settings, token lists and the history the app shows are stored only on your device. Removing the app or the extension removes them too.
Network requests
To show balances, send transactions, show prices and make swaps, the app sends requests directly to:
- public blockchain nodes and services;
- exchanges and price services, for the Market section;
- swap services such as LI.FI and THORChain, when you start a swap yourself.
These services see your IP address and the public addresses requested, and follow their own privacy policies. The web app and the Chrome extension also read toman exchange rates from a Riva server, which does not log requests.
Anonymous usage statistics
To know how many people use Riva and how well the app works, these events are recorded in PostHog:
- installing the app, opening it and time spent in it;
- the names of the screens you open, and actions such as copying an address or switching the theme;
- a wallet created or imported;
- a transfer or swap that the network accepted.
Each event carries only the platform (Android, iOS, web or the Chrome extension), the operating system, the device type, the screen size, the browser and the app version. No address, network, token, amount, balance or transaction id is ever sent. An install is identified by a random id made on the device, not by a device identifier, and each transfer and swap gets a new random id so it cannot be linked to others or to your install.
Anonymous session replay on Android and iOS
The Android and iOS apps record usage sessions in Microsoft Clarity so we can find design problems. All screen content, including the recovery phrase, addresses and balances, is masked before recording; only the screen layout, taps and moves between screens are kept. The web app and the Chrome extension record no sessions.
Chrome extension
The Riva extension runs in Chrome’s side panel and requests these permissions:
- sidePanel: to open Riva in the side panel;
- storage and unlimitedStorage: to keep the encrypted wallets and settings on this computer, without Chrome clearing them when space runs low.
The extension has no access to the content of the websites you open, does not read your browsing history and adds nothing to pages. Riva’s use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
The riva.sh website
The Riva website uses Google Analytics to count visits and popular pages. Google sets cookies for this and sees your IP address. You can block it with an ad blocker or the Google Analytics opt-out add-on.
Selling and sharing data
Riva sells no data, uses none for advertising and gives none to anyone other than the services named on this page.
Age
Riva is not intended for anyone under 18 and does not knowingly collect information from them.
Changes to this policy
If this policy changes, the date at the top of this page is updated. If an important change is made, the app shows it to you before you continue.
Contact
For questions about this policy, write to privacy@riva.sh