Ritmo

Privacy Policy

Effective: 18 August 2026 · Last updated: 18 August 2026

The short version

Ritmo helps you plan and reflect on your time. To make that work across your devices — and across iPhone and Android — the things you create in Ritmo (your schedule, captures, notes, reflections, goals, persona answers, and household setup) are stored on your device and synced to Ritmo's own backend, run on Cloudflare, tied to your account. On iPhone they also sync through your private iCloud.

Some things stay on your device only: anything you read from Apple Health, your calendar and reminder contents, voice-capture audio (transcribed on-device, then discarded), and photos you attach to captures.

The one time your Ritmo content is sent to another company for processing is when you use the AI assistant — then the conversation and the relevant schedule context go to Anthropic to generate a reply. We don't sell your data, run ads, or track you across other apps. We use no analytics or advertising SDKs. You can delete everything we hold, from inside the app, at any time.

Who we are

Ritmo ("Ritmo", "we", "us") is an independent app operated from Ghana. You can reach us at support@app-ritmo.com. For the purposes of the GDPR / UK GDPR, Ritmo is the data controller for the information described here.

What we collect, and why

Information you give us directly

What	Why	Where it lives
Email address	Sign-in by one-time code, and to recognize your account	Stored on our Cloudflare backend as your account identifier (email sign-in) and used to deliver the code. No marketing — there is none.
Apple / Google sign-in identifier	To recognize you across devices without a password	An opaque, per-app identifier — not your real Apple or Google account. Stored on our backend as your account key.
Your name (optional)	So the app can greet you	Kept on your device only. If you use Sign in with Apple, Apple offers it once at first sign-in; we don't re-request it.
Your Ritmo content — schedule blocks, captures, notes, reflections, goals, tasks, weekly reviews, observances, persona/calibration answers, and household setup	This is the app's whole function, and it must be available on all your devices	On your device, synced to our Cloudflare backend under your account, and (on iPhone) through your private iCloud.
Voice-capture audio	To turn a spoken note into text	Transcribed on-device; the audio is discarded and only the text is kept (and then synced as content, above).
Photos attached to captures	So a snapshot can become a schedulable item	Stored with that capture. Synced as your content; never shared beyond your account.
Calendar events (Apple, Google, Outlook) & Apple Reminders	To show alongside your Ritmo schedule and let you plan around them	Read with your permission and shown in the app. Connecting Google or Outlook uses their OAuth sign-in. On Android, Ritmo can also adjust or remove calendar events it manages.
Apple Health signals (e.g. sleep, activity), if you connect Health	To shape gentle scheduling and recovery suggestions	Read from HealthKit on your device and used there. Not sent to our backend.
Subscription status	To unlock paid features and honor your plan	Your purchase is verified with Apple or Google; we store the resulting entitlement (plan + expiry) on our backend, not your card details.

Information collected automatically

What	Why	Where it lives
A per-install device identifier	To attribute which device wrote which record, and to secure the app with App Attest	On your device and on our backend, tied to your account.
Sign-in & rate-limit counters	To deliver one-time codes and prevent abuse of the service	Cloudflare KV, keyed by email and a hashed IP, expiring on a short window.
Crash, hang & performance reports	To find and fix bugs	Prepared by Apple's MetricKit on your device and forwarded to our backend, stored ~30 days keyed by a hashed IP — not your account, and with no schedule content, names, emails, or conversations. On by default; you can turn it off in the app's Diagnostics settings.

What we deliberately do not collect

Your real Apple or Google account. Sign-in gives us only an opaque per-app identifier.
Your location. We never ask for it.
Your contacts. We never ask for it.
The advertising identifier (IDFA / GAID). We never read it.
Cross-app or cross-site behavior. We have no ad-network, analytics, or tracker integrations of any kind.
Your full photo library. When you attach a photo, the system picker runs out-of-process; we only receive the one you pick.

Where your information goes

Beyond your device, your information travels only along these paths, each for a specific purpose:

Sign-in. Your email or sign-in identifier goes to our Cloudflare backend to issue and check your one-time code; the code itself is delivered by email through Resend.
Content sync. Your Ritmo content syncs to our Cloudflare backend so it's available on all your devices and on both iOS and Android. On iPhone it also syncs through your private iCloud, which Apple operates.
AI assistant (when you use it). Your conversation and the relevant schedule context are sent to Anthropic through our backend to generate a reply. Anthropic does not train its models on this API traffic, and our backend does not log the conversation contents.
Calendar & reminders (when you connect them). Connecting Google or Outlook uses their OAuth sign-in; Ritmo reads your events to show them, and on Android can adjust or remove events it manages.
Subscriptions. Purchases are verified with Apple's or Google's servers to confirm your plan.
Diagnostics. Anonymized crash and performance reports go to our backend, as described above.

When you share within a household, the household-shareable records (members, coverage, and household-linked blocks) become readable by the other members of that household. Your private records stay private.

Third parties who process data for us

Apple — Sign in with Apple, iCloud sync, App Attest, and App Store purchases. Apple's privacy policy.
Cloudflare — hosts our backend, database, and rate-limit storage. Cloudflare's privacy policy.
Anthropic — processes your AI-assistant conversations when you use that feature. Anthropic's privacy policy.
Google — Sign in with Google (Android), Google Calendar, and Google Play purchases, when you use them. Google's privacy policy.
Microsoft — Outlook Calendar, when you connect it. Microsoft's privacy statement.
Resend — delivers your sign-in code emails. Resend's privacy policy.

We do not share your data with marketers, data brokers, advertisers, analytics platforms, or any third-party SDK not listed here.

How long we keep things

Your account and content on our backend: for as long as your account exists. When you delete your account, we remove them (see below).
On your device / in iCloud: until you delete the app, wipe local data in the app, or remove the iCloud records with Apple's tools.
Sign-in and rate-limit counters: expire on a short window (typically within an hour).
Diagnostics: about 30 days, keyed by a hashed IP, then deleted automatically.
AI conversations: not stored by us — pass-through only.

Your choices and rights

Access — email support@app-ritmo.com from your account's email and we'll respond within 30 days.
Delete your account — from inside the app. This removes your content, settings, entitlements, and account identifiers from our backend, and signs your devices out so they can't restore the data.
Export — export your data from inside the app to keep your own copy.
Correct — most of your data is editable directly in the app.
Object / withdraw consent — turn off any opt-in feature (AI assistant, calendar, Health, diagnostics) in the app's settings, or email us with specifics.

One thing we keep after deletion. To enforce our "one free trial per Apple or Google account" rule, we retain a one-way cryptographic hash of the account identifier that started the trial. It cannot be reversed to your email, name, or account, and it carries none of your content — it only lets us recognize that a trial was already used. Everything else tied to your account is deleted.

If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

International transfers

Ritmo is operated from Ghana, and the providers above (Apple, Cloudflare, Anthropic, Google, Microsoft, Resend) process data on infrastructure that may be located in the United States, the European Union, or elsewhere. By using Ritmo you understand your information may be processed in countries other than your own, under those providers' safeguards.

Children

Ritmo is intended for people aged 16 and over (or the age of digital consent in your country, if higher). We do not knowingly collect data from children below that age. If you believe a child has provided us data, contact support@app-ritmo.com and we will delete it.

Security

Data in transit is protected with TLS.
On-device data uses the operating system's hardware-backed encryption.
Sign-in uses Sign in with Apple (cryptographically signed by Apple) or one-time email codes (6 digits, short expiry, limited attempts).
Our backend uses Apple's App Attest to confirm requests come from a genuine Ritmo install, and can revoke a device's access if your account is deleted or compromised.

No software is perfectly secure, and we don't claim otherwise — but we design conservatively, review our boundaries, and act quickly on anything we find.

Changes to this policy

If we change this policy we'll update the date above, and for material changes we'll notify you in the app and give you notice before the change takes effect.

Contact

Questions, concerns, or requests: support@app-ritmo.com. We aim to respond within 5 business days; complex requests may take up to 30.