Delete your Riffl account.

1 · How to ask

Send an email from the address you use to sign in to Riffl:

• To: privacy@riffl.app
• Subject: Delete my Riffl account

Nothing else is needed in the message. If your device can open an email from here, start the email; if not, copy the address above.

If you also used a different address with Riffl, for the waitlist or the contact form, name it in your email. We confirm each address with that address before we look for anything under it.

It helps to sign out of Riffl on each of your phones first: in the app, open Settings, tap your name or email at the top, then tap Sign out. Signing out keeps your records on the phone.

2 · What happens next

We write to the address on your account, in a new email with a one-time code in its subject. To go ahead, reply from that address with YES DELETE and the code at the top of your reply. The code works once, for 14 days. If you don’t reply, or you tell us you did not ask, nothing is deleted.

We also check that your reply really came from that mailbox, and we never act on a request sent from a different address, even one that names your account.

Once you confirm, we delete your account within 30 days and write to tell you when it is done.

Deleting an account cannot be undone. If you sign up again later with the same email, you get a new account, and nothing from the old one comes back from our servers. If you are a Founding Riffler, your badge and its number go with the account, and the number is never given to anyone else.

3 · What we delete

From our servers, for your account and for each phone that signed in to it (a phone that has since signed in to someone else’s account is theirs now, and is left alone):

• Your account and its email address.
• The list of phones linked to your account, and the links themselves.
• Your Sync data: the records your phones uploaded, and Sync’s list of your phones. We could never read those records anyway. They are encrypted on your phone, with a key made from your passphrase, before they leave it.
• Your scan allowance, any scan credits and your Riffl Plus subscription, and the log of when you scanned (how many scans and what they cost us, never what was in the picture).
• Your referral and invite records: a code you used, the invite code you could share, and your address on the records of anyone who used it.
• Your waitlist entry, if you joined from that address, and the note our own inbox got when you joined.
• Messages you sent us from that address, through our contact form or by email, apart from your deletion request (kept, as below).
• Our record of which of our emails were sent to you, and any sign-in code still waiting to be used.

4 · What we keep, and why

• Purchase records. Google Play keeps its own record of anything you bought through it, under Google’s policies, and that record is not ours to delete. We keep a minimal record of what you bought (what, when, and the store’s reference for it), without your email, because tax and accounting law require it. The account it pointed to no longer exists.
• A request to stop emailing you. If you ever asked us to stop sending you email, we keep that request (your address and when you asked), so no mailing list can reach you again by mistake.
• Your request itself. The record that you asked and that we did it stays: our email thread with you in our privacy inbox, or, for a request made in the app, a record with no name or email address on it.
• Records with nothing that leads to you. Daily counts, crash reports and other records that carry no email, account or phone id stay. Nothing in them can be matched to your account.
• Older backups. Backups of our database made before your account was deleted still hold a copy until they are deleted. We never restore one without deleting your account from it again.
• Our server’s request log. Our hosting provider logs the web address of every request to our server. If you ever used the unsubscribe link in one of our emails, that address carried your email, encoded, so the log holds it until the log expires, which is 30 days at the logging service’s default setting.
• Our email service. The service that delivers Riffl’s emails keeps its own contact lists and a log of messages it sent. We remove your address from its lists, and from its log where it lets us.

5 · The records on your phone

Riffl keeps your records on your phone, and deleting your account does not touch them. They stay on the phone until you delete them there.

To wipe a phone as well, open Riffl, go to Settings, then Security (or About and data), and use Delete all data. It removes every record from that phone and cannot be undone. Do it on each phone you want wiped.

A phone you keep using carries on as a new install: if Riffl is full at the time, it joins the waitlist like any new phone.

6 · Riffl Plus and refunds

Deleting your account cancels a Riffl Plus subscription bought through Google Play, so it does not renew. A subscription bought through the App Store is billed by Apple and keeps renewing until you cancel it on your iPhone in Settings (your name, then Subscriptions); the app shows you where before you delete. It does not refund the period you have already paid for, and Plus ends with the account. Refunds for a subscription bought through Google Play go through Google Play, under its refund policy.

7 · Questions

Write to privacy@riffl.app. How Riffl handles your data, and your other rights over it, are in our Privacy Policy.