River Privacy Policy

Version: draft of 29 October 2026. Effective date: to be determined.

River (provisional name; final trade name: to be determined) is an iPhone app for learning No-Limit Texas Hold'em poker. This policy explains which data River processes, for what purpose, on what basis, for how long, with whom it is shared and what your rights are. It applies to the app and to River's web pages (privacy, terms of use, support and responsible gaming).

It takes into account the Swiss Federal Act on Data Protection (FADP) and the European Union's General Data Protection Regulation (GDPR), as River is also offered in countries of the European Union.

In short

River works without a name, an email address or a password: an anonymous account is created automatically.
The full history of your simulated hands stays on your iPhone. Only your progress and your evaluated decisions are synchronised.
No advertising, no advertising identifier, no tracking, no third-party analytics tools in the app.
Usage analytics only run with your consent, which you can change at any time.
Payments are processed by Apple: River receives no payment data.
You can delete your account and your data directly in the app.

1. Controller

ILYGO Sàrl, Switzerland.

Postal address: to be determined
Swiss business identification number (UID): to be determined
Data protection contact: to be determined
Representative in the European Union (Art. 27 GDPR): to be determined

2. Data processed

2.1 Account and device

The first time the app is launched with an Internet connection, River creates an anonymous account without any action on your part. This account includes:

a random internal identifier;
a second random identifier, separate from the first, sent to Apple when you make a purchase so that the purchase can be linked to your account;
the account creation date, the app language, the date on which you confirmed that you are 18 or older, your choice regarding usage analytics and your starting level (placement test);
sign-in tokens: an access token valid for 15 minutes and a renewal token valid for at most 90 days. The server keeps only a fingerprint of it; on the iPhone, they are stored in the iOS keychain;
for each device: an installation identifier generated by the app, the platform, the app version, the iOS version and the date of the last connection.

River does not record your name, your email address or your phone number.

2.2 Sign in with Apple (optional)

If you choose "Save my progress", River links your account to your Apple ID and records:

the stable identifier that Apple provides to River for your Apple ID;
an Apple token, stored encrypted and used only to revoke the link with Apple when your account is deleted, as required by Apple.

2.3 Progress and learning

Your progress is recorded on your iPhone as events, then synchronised with the server:

placement test, lessons started, steps and lessons completed, exercise answers, exams, reviews, answers to the daily puzzle, uses of the "What if?" mode, hands played in free play (for the daily limits), streak freezes used and settings changes (without personal data);
for each decision evaluated by the coach: the game situation, the action chosen, the reference action, the loss of expected value (EV) and the difficulty of the situation;
for each event: the date and time, the local date and the time-zone offset, which are used to calculate your streak, the daily limits and review due dates.

The server also keeps a summary state (progress, decision index, review queue, streak, counters) to restore your progress quickly, as well as your daily puzzle results (date, puzzle, success, time of the answer), which are used to display an overall success rate.

The full history of your simulated hands is never sent: it stays on your iPhone, limited to the last 500 hands.

2.4 Purchases and subscription

Purchases are made through the App Store. River receives signed information about your transactions from Apple:

identifiers of the transaction and of the original transaction, product purchased, purchase and expiry dates and, where applicable, revocation date (for example after a refund);
type of offer (for example the free trial), environment (real purchase or test purchase) and the random identifier linked to your account (see 2.1);
notifications sent by Apple to River's server: renewal, expiry, refund, billing failure.

From this, River determines your Premium access: status, expiry date and any grace period.

River receives no payment data (card number, billing address): payment is handled entirely by Apple.

2.5 Usage analytics and diagnostics, only with your consent

If you accept, on the privacy screen at first launch or in Settings → Privacy, River sends:

named usage events (for example "lesson completed" or "offer displayed"), with non-personal properties, the app version and the time;
technical diagnostics provided by iOS (MetricKit): crashes, hangs and energy use.

These events are linked to a pseudonym calculated from your account identifier using a secret key, not to the identifier itself.

Without your consent, no event is sent. If you withdraw your consent, no further events are sent and those waiting to be sent are deleted from your iPhone.

Apple may also provide ILYGO, in App Store Connect and Xcode, with statistics and crash reports, depending on the sharing settings with developers that you have chosen in iOS.

2.6 Security

Audit log: River records sensitive operations on accounts (creation of an anonymous account, link with Apple, account merge, deletion, linking, update and revocation of a subscription) as well as all administration operations. Each entry records, in particular, the account concerned, designated by its pseudonymous internal identifier, the operation, its result and its date; it contains no identifying data (no Apple identifier, IP address or installation identifier) and no secret.
Request limiting: to protect the service against abuse, the server counts requests per IP address and, depending on the operation, per account, per installation or per family of renewal tokens (one per device). These counters contain only a fingerprint calculated with a secret key (HMAC), never the IP address or the identifier in clear, and are erased at the latest about 24 hours after the last request concerned.
Technical logs: the API's technical logs contain no IP address, no token and no secret. They reproduce the audit log entries identically and may therefore contain, like them, the pseudonymous internal identifiers of an account, its devices or its subscriptions. They are kept for at most 90 days.

2.7 Data kept only on your iPhone

events awaiting synchronisation and the state of your progress;
the history of simulated hands (last 500 hands);
downloaded learning content;
your preferences, including your privacy choices and reminder time;
the last known state of your Premium access.

Reminders are local notifications scheduled on the iPhone: River does not collect any push notification token.

2.8 Web pages

River's web pages use no cookies and no trackers. Links shared from the daily puzzle lead to a redirect page to the App Store, without any personal parameter.

2.9 Support requests

If you contact support, ILYGO processes the information you send (your message, the address to reply to) and, if you provide it, the support identifier shown in Settings, which is used to find your account.

3. Purposes and legal bases

Purpose	Data	Legal basis under the GDPR
Providing the app: account, saving and synchronising progress, restoring on another device, merging accounts	2.1, 2.2, 2.3	Performance of the contract (Art. 6(1)(b))
Verifying purchases and managing Premium access (restore, renewal, refund, daily reconciliation with Apple)	2.4	Performance of the contract (Art. 6(1)(b))
Displaying the overall success rate of the daily puzzle	Puzzle results (2.3)	Performance of the contract (Art. 6(1)(b))
Restricting the app to people aged 18 and over	Date of age confirmation (2.1)	ILYGO's legitimate interest in restricting the app to an adult audience (Art. 6(1)(f))
Usage analytics and diagnostics, to improve the app and fix crashes	2.5	Consent (Art. 6(1)(a)), which can be withdrawn at any time
Aggregated statistics on the use of the service (progress, retention, trials and subscriptions), without individual data	2.1 to 2.4, and 2.5 only with your consent	ILYGO's legitimate interest in managing the service (Art. 6(1)(f)); consent for the data in 2.5
Security: preventing abuse, protecting accounts, recording sensitive operations	2.1, 2.6	ILYGO's legitimate interest in the security of the service (Art. 6(1)(f))
Support and exercise of your rights	2.9 and data required for the request	Performance of the contract (Art. 6(1)(b)); legal obligation for requests relating to your rights (Art. 6(1)(c))
Accounting obligations relating to sales	2.4	Legal obligation (Art. 6(1)(c)); scope to be determined

Under the FADP, ILYGO processes your data lawfully, in good faith and proportionately, only for the purposes set out above, and obtains your consent where required.

River does not sell any data and does not use it for advertising purposes.

4. Retention periods

Data	Retention period
Account, devices, Apple identity, progress, synchronised events, puzzle results	Until the account is deleted. An anonymous account, that is, one not linked to an Apple ID, with no activity for 13 months is deleted automatically.
Renewal tokens	At most 90 days; replaced at each use and revoked on sign-out, then erased when they expire. Deleted immediately with the account.
Purchase data (transactions, Premium access)	Until the account is deleted: they are then deleted with it. Any period required by accounting obligations: to be determined; if such an obligation is adopted, the purchase data concerned will be kept for that period instead of being deleted with the account, and this policy will be updated.
Apple notifications relating to purchases	13 months, and at the latest until the account is deleted.
Encrypted Apple token	As long as the account is linked to Apple. After a deletion, at most 7 days, only if revocation with Apple has to be retried.
Usage analytics and diagnostics (2.5)	13 months; deleted with the account. Events already received before you withdraw your consent are kept until this period expires, unless the account is deleted.
Audit log	90 days, including after the account is deleted (pseudonymous internal identifier of the account, without identifying data or secrets).
API technical logs	At most 90 days.
IP addresses and other counters used to limit requests	Never in clear: only a fingerprint (HMAC) is used as a counter, erased at the latest about 24 hours after the last request concerned.
Support requests	To be determined.
Server backups	Deleted data remains in the encrypted backups until their retention period expires (to be determined), then disappears automatically.
Data on your iPhone	Until the account is deleted or until sign-out, after confirmation. Hand history: last 500 hands.

Deleting the app from your iPhone does not delete your account on the server: to do so, use "Delete my account and data" (section 9).

5. Recipients and processors

ILYGO: only the people and agents authorised by ILYGO to operate the service access the data, to the extent necessary.
Hosting: server data is hosted in Switzerland or the European Union, on ILYGO's infrastructure. Exact hosting provider and location: to be determined.
Apple: Sign in with Apple, App Store (payment, subscription management, refunds), Apple's purchase verification services and notifications. Apple processes this data under its own terms and its own privacy policy.
Artificial intelligence agent (processor): ILYGO may use an artificial intelligence agent, supplied by a provider acting as a processor (provider and place of processing: to be determined), for the technical operation of the service and the handling of support requests. This agent uses a dedicated administration interface with limited permissions, and each of its operations is recorded in the audit log. It can access the data of an account (account summary without the content of events, export or erasure on request) only if ILYGO has given it explicit authorisation. The indicators it otherwise consults are aggregated and contain no individual data.
Authorities: where required by law.

6. Transfers outside Switzerland and the European Economic Area

River's server data is hosted in Switzerland or the European Union. Some recipients, such as Apple or the provider of the artificial intelligence agent, may process data in other countries. In that case, ILYGO relies on the safeguards provided by law, for example an adequacy decision of the Swiss Federal Council or of the European Commission, or standard contractual clauses. Safeguards chosen for each recipient: to be determined.

7. Security

All exchanges between the app and the server are encrypted (TLS).
On the iPhone, sign-in tokens are stored in the iOS keychain.
On the server, renewal tokens are kept only as a fingerprint, the Apple token is encrypted and backups are encrypted.
Usage analytics data and request-limiting counters are pseudonymised.
Administrative access is restricted to technical accounts with limited permissions, and each operation is recorded.

8. Your rights

Within the limits provided by law, you may:

access your data (Art. 25 FADP, Art. 15 GDPR);
receive your data in a common electronic format or have it transmitted to another controller (Art. 28 FADP, Art. 20 GDPR);
have inaccurate data rectified (Art. 32 FADP, Art. 16 GDPR);
have your data erased (Art. 32 FADP, Art. 17 GDPR), directly in the app (section 9);
request restriction of processing (Art. 18 GDPR);
object to processing based on legitimate interest (Art. 30 and 32 FADP, Art. 21 GDPR);
withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR);
lodge a complaint or report with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the European Union, the authority of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

How to exercise your rights:

Usage analytics: Settings → Privacy.
Erasure: in the app (section 9).
Access and portability: the app does not yet offer an export. Send your request to the contact given below (to be determined), stating the support identifier shown in Settings. ILYGO replies within 30 days and provides your data in JSON format.

Because River knows neither your name nor your email address, the support identifier is used to find your account. ILYGO may ask you for additional information to verify that the request comes from the account holder.

9. Deleting your account and your data

In Settings, choose "Delete my account and data", then confirm. This function is also available for an anonymous account.

On the server: your account data is deleted (account, Apple identity, devices, progress and synchronised events, puzzle results, purchase data subject to an accounting retention obligation to be determined, usage analytics). Your renewal tokens are deleted immediately: all your sessions are closed. The link with Apple is revoked with Apple straight away; if Apple cannot be reached, further attempts are made at increasing intervals (from a few minutes to 6 hours) for at most 7 days.
On your iPhone: River's data is erased and the app returns to the state of a new installation.
Offline: the deletion is queued and sent as soon as the network is back. In the meantime, only the minimal information needed to complete the deletion remains on the iPhone.
What remains temporarily: the audit log and the technical logs (at most 90 days), which keep the pseudonymous internal identifier of the account, without any identifying data or secret; the request-limiting counters, as fingerprints (HMAC), for about 24 hours at most; the encrypted Apple token if revocation with Apple has to be retried (at most 7 days); backups until their retention period expires (to be determined).
Subscription: deleting your account does not cancel your Apple subscription. The deletion screen offers a link to subscription management. If you later restore your purchases on a new account, the Premium access of an ongoing subscription is transferred to it.

Signing out (Settings, account linked to Apple) is different: after confirmation, it erases River's data on the iPhone but keeps your account on the server.

10. Minimum age

River is restricted to people aged 18 and over. At first launch, the app asks you to confirm this. Without this confirmation, it displays an explanation, gives access to no content and sends no data.

11. Automated evaluations

River's coach and decision index automatically evaluate your game decisions, by calculation, for learning purposes only. These evaluations are calculated on your iPhone, have no legal effect and do not significantly affect you. River makes no automated individual decision within the meaning of Art. 21 FADP and Art. 22 GDPR.

12. Changes

ILYGO may update this policy, in particular when the app evolves. The version date is shown at the top of the page. In the event of a significant change, ILYGO will inform you appropriately, for example in the app.

13. Contact

For any question about this policy or your data: to be determined.