Privacy Policy

Updated October 14, 2026

1. Who we are

Rori is an independent project, run by one person in Minnesota, United States. Every question about privacy, including a request to see or delete your data, goes to hello@rorifocus.com. A real person reads it.

2. What the app collects, and why

All of this is used only to make the app work, is linked to your account, and is never used for tracking or ads.

• Name. The name you type, or the one Apple gives us if you sign in with Apple. Your friends and your league see it.
• Email address. To sign you in and to send the emails described in section 7. With Sign in with Apple it can be Apple's private relay address.
• Contacts: your in-app friends. Who your friends are, friend requests and the people you blocked. This is Rori's own friends list. We never read your phone's address book.
• Gameplay content. Your coins, streak, rooms, closet and Rori's look, kept as a backup so a new phone picks up where you left off, and your points in the weekly league.
• Other content you write. If you report someone: the reason you pick and the short note you write.
• User ID. Your account number and your @username. It also links your Rori Plus purchase to your account.
• Device ID. Your phone's push notification token, so a friend's high five can reach you. It is Apple's token for Rori. It is not an advertising ID.
• Purchase history. Whether Rori Plus is active and your purchase records for it. Apple handles the payment, see section 8.
• Product interaction. Simple in-app facts that run the game: whether you kept your daily goal (yes or no), focus blocks and their minutes, and high fives or visits you send.
• Other data. Your time zone, your daily rule as two numbers (like "4 opens a day, 5 minutes", never which app), your Friends notification switch, and whether the weekly email and Rori news are on.
• Crash and slow-down reports. If the app crashes or hangs, it can send a small technical report: app version, iPhone model, iOS version and where in the code it happened. It holds no names, no content and no app choices. It may carry your account number if you are signed in. We keep these for 30 days (7 days if you were signed out).

3. What we do not collect or do

• We do not read your address book, and we do not ask for your location.
• We do not see which apps you have, which you use, or for how long.
• We do not use advertising identifiers, and we do not ask to track you across other apps or sites.
• We do not sell your data, share it for advertising, or show ads.
• We do not send what you type to any AI service. Rori's words are written by us and live inside the app.
• Photos: the app can only add your share card to Photos when you tap Save. It never reads your photos.

4. Screen Time stays on your iPhone

Rori uses Apple's Screen Time tools. Apple designed them so that an app like Rori gets sealed tokens instead of app names. The apps and categories you pick to block, your limits, schedules and passes, and your usage stay on your device. They are not in your account and not in your backup. Because of that, we cannot see them, restore them or delete them for you. Deleting the app removes them.

5. Who helps us run Rori

These companies process data for us, only to provide their service:

• Supabase, our server and database. It holds your account and everything in section 2.
• Apple, for the App Store and payments, Sign in with Apple, and push notifications.
• RevenueCat, which checks your Rori Plus subscription with Apple. It gets your account ID and your purchase records, never your card details.
• Resend, which sends our emails: your sign-in code, the weekly recap and Rori news. It gets your email address, and your name and weekly numbers for the recap.

That is the whole list. We would hand data to anyone else only if the law truly required it, such as a valid court order. These companies may store data in the United States and other countries. Some providers process data in the US under Standard Contractual Clauses or the EU–US Data Privacy Framework.

Other Rori users can see only what the game shows them: your name, @username, Rori's look, your points and your daily rule numbers in the league, and a bit more for your friends, like your streak. Nobody else sees your email, time zone or subscription. You can block and report anyone.

6. Signing in

You can sign in with Apple or with your email: we send a six-digit code, you type it in. We keep no password.

7. Notifications and emails

Most of Rori's reminders are made on your phone. Friend notifications (high fives, visits, nudges, requests, league results) come from our server through Apple. You can switch them off in Rori's Settings or in iOS Settings.

We email you for three reasons: your sign-in codes, the weekly recap of your week (Rori Plus), and Rori news. Sign-in codes are always sent, because they are how you sign in.

We email customers about Rori under the existing-customer rule. You can opt out any time: tap No thanks when you sign up, or use the unsubscribe link in every email, or write to hello@rorifocus.com.

We keep a record of when and how you agreed (date, wording, country).

8. Subscriptions and payments

Rori Plus is billed by Apple through your Apple ID. We never see your card or bank details. Apple tells us, through RevenueCat, whether your subscription is active and when it renews or ends. Deleting your Rori account does not cancel the subscription: cancel it in iPhone Settings, under your name, then Subscriptions.

9. How long we keep it, and deleting your account

We keep your account data until you delete your account. A few things are cleared sooner: waiting friend notifications after 14 days, high fives, visits, nudges and answered friend requests after 30 days, subscription event records after 180 days, and crash reports as in section 2.

To delete your account: open Rori, then Settings, then Delete account. Or write to hello@rorifocus.com from the email address on your account and we will do it for you.

What deletion removes: your profile, name and email, backup, streak and coins, friends, league history, push token and your reports, along with your sign-in and your customer record at RevenueCat. If you used Sign in with Apple, we also revoke that link with Apple. You are taken off our news list. It cannot be undone. A report someone made about you keeps only the name it showed. Our providers' routine backups roll over on their own schedule.

10. Your rights

Wherever you live, you can write to hello@rorifocus.com to see what we hold about you, get a copy, correct it or delete it. We answer within 30 days and it is free. We may ask you to write from your account's email address so we know it is you.

If you live in the EU, the UK or Switzerland, you also have the GDPR rights of access, correction, erasure, restriction, portability and objection, and you may complain to your local data protection authority. If you live in California, you have the right to know, delete and correct, and to opt out of sale or sharing. There is nothing to opt out of, because we do neither.

Legal bases

• Contract: your account, sync, friends and subscription.
• Legitimate interest: Rori news to existing customers (you can opt out any time), security and crash reports.

11. This website

rorifocus.com has an optional form where you can leave your email to hear about the launch. That address goes to Kit, an email service, and you can unsubscribe from any email or by writing to us. The site is hosted by Vercel, which keeps routine server logs and a visit counter that uses no cookies and cannot tell who you are. The site sets no cookies and has no ads.

12. Children

Rori is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has an account, write to us and we will delete it.

13. Security and changes

Data travels over HTTPS and sits behind access rules on our server, though no method is perfectly secure. If this policy changes, we will update the date at the top, and for a significant change we will tell you in the app or by email.

14. Contact

hello@rorifocus.com — for privacy requests, or anything else.