Rikko

Privacy Policy

Last updated 2026-11-13

This policy explains how possible OÜ (“Rikko”, “we”) processes personal data when you use the Rikko app, API, pay pages, and shared media pages. The controller is possible OÜ, Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Harju maakond, Estonia. Contact: support@rikko.app.

If someone added an IOU about you

You have privacy rights even if you have never created a Rikko account. The person who created the IOU supplied your name, any phone number or email they selected, and the claimed amount or item, reason, due date and relationship. They may have typed this information or selected your entry in their device's contacts; Rikko does not obtain a full address book. Later activity, such as a payment claim or a reply, comes from the people using that IOU. We do not independently verify that you owe the money or item.

We use these details to keep the creator's informal record, present the IOU and enable a reminder they choose to send. Our basis for information about a person who is not our account holder is legitimate interests in facilitating a genuine private IOU record and communication, subject to your rights and interests, not a contract you did not accept. An in-app friendship is separate from accepting any particular IOU. Information can be processed by the service providers below, seen by authorized IOU participants, and seen by anyone given its public link.

You can object to this processing or ask for access, correction, restriction or deletion by emailing support@rikko.app. No signup or payment is required. Tell us which IOU or contact information concerns you, without sending bank credentials or an identity document unless we explain why additional verification is necessary. Disputing an IOU or deleting an account does not automatically erase the creator's record; we review the specific request and any overriding grounds for retention. Retention, recipients, safeguards and complaint rights are described below.

Data we process

• Account and identity: display name, email, an optional public username you explicitly claim, a password hash, keyed contact indexes, legal-consent records, and active login sessions. Usernames are currently immutable after claiming. The iOS 1.0 sign-in flow uses email and password; it does not collect an Apple or Google account identifier or verify the account holder's phone number.
• Friends and invitations: friend requests, your accepted friendships, per-IOU invitations and your consent decisions. Your friend list is visible only to you; the other participant can see the relationship they share with you. Verified signed-in users can find an opted-in profile by its exact username and see its display name. We retain bounded daily request counters and hashed recipient counters to prevent repeated invitations.
• IOUs and payments: creditor and debtor details, IOU type, amount and currency for money IOUs or a free-text item description for non-money IOUs, reason, due date, relationship, reminder history, payment or fulfillment status, disputes, and payout handles. Debtor contact details and payout handles are encrypted at rest. Non-money IOUs have no payment instructions or payment claims; their creator records fulfillment.
• Content and safety: chat messages, reminder copy, uploaded source photos during composition and automated visual-safety results, generated memes/videos, GIF selections, public share links, blocks, and in-app or public-funny-page reports.
• Device and service data: push tokens, app/platform information, security-relevant IP data used for rate limiting, an opaque necessary browser cookie used to separate and de-duplicate public safety reporters, and limited crash diagnostics.
• On-device data: when you save a face for reuse, the selected photo copy and its crop/consent metadata stay inside Rikko's protected app storage on that device until you remove the face or sign out. IOUs created while signed out (including the debtor/contact, IOU type, amount, currency, item description, reason and due date) and signed-out payout handles are stored in operating-system protected storage on native devices until you import or remove them. Rikko's browser preview is for development and uses browser storage.

Offline account data

Offline storage notice, 26 October 2026: in app versions with account offline support, Rikko keeps a bounded account-specific copy of previously synchronized IOUs and payout details, together with queued IOU creations, edits and deletions, in operating-system protected storage on your device. On iOS this uses the device-only Keychain and is available only while the device is unlocked. It is not an independent backup, and a newly installed or signed-out app cannot retrieve your cloud records without an internet connection.

Queued changes are sent to your account when Rikko can reconnect and authenticate. The app distinguishes pending changes from confirmed server changes and asks you to resolve conflicts rather than silently replacing a newer record. Nudges, friend actions, payment-detail changes and cloud media still need internet; reconnecting does not automatically send a nudge or make a payment. Requests older than 30 days cannot be applied automatically. Unresolved local changes remain available for review or discard rather than being treated as successfully synchronized.

Signing out warns about unsynchronized changes before clearing account-scoped offline storage. Confirmed account deletion or a terminal session revocation also clears that local account storage when the app learns about it. A device that is offline cannot learn about a remote change or account deletion until it reconnects. The app's connectivity observer reads only connection-status booleans; it does not request your IP address, Wi-Fi name, hardware address or location for this feature.

To prevent a repeated synchronization request from creating duplicate changes, the server stores a minimal account-linked receipt: account and operation identifiers, operation type, IOU identifier, version timestamps, and a keyed digest of the request. The receipt does not contain copies of IOU text, contacts, payment details or response bodies. Receipts become eligible for deletion 30 days after the operation's original creation time, and bounded scheduled cleanup removes them; outages or cleanup backlogs can delay removal. Account deletion removes these receipts with the account. These are synchronization records, not verification that an external message was delivered or money was received.

Contacts

Rikko uses the operating system's single-contact picker. It does not request bulk address-book access. Only contact details you deliberately select and confirm for an IOU are sent over TLS and stored with that IOU. We do not upload or retain your full address book. Phone-number account discovery is unavailable. Inviting someone by phone opens your chosen external messaging app; the invitation does not prove ownership of a number or disclose whether its holder has a Rikko account.

Friendship does not establish that someone owes money. An IOU reaches the recipient as a separate invitation to accept, decline, or report and block. Accepted IOUs can receive text or media nudges inside Rikko; we store the message, sender, recipient, creation time and read status. Push notifications use generic copy, and private IOU details are shown after opening the app. Removing a friend revokes their existing in-app IOU connections while each creditor retains their financial records. Blocks prevent further delivery in both directions. Account export includes your username, relationship records, invitations and nudges; account deletion removes your friendships and invitation counters.

Purposes and legal bases

• Account and requested features (performance of our contract with you): account creation, authentication and recovery emails, private IOU storage and synchronization, accepted friend/IOU connections, requested nudges, public links, and media composition. Required account fields are identified in the app; without them we cannot create or secure your account. Claiming a public username, entering a debtor contact and using creative media are optional.
• Information supplied about someone else (legitimate interests): the creator's and Rikko's interest in keeping and communicating a genuine informal IOU, balanced against the named person's privacy and safety. The notice above explains the source and the right to object. This does not mean the named person agreed to Rikko's terms or accepted a debt.
• Optional notifications, GIF requests and photo safety processing (consent): push delivery only after you opt in, direct KLIPY discovery and usage signals only after the GIF privacy choice, and sending a selected face photo to OpenAI for moderation only after the disclosed confirmation. You can withdraw notification permission in device settings, withdraw GIF permission in Settings → GIF privacy, and decline future photo uploads without losing core IOU features. Withdrawal does not undo processing already lawfully carried out.
• Optional usage analytics (separate consent): where available in your app version, the “Help improve Rikko” setting lets you choose whether to send limited product-usage events to PostHog. It is off by default and separate from account acceptance, notifications and GIF consent. Declining or withdrawing does not restrict core app features.
• Security, safety and diagnostics (legitimate interests): protecting accounts and other people from fraud, harassment and service abuse, enforcing bounded limits, investigating reports, and diagnosing failures with minimized diagnostics. Measures include access restrictions and retention limits; these purposes do not authorize unrelated marketing.
• Rights requests and required legal compliance (legal obligation): responding to applicable data-protection requests or binding legal requirements. Necessary evidence for establishing, exercising or defending legal claims is processed on legitimate-interest grounds unless a specific legal duty applies.

GIF discovery is a separate optional third-party feature described below. A device permission, acceptance of these terms, or opening an IOU does not give blanket consent to advertising or tracking. We do not make credit scores, determine whether a debt is legally enforceable, or automatically confirm a payment. Automated safety checks and rate limits can stop an upload or action; you can contact us for help or a human review of a restriction.

GIF search and external providers

Before the first KLIPY request, Rikko explains the data involved and offers Continue or Not now. Text nudges and the owned meme catalogue work without this choice. Your choice and its notice version and timestamp are saved on that app installation. Until you choose Continue, Rikko does not read or create its KLIPY installation identifier or request provider discovery, usage measurement or media.

When GIF search is available in your version of the app and you use it, your device contacts KLIPY directly over TLS. Search requests include the search term you enter, or a request for trending GIFs, and a random installation-scoped identifier stored in ordinary app data. This identifier is not your Rikko account ID or an advertising identifier; it can be shared by accounts using the same app installation and is not reset merely by signing out. Rikko does not attach your email, contacts, IOU or payment details to these requests. Anything you type into the GIF search field is, however, sent as the search term.

GIF previews, playback and user-requested sharing use the exact media URLs supplied by KLIPY. KLIPY and its delivery providers receive your IP address and request metadata when your device loads this content. A share action also sends the selected GIF identifier, original search term and installation-scoped identifier directly to KLIPY for share measurement. Rikko does not route new GIF searches or share measurement through its API, or upload the selected provider media to Rikko's media store. If your app has GIF search disabled or has no valid client configuration, it makes none of these discovery or share-measurement requests.

For a GIF nudge sent inside Rikko, we store the KLIPY item identifier with your message, not a copy of the GIF or its delivery URL. When the recipient chooses to load it, their device sends that identifier directly to KLIPY to obtain the current preview and animation. Their Rikko account credentials, IOU details and message text are not included in that lookup. A deleted or unavailable provider item may no longer play; the message can still be reported or blocked.

To hand a selected GIF to another app, Rikko creates a temporary private file on your device. An active download or share keeps that file available while it is being used. When the system share sheet reports completion or cancellation, Rikko removes its own copy before it reports that outcome to the app. A system share completion is not a delivery receipt from the recipient.

Leftover copies from an interrupted share are removed the next time the app starts, returns to the foreground, or prepares another GIF. Rikko cannot run this cleanup while iOS has suspended or closed the app. If safe removal cannot be confirmed, Rikko pauses new GIF sharing and warns you not to resend a message that may already have been sent. Rikko cannot delete copies saved by the operating system, another app or a recipient.

The share sheet lists the apps on your device that can receive a GIF. You choose the app and the recipient; Rikko does not pick either for you and does not learn what the receiving app does with the file.

KLIPY processes search, viewing and sharing information to deliver GIFs and for its own analytics. Its privacy policy also describes personalization and advertising-related processing for integrations that use them. In Rikko's integration advertising is switched off, no advertising identifier is sent and no advertising SDK is included. Rikko does not track you across other companies' apps or websites and therefore does not ask for Apple's tracking permission. KLIPY handles the data it receives under KLIPY's Privacy Policy, which also explains your choices there.

You can withdraw through Settings → GIF privacy. Rikko stops in-flight provider work, discards its pending results and draft GIF references, removes its provider installation identifier, and stops displaying provider media. An already active share can finish its handoff without Rikko deleting the file while the receiver is reading it. Rikko removes its copy when that handoff ends. Withdrawal is not an immediate recall of that file, and an interrupted cleanup follows the rules above. Account deletion also records a local denied choice and removes the identifier. Withdrawal cannot recall a request already received by KLIPY or remove a copy held by another app. Contact us or KLIPY about provider-held information; re-enabling the feature does not erase the provider's earlier records. This GIF choice does not authorize cross-app advertising tracking.

Optional usage analytics

Optional analytics notice, 14 November 2026: where this feature is available, Rikko does not initialize its PostHog analytics client until you opt in. A one-time optional choice may appear after the introduction, including when you use Rikko without an account. Choosing No thanks or dismissing that choice keeps analytics off. Existing saved choices are respected. You can also choose or change this setting through Settings → Help improve Rikko. Your choice, notice version and timestamp are stored on that device, not sent as an analytics event. The preference is installation-local, not an account setting, and can remain saved when you sign out. Events from before consent are not collected later.

After you opt in, Rikko sends a limited set of product-event names, static screen names, predefined categories and event times to PostHog's EU ingestion endpoint. For example, an event can indicate that an IOU was created or that you confirmed a nudge; a nudge confirmation does not verify delivery to its recipient. The analytics stream does not include your name, email, Rikko account or login-session ID, contacts, amounts, item descriptions, payment details, message text, GIF search terms, photos, route parameters or push tokens. This integration does not automatically capture touches or screen contents, app lifecycle events, logs or errors, record your screen, load feature flags, or use advertising identifiers or account-identification calls.

Events use a random identifier held only in app memory, not a persistent installation identifier. Rikko clears the unsent analytics queue and resets that identity when you withdraw, background the app or change accounts; a new app process does not reuse the previous identity. This is pseudonymous processing, not a promise of anonymity. PostHog receives ordinary network metadata, including your IP address, when a request reaches it. Rikko disables analytics GeoIP enrichment and does not send this data for advertising or combine it with Rikko account records. Provider-held records and network processing are separate from the app's memory-only storage. See PostHog's Privacy Policy.

Turn off Help improve Rikko at any time to stop future collection and discard unsent events. Withdrawal cannot recall a request already received. We do not keep a mapping between your Rikko account and the temporary analytics identifier, so account deletion does not automatically locate and erase earlier PostHog events. Contact us to exercise your rights; provider retention and deletion follow the applicable service configuration and agreements. Keeping this optional choice off does not affect IOUs or nudges.

Visual-media safety

Before Rikko creates a “Star in it” video, each selected face photo is sent over TLS to OpenAI's automated moderation service to detect prohibited visual content. If the safety check flags the image or cannot return a valid result, Rikko does not create or upload the video. The source JPEG is held only in a private temporary work directory for validation, moderation, and an allowed composition; it is not placed in Rikko's object store or given a public Rikko URL. The request removes that directory immediately after processing, including failed processing. If a server process stops before cleanup can run, startup and minute safety maintenance remove stale, app-owned source directories after a two-hour safety window. OpenAI's current API data-control policy lists moderation inputs as not used for training and not retained for abuse monitoring or application state. OpenAI processes the image as a service provider under its API terms.

Who receives data

We use service providers for hosting, database and object storage, transactional email, push delivery through Expo and Apple, visual-media moderation through OpenAI, crash/error reporting through Sentry, KLIPY when you search for or load a GIF, and PostHog only for separately opted-in usage analytics where that feature is available. A recipient may process data outside your country, including in the United States. Where the law requires a safeguard for such a transfer, the transfer relies on a recognised transfer mechanism in that provider's data-processing terms. Rikko does not sell account or IOU data or use that data for targeted advertising. External services process the information you send to them under their own applicable terms and privacy policies.

A pay, meme, or funny link is visible to anyone who receives its unguessable URL. An authorized IOU participant sees information needed for that shared IOU. Payments open the payout provider chosen by the creditor; Rikko does not receive card or bank-login details and is not party to the transfer. You can ask the contact above for the relevant recipients, transfer countries and a copy of applicable transfer safeguards, subject to necessary redactions that protect others.

Retention and deletion

Account data, IOUs, messages, and generated media are kept while the account or relevant shared record is active, then removed when you use the in-app deletion or takedown controls, subject to narrowly limited security, fraud-prevention, legal, and backup retention. Consumed or expired authentication challenges are eligible for removal after a 24-hour security grace period. Expired or revoked session records are eligible for removal after 30 days; associated notification tokens are scheduled for removal when the session expires or is revoked. When an account is deleted, safety reports by or about it are detached from the account using fresh random tombstone identifiers. The restricted report reason, detail, outcome, and pseudonymous decision audit may be retained for up to 24 months from the report date to investigate abuse and defend claims, and then are scheduled for deletion. The single evidence record that directly supports a still-active safety enforcement is retained for the life of that enforcement; a documented legal hold may also require longer retention. A minimal keyed subject/enforcement record is retained while the restriction is active and for up to 24 months after revocation or expiry so Rikko can apply and audit account-safety decisions. Report content is not included in the reported person's export. Cleanup normally runs every six hours, but outages can delay it. Provider logs and backups follow the configured provider agreements and retention schedules.

Reusable face photos, signed-out IOUs, and signed-out payout handles are device-local. Removing a saved face deletes its managed photo and metadata. When you choose Save or Nudge for a newly created signed-out IOU and then authenticate through that contextual account prompt, Rikko sends that exact IOU and only its explicitly selected payout methods to the selected account automatically so the requested action can continue. Older or unrelated signed-out data stays on the device until you separately review and add or discard it. Uninstall/reinstall persistence is controlled by the operating system and may differ by platform. Signing out or deleting an account clears saved-face data, account-scoped caches, and scheduled account notifications from that device. Application backup is disabled for Rikko on Android. On iOS, Rikko marks the saved-face folder and each saved face for backup exclusion after every save, stores its metadata in the device-only Keychain, and requests complete file protection.

Deleting your account removes data controlled by your account. If another user created an IOU concerning you, their creditor-controlled record can remain but is detached from your deleted account. The deletion page below describes the implemented scope.

Your choices and rights

You can correct account details, export your data, revoke individual sessions, remove generated media, and permanently delete your account inside the app. Export and starting account deletion may require you to confirm your password again to protect your data. You can also contact us without an account to request access, correction, restriction, portability where applicable, objection, or deletion. For processing based on legitimate interests, you may object for reasons relating to your situation. We must consider that objection; retaining a record is not automatic simply because another user created it.

For requests under EU data-protection law, we respond without undue delay and ordinarily within one month. If a permitted extension is needed because of complexity or the number of requests, we explain it within that first month. If we cannot grant a request, we explain why and your challenge options. We use proportionate verification to protect private information and do not require you to pay or create an account to exercise your rights.

You may complain to Estonia's Data Protection Inspectorate (Andmekaitse Inspektsioon), or to the data-protection authority where you live or work or where an alleged infringement occurred. These rights do not depend on accepting the IOU or contacting its creator first.

Security

Rikko uses TLS, short-lived access tokens with rotating refresh sessions, database row-level access controls, encryption for sensitive fields, bounded uploads, content moderation, and rate limits. No internet service can promise absolute security; please report suspected account misuse through the public contact above.

Children

Rikko is not directed to children under 13. If local law requires a higher minimum age or parental authorization for this service, you may use Rikko only when that requirement is met.

In regions where Apple reports that the law requires an age check, the iOS app asks Apple for your age range before online features work. The age range stays on your device. It is used to decide whether the minimum age is met and is then discarded; it is not sent to our servers or to any provider, and Rikko never sees your date of birth. The app keeps one word on the device: whether a check applies there and whether it passed. If Apple's age range does not confirm an age of 13 or older, online features stay off. Deleting your account, exporting your data, reporting and blocking remain available. Where a parent or guardian withdraws consent for the app, Apple prevents the app from opening on that device.

Changes

Material policy changes receive a new version. The app records the version accepted when an account is created; material changes may require renewed notice or consent.