Who is responsible
Ritwo is provided by KUROMNIS LTD, trading as PositiveAI, a company registered in England and Wales (company number 14569958). KUROMNIS LTD is the controller of the personal data described here.
On your iPhone
Ritwo keeps your challenges, ritual names, reminder times, check-ins, dates, progress, chapter history, orb colours and preferences on your device. Solo use needs no account and sends none of this to us. Device backups may include it, depending on your iOS settings.
Settings › Backup & restore can export a backup file. It contains personal information and is not encrypted by Ritwo; you decide where to save or send it.
Ritual names stay on your iPhone
Ritwo 1.30 never uploads the names of your rituals, and it has no setting to share them. They are not included in your circle’s view of your progress or in check-in alerts about you. Earlier test versions of Ritwo had an optional name-sharing setting; when you update, Ritwo switches it off and asks to remove names you shared before (Together › Manage shows if removal is still pending).
People you share with who are still on an older test version may send alerts that include their own ritual names until they update. We cannot recall notifications already delivered or copies someone else has kept. Please choose a display name that does not reveal private or health information.
If you share (Together)
Sharing uses a cloud account. You can create one with Sign in with Apple (Apple may give us a private relay address) or with an email address and password. We store:
- Account identifier and sign-in email or relay address, to sign you in and keep the account secure. Basis: providing the service you asked for.
- Display name and orb appearance, so the people you accept recognise you. Basis: providing the service.
- Shared progress for the challenges you choose: today’s check-in state and times, your current day and chapter, time zone and role (participant or supporter). People in that circle see this, not your other challenges or full history. Basis: providing the service and, because a challenge such as quitting a habit can reveal health information, your explicit consent (see below).
- Circle membership and invitations, including who you are connected to, so circles of up to four people work and everyone can confirm who joins. Basis: providing the service.
- A notification token, only if you turn on check-in alerts, so we can send them. Alerts say that someone checked in; alerts about you never include your ritual names. You can choose whether previews show the person’s display name. Basis: your consent; turn alerts off at any time.
Check-ins are self-reported. They are not verification that something happened.
Your consent for health information. Nothing about a challenge is shared until you agree. Sharing is per challenge: you invite someone or join with their code, and before anything is shared Ritwo shows Connect with and the person’s name, who is in the circle, and what they will see: your display name, day, chapter, orb colours and completion lights, never your ritual names. It then says: “People in your circle will see this challenge and your check-ins. A challenge such as quitting drinking can say something about your health, so only share it with people you trust.” Nothing is shared until you tap Agree to connect, and everyone in the circle must agree. Supporters share their display name and role, not a challenge. You can withdraw at any time by leaving the circle (Together › Manage), which removes your shared progress from it.
Optional and off by default
Help improve Ritwo (Settings › Privacy & Shared Sky). If you turn it on, Ritwo sends an account identifier and, for your original challenge, daily completion, pause and settled status, day number, dates and whether you share it. Never ritual names, rewards or notes. Turning it off stops collection and asks us to delete what was uploaded; if deletion is pending, the app shows Finish deleting measurement. Basis: your consent.
Uploaded measurement is linked to a random identifier, or to your account if you sign in, and is deleted 12 months after we receive it.
Contribute to Shared Sky. Before anything is sent, Ritwo asks Add your light? and explains what is sent; nothing is contributed unless you choose Contribute to Shared Sky. We ask explicitly because when you show up can say something about your health. If you agree, Ritwo sends limited activity signals with no names or ritual details. They are pooled into hourly windows and shown only after the hour has ended plus 20 minutes, as coarse levels rather than counts. An hour with fewer than 20 contributors shows as quiet. Pooled activity cannot be withdrawn individually. Your contribution choice lasts 90 days unless you stop it sooner. Basis: your consent.
Viewing Shared Sky makes network requests but does not contribute anything.
Community and larger groups
Public Community and larger invite-link groups are hidden in Ritwo 1.30. Only people who joined during testing still see them, so they can manage their card or group and leave it, which removes their shared card or progress. In-app Report and Block exist only there. Everyone else reports a safety concern by email to support@positiveai.co.uk; we handle safety reports within 24 hours.
Founding Supporter purchase
Founding Supporter is an optional one-time purchase that unlocks cosmetic touches only. Apple processes the payment; we never receive your card details. Ritwo checks your purchase with Apple on your device and does not send purchase information to our servers. Your App Store purchase history stays with Apple.
App Store privacy labels
Ritwo’s App Store privacy answers match this notice. Data linked to you: Email Address, Name (your display name), Contacts (the people you connect with in circles), Health, Fitness, Other User Content, User ID, Device ID (the notification token, only if you turn on alerts) and Product Interaction (optional measurement and Shared Sky contribution). Data not linked to you: Diagnostics and Other Data. Tracking: none. All of it is used only for app functionality, and optional measurement for improving Ritwo.
Ritwo does not read your iPhone address book or Apple Health. “Health” and “Fitness” are declared because the challenges you choose to share, such as quitting a habit or exercising, can reveal health or fitness information through your shared progress, and because earlier test versions could share ritual names.
Other uses and what we never do
We use limited security and service information in our legitimate interests of keeping Ritwo reliable, preventing abuse and handling reports and support requests. If you email us, we use your message to answer it. We may also process information to meet legal obligations.
We do not sell your information, use it for advertising, use cross-app tracking, or make automated decisions about you with legal or similarly significant effects. Ritwo shows no advertising, does not use your advertising identifier, and includes neither Google Analytics nor Crashlytics.
Service providers and where data is processed
Ritwo uses Google Firebase: Authentication, Cloud Firestore and Cloud Functions (located in London, europe-west2) and Cloud Messaging for alerts. Apple provides Sign in with Apple, push notification delivery and purchases. Cloud services also receive ordinary connection information such as IP addresses. Some provider processing, including Firebase Authentication, happens outside the UK under the providers’ international-transfer safeguards. See Firebase privacy information and Google’s data-processing terms.
How long we keep information
- Information on your iPhone stays until you delete it or the app. Exports and device backups are under your control.
- Account, circle and shared-progress records are kept while your account exists and you stay connected. Leaving a circle removes your shared progress from it.
- Uploaded measurement is kept for 12 months from when we receive it, or until you turn it off or delete your account, if sooner. A daily job deletes older records.
- Alert delivery records expire after two days. Shared Sky signals and published windows expire after 24 hours. Expiry clean-up runs in the background, so removal is not instant.
- Google Cloud Logging keeps ordinary service logs for 30 days and required audit logs for 400 days. The database keeps one hour of recovery history.
- Safety reports, and the emails about them, are kept for 12 months. A report someone else made about you can be kept for that period even after you delete your account.
Deleting your account
Settings › Account › Delete my cloud account deletes your cloud account and, with it, your circles and shared progress, invitations, Community card and group membership, reports you submitted, uploaded measurement, Shared Sky contribution and alert records. If you used Sign in with Apple, Ritwo also revokes its access to your Apple ID. Your rituals and history stay on your iPhone. If you are offline, the app asks you to reconnect to finish.
Your rights
You can ask to access, correct, delete or restrict your information, object to processing based on legitimate interests, ask for a portable copy, or withdraw consent at any time. Withdrawing consent does not affect processing before you withdrew it. Email support@positiveai.co.uk; we may need to confirm it is your account. You can complain to the Information Commissioner’s Office.
Children
Ritwo is for adults. You must be 18 or over to use it, and it is rated 18+ on the App Store.
Not medical advice
Ritwo supports personal consistency. It is not medical treatment or an emergency service. If you are physically dependent on alcohol, stopping suddenly can be dangerous: speak to your GP or call NHS 111. In an emergency, call 999.
Changes
We will update this notice when Ritwo or how it uses information changes, and tell you in the app about important changes.