Privacy Policy

Effective date: 2026-06-17

River Rat is operated by Evil Twin Enterprises LLC ("River Rat," "we," "us"). This policy explains what we collect, why, and your choices, across the River Rat website (riverrat.app) and the River Rat app for iOS and Android.

What we collect and why

River Rat website (riverrat.app)

• Aggregate analytics. We use Cloudflare Web Analytics, which is privacy-first: it sets no cookies and collects no personal data. It gives us aggregate counts (such as page views and referrers). It does not track you across sites or build a profile of you.
• Your theme choice. If you switch between light and dark mode, that preference is saved in your browser, on your device. It never reaches us.
• The contact form. If you message us through the Support page, we receive what you type — your name, email, and message — and use it only to reply. The form is delivered by Web3Forms, a third-party form service that relays the message to us. We don't add you to any mailing list.

River Rat app (iOS and Android)

The app works anonymously. There is no sign-up and no account.

• An anonymous device ID. The app creates a random identifier and a matching secret key and stores them securely on your device. When the app talks to our notification server, it sends the secret over an encrypted connection to prove the request is really from your device — and our server keeps only a one-way hash of it, never the secret itself. This identifier exists so that, if you turn on notifications, we know which device to send them to. It is not used to track you, and it is not linked to your name, email, or any personal identity.
• Notifications (only if you turn them on). If you enable flow alerts, the app shares a push token (provided through Apple or Google and our delivery provider, Expo) and the alert rules you set — which river sections you want and at what flow thresholds — with our notification backend (Supabase) so we can send the alerts you asked for. Turn notifications off and the app deletes that device record; a device that stops syncing is also automatically deleted after about six months of inactivity.
• Accepting the Terms. When you accept our Terms, we record the version, a hash of the exact text you saw, and the date, as a legal record.
• Stays on your device. Your saved sections, alert settings, theme, and cached forecast data are stored on your device and aren't sent to us (beyond the alert rules needed to deliver notifications, above).

Both

• The site and app fetch public river forecasts we publish (derived from USGS and NOAA data). Reading that data sends us no personal information.

What we do not collect

• No accounts, names, or passwords — the app is anonymous and the website has no login.
• No location. The app does not request or use your device location.
• No advertising identifiers (no IDFA or Android ad ID), no ad networks, and no cross-app or cross-site tracking.
• No third-party analytics or crash-reporting SDKs in the app.
• No payment information.
• We never sell or rent your data.

Service providers

We rely on a few providers solely to run the service, and they process only what's described above: Cloudflare (privacy-first website analytics), Web3Forms (delivers Support-form messages), Supabase (stores the anonymous device record and alert rules behind notifications), Expo (app infrastructure, updates, and push delivery), and Apple / Google (deliver push notifications to your device).

Data retention

Contact-form messages are kept as long as needed to handle your request. The notification device record exists while notifications are enabled; turning them off deletes it, and a device that stops syncing is automatically deleted after about six months of inactivity. Terms-acceptance records are kept as a legal record. Aggregate website analytics are retained by Cloudflare under their policy and contain no personal data.

Children

River Rat is intended for adults (the app's Terms require you to be 18 or older) and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

Your choices and rights

• Notifications: turn them off anytime in the app (which deletes the device record) or in your device settings.
• On-device data: clear it by deleting the app, or through your browser for website preferences.
• Requests: to ask what we hold or to request deletion, contact us through the Support page. Because the app is anonymous, we may be unable to locate device-specific data without the information needed to identify it.
• Depending on where you live (for example, California, or the EEA/UK), you may have additional rights to access or delete personal data. Contact us through the Support page and we'll honor applicable requests to the extent the law requires.
• "Do Not Track." We don't track you across other websites, so we don't respond differently to a browser's "Do Not Track" signal.

Where your data is processed

Our service providers may process and store data in the United States and other countries. Where required, we rely on appropriate safeguards for any such transfer.

Changes to this policy

We may update this policy; we'll post the new version here and update the effective date above.

Contact

Questions about privacy? Reach us through the Support page at riverrat.app/support.

River Rat is a product of Evil Twin Enterprises LLC.

See also: Terms of Use