Skip to content

Privacy Policy

RIVO works without an account, and with one we keep as little as possible. Here is exactly what is stored and where.

Without an account

Your watchlist, favourites, watched list, recently viewed, playlists, episode progress, resume points and settings (including the Kids mode PIN, kept only as a hash) are stored only in your browser's local storage. New-episode notifications are produced in your browser too, and no push service is used. Nothing about them is sent to our servers. You can export, import or delete them at any time in Settings → Your data.

With an account

Accounts have no email or password, just a random 16-digit account number. If you sign in, we store:

  • Your account number as a keyed fingerprint (used to log you in) and an encrypted copy (so you can see it on your account page). We cannot read it from the database alone.
  • Your recovery email, if you add one, only as a keyed fingerprint plus a masked hint such as "a•••k@gmail.com". We never store the address itself; we only use the address you type at that moment to send a recovery code.
  • Your display name and profile picture choice.
  • Your synced library and preferences (the lists above, plus when items were removed so deletions sync across your devices).
  • Sign-in sessions: a hashed session token and your browser's user-agent string, kept for up to 90 days. Your account page lists them as devices (e.g. "Chrome on Windows") and can sign out all the others.

While you're signed in, your library and preferences live only in your account. The browser keeps them in memory, not in its storage (except per-device settings such as Kids mode and data saver). Logging out ends the session and removes the account's data from that browser; log in again on any device to get it all back. Deleting your account (Account → Delete account) permanently removes everything.

Cookies

We set preference cookies for language, region and adult-content filtering so pages render correctly, and (only if you sign in) one login cookie (rivo_session, HTTP-only, not readable by scripts). No advertising or tracking cookies are used, and there is no analytics.

Third parties

  • TMDB provides titles and images; images load directly from TMDB, which may see your IP address.
  • YouTube plays trailers in privacy-enhanced mode (youtube-nocookie.com).
  • cinesrc.st provides the video player, embedded in a sandbox that blocks pop-ups and redirects. It may see your IP address and its own privacy policy applies.
  • TheIntroDB supplies intro and credits timestamps. Those requests go through our server, so TheIntroDB never sees you.
  • Resend delivers recovery-code emails, if you ask for one. It receives only the address you typed and the code.
  • Profile pictures are generated on our own server. No third party is involved.

Shared playlists

When you share a playlist, its contents are encoded in the link itself. Anyone with the link can see the titles in it.