Legal
Privacy Policy
Riva is local-first. The open-source Riva app runs on your machine and keeps its data there. Data reaches us only when you visit this website, contact us, sign in to the hosted dashboard, link a machine to it, or choose to share anonymous usage counts. This page lists each case.
The Riva app on your machine
The Riva app (the riva command, its terminal and web dashboards, and the menu-bar app) reads information about the AI agents running on your computer: processes, resource use, session transcripts, token usage and security findings. It stores this on your machine. It does not send it to us unless you link the machine to a Riva Server (see Linked machines).
The app is open source under the MIT license, so you can read exactly what it does on GitHub.
This website
Our public pages use Google Analytics to count visits and see which pages are used. Google Analytics sets cookies and receives your IP address, browser and device details, and the pages you view. You can block it with your browser's privacy settings or a content blocker, and the site keeps working.
The site also stores a few settings in your browser's local storage: your theme choice and, if you sign in, your session. These stay in your browser.
Contact form
When you send a message, we store your name, email address, company (if you give one), your message, the page you sent it from, your IP address and your browser's user agent. We use the IP address to limit spam. Messages are emailed to our team so we can reply.
Riva Server accounts
To sign in to the hosted dashboard at rivalabs.ai you give us your email address. Sign-in uses one-time email links sent through Supabase, our authentication provider. We store your email, a display name if you set one, and your organization and its members.
Linked machines
If you link a machine with riva link start, it sends the following to the Riva Server you linked it to:
- the machine's name, a random machine ID, operating system and approximate location;
- heartbeats with the agents it sees, their status and resource use;
- events and audit-log entries;
- summaries of agent sessions: project name, git branch, model, token counts and efficiency metrics. Depending on your Riva version, a summary can also list the paths of files the agent read or wrote and a per-turn outline of its tool calls, which may include short excerpts of tool inputs (up to 80 characters).
Riva does not send the contents of your files. Data is kept separate per organization; other customers cannot see it. If you run your own Riva Server, this data goes to your server, not to us.
Anonymous usage counts
Installer. The install scripts send one anonymous request when they finish: your operating system, the install method and the Riva version. We store a keyed hash of your IP address, not the address itself, to count distinct installs. Set RIVA_NO_TELEMETRY=1 before installing to skip it.
Usage sharing (off by default). The app asks before sharing anything. If you say yes, it sends a random client ID, your operating system, the names of the agents it detects, the Riva version, and your approximate city, country and coordinates. To find your city, the app looks up your IP address with ip-api.com. You can turn sharing off in ~/.config/riva/hub.toml.
Service providers
We use these providers to run the service. Each processes data only to provide its part of it:
- Google Cloud: hosting and databases (United States)
- Supabase: sign-in
- Google Analytics: website analytics
- Our email delivery provider: sign-in links and contact-form messages
- ip-api.com: city lookup, only when you opt in to usage sharing
We do not sell your data or use it for advertising.
How long we keep data
- Resource snapshots and events from linked machines: 30 days.
- Anonymous usage-sharing records stop appearing in our counts after 90 days without a new ping.
- Account, organization, audit-log and session-summary data: while your account is active, or until you ask us to delete it.
- Contact-form messages: as long as we need them to handle your request.
Your choices and rights
You can use the Riva app without an account, without linking a machine and without sharing usage. You can ask us for a copy of your data, to correct it, or to delete your account and everything linked to it. Depending on where you live (for example in the EU, UK or California), you may have further rights under local law; we will honour them.
Changes
If we change this policy, we will update the date at the top. For significant changes affecting account holders, we will also email you.
Contact
Questions or requests: tech@rivalabs.ai or our contact form.