Rij — Privacy Policy

Summary

• Rij reads health data, app usage statistics, and notification metadata to show you possible connections between your device activity and your health.
• All device usage and health data stays on your device. It is stored in an encrypted local database and is never uploaded to our servers, shared with third parties, or used for advertising.
• The only data we hold on our servers is a small set of fields needed to deliver push notifications and verify purchases. No personally identifying information is collected.
• You can erase the server-side data at any time from Settings → Erase My Data inside the app, or by emailing hello@dhive.ca.

1. Data accessed on your device (never uploaded)

Rij reads the following data on your device and writes it only to a local database that stays on the device. The database file never leaves the device.

Health data

• Android (Health Connect): Steps, heart rate, resting heart rate, heart-rate variability, sleep stages and duration, active calories, distance, exercise sessions, blood-oxygen saturation, body temperature, body weight.
• iOS (HealthKit - read-only): Steps, heart rate, resting heart rate, heart-rate variability, Apple Exercise Time, active calories, distance walked/run, blood-oxygen saturation, body temperature, body mass, sleep analysis.

On both platforms, Rij requests read-only access to health data; it never writes to your health store.

Limited Use Compliance:

Our use of information received from Health Connect will adhere to the Health Connect Permissions Policy, including the Limited Use requirements. We do not sell, share, or lease your Health Connect data or HealthKit data to third parties, nor do we use this data for advertising, marketing, or user-profiling.

App / device usage

• Android (Usage Stats / PACKAGE_USAGE_STATS): Per-app foreground time, per-app launch counts, screen unlock counts, time-of-day usage buckets, per-app category usage.
• iOS (Screen Time / FamilyControls + DeviceActivity report extension): Category-level totals only — total minutes per two-hour bucket, minutes per app category (e.g. "Social Networking", "Productivity"), pickup counts. No per-app data and no app identifiers are ever exposed to Rij on iOS — this is an Apple platform restriction, not a Rij choice.

Notification metadata

• Android (Notification Listener / BIND_NOTIFICATION_LISTENER_SERVICE): Counts of system notifications you receive, plus the posting app's package name. The title, body, and content of notifications are never stored.
• iOS (DeviceActivity report extension): Per-day and per-category notification counts only. No posting-app identifier and no notification content is ever exposed to Rij on iOS — Apple does not provide that API to third-party apps.

This data:

• never leaves your device,
• is not uploaded to our servers,
• is not shared with third parties,
• is not used for advertising,
• is deleted automatically when you uninstall the app.

2. Data we store on our servers

To deliver push notifications and (on Android) verify in-app purchases, Rij uses Google's Firebase platform. The same Firebase project serves both platforms.

The following is the complete server-side record per user. Some fields are written only by one platform; that is called out in the Platform column.

iOS in-app purchases are verified entirely on-device using Apple's StoreKit 2 framework. The purchase receipt is never sent to our servers and no Cloud Function is involved. Subscription status is determined locally from Apple's signed transaction.

We do not collect or store on our servers: your name, email address, phone number, location, IP address (beyond Google's standard infrastructure logging), advertising ID, contacts, photos, files, messages, or any of the health, usage, or notification data described in section 1.

3. Analytics

Rij does not include any third-party advertising, attribution, or analytics SDK (no Mixpanel, AppsFlyer, Amplitude, Sentry, etc.) on either platform.

On Android, Google Firebase Analytics is present as part of the Firebase SDK bundle but we have not added any custom analytics events. Firebase Analytics' automatically collected events (app open, session length, OS version, device model, country, language) are governed by Google's Firebase data-processing terms. Aggregated counts are visible to us; raw events are not.

On iOS, the Firebase Analytics module is not imported in the app source at all.

4. How to erase your data

Local (on-device) data

Uninstalling Rij permanently deletes the encrypted local database and all health, usage, and notification data described in section 1.

Server-side data

Inside the app, go to Settings → Erase My Data. This deletes your Firestore users/{uid} document and removes your anonymous Firebase Auth user. The action is irreversible.

If you cannot reach the in-app setting (for example, because you have already uninstalled the app), email hello@dhive.ca with the date and approximate time of last use. We will locate and delete the associated anonymous record. Because we hold no personally identifying information, you will need to send the request from a contactable address; we cannot otherwise verify your identity.

5. Security

On-device data

• Android: The local database is encrypted with SQLCipher 4.6.1 using AES-256. The database passphrase is generated on-device and stored in the Android Keystore (AES-256-GCM) — it is never transmitted off the device.
• iOS: The local database is a SwiftData store. The store file is protected at rest using iOS Data Protection with the NSFileProtectionCompleteUnlessOpen class — the file is encrypted with a key derived from your device passcode and managed by the iOS kernel. An auxiliary AES-GCM-256 key (used to encrypt cross-process snapshots shared with the Screen Time report extension) is stored in the iOS Keychain under the kSecAttrAccessibleAfterFirstUnlock protection class.

Network

• All network traffic between Rij and Firebase uses TLS 1.2 or higher.
• On iOS, Firebase calls are additionally protected by Firebase App Check (DeviceCheck App Attest), which lets our backend reject requests not originating from a genuine instance of the app.
• We do not transmit your health, usage, or notification data over the network.

6. Children

Rij is not directed at children under 13 and we do not knowingly collect data from children under 13.

7. Permissions you grant

Android permissions

iOS permissions and entitlements

You can revoke any of these in your device's system settings at any time. Revoking a permission stops the corresponding data flow immediately; previously stored on-device data is unaffected until you tap Settings → Erase My Data or uninstall Rij.

8. Changes to this policy

If we materially change what is collected or how it is used, we will surface a notice in the app.

9. Contact

Questions, deletion requests, or other privacy concerns: hello@dhive.ca.