Your data and your privacy

Riina is a fantasy health league. To make it work we process activity and health data that you choose to connect, sync, or share. This policy explains what we collect, why, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Effective date: October 27, 2026Applies to the Riina app and riina.io

Who we are

The data controller for your personal data is Riina Labs, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA.

For any privacy question or to exercise your rights, email privacy@riina.io. Our Data Protection Officer is Michael Cahill, reachable at the same address. For security concerns, email security@riina.io.

EU representative

Under Article 27 of the EU GDPR, our representative in the Union is Volker Leukhardt, Rua Heróis de França 906, 5Tras, 4450-156 Matosinhos, Portugal, reachable at privacy@riina.io.

UK representative

Under Article 27 of the UK GDPR, our UK representative is Rickert Services Ltd UK — Riina Labs, Inc, PO Box 1487, Peterborough, PE1 9XX, United Kingdom, reachable at art-27-rep-RiinaLabs@rickert-services.uk.

Google Sign-In and Google Health data

This section describes how Riina accesses, uses, stores, and shares data obtained through Google APIs, and applies in addition to the rest of this policy.

What Google user data we access

Google Sign-In (optional): if you choose to sign in with Google, we receive the identity information covered by the openid, email, and profile scopes — your Google account email, basic profile (name and picture), and your Google account identifier.
Google Health API (optional): if you separately connect your Google Health account, we read your activity, fitness, and health-measurement data on a read-only basis using the scopes googlehealth.activity_and_fitness.readonly and googlehealth.health_metrics_and_measurements.readonly. This covers exercise/workout sessions, heart-rate samples, daily resting heart rate, and body weight.

How we use Google user data

We use Google Sign-In data only to authenticate you and create or access your account. We use Google Health data only to sync your workouts and health metrics into Riina and to power the user-facing features you enable — heart-rate zones, effort scoring, leagues, drafts, and leaderboards. We do not use Google user data for advertising, and we do not sell it.

How we share Google user data

We do not transfer Google user data to third parties except the service providers listed in Who we share data with, acting on our instructions under data-processing agreements to provide the service. Our game-commentary provider (Anthropic) receives only aggregated game context — never raw Google health data such as heart-rate samples, routes, or body metrics. Google user data is not used to develop, improve, or train generalized AI/ML models. The advertising measurement described under Analytics and tracking never receives Google user data: the website pixel is not part of the app, and the app’s milestone events carry no health or activity data, whatever their source.

How we protect, retain, and delete Google user data

Google OAuth tokens and the data we sync are stored on our EU infrastructure and protected as described under Security. You can revoke Riina’s access at any time by disconnecting the source in the app, from your Google account permissions, or by deleting your Riina account; on disconnection or deletion we delete the associated tokens and synced Google data as described under How long we keep your data.

Limited Use

Riina’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Garmin activity data and authorization

Garmin connections are optional and associated with your identifiable Riina account. This section also covers Garmin workouts you choose to share through Apple Health or Android Health Connect.

Official Garmin authorization

When available in your app, the official connection uses Garmin’s OAuth consent screen. You sign in on Garmin’s website; Riina does not receive your password through this flow. We receive an API user identifier, your granted permissions, and access and refresh tokens. We encrypt the tokens in our database and use them to maintain or revoke the connection.

The initial official integration is an authorization-only pilot. It does not import workouts or enable AI processing of workouts through the official API. Any existing Garmin sync connection or sharing through Apple Health or Health Connect continues separately.

Activity data and purposes

For Garmin workouts you sync to Riina, we process activity identifiers, activity type, start and end times, duration, recorded heart-rate samples, calories, distance, and available route and device information. We use these to display workout summaries, avoid duplicate imports, calculate personalized effort points, and contribute results to team competitions, standings, and leaderboards. Your sharing settings and the game features you use determine what other users can see, as described under Sharing and visibility to other users. We do not sell Garmin activity data or use it for advertising.

AI transparency statement

Our self-hosted machine-learning service processes workout heart-rate data, duration, activity information, and your heart-rate profile to classify activities and estimate effort. These estimates contribute to workout and team scores and can be inaccurate. You can contact us to question a result or request correction. This processing runs on our EU-hosted infrastructure.

Anthropic receives game-summary context, including usernames and workout-derived point totals, for game commentary. It does not receive raw heart-rate samples or GPS routes through that feature. If you use the support assistant, Google’s Gemini service processes your messages, images you submit, and device/sync context such as device names, last sync times, and workout counts. Include health information in a support message only if you want it processed for that request.

Garmin OAuth authorization alone is not consent to AI processing. Before workout processing through the official Garmin API is enabled, we will provide an explicit consent choice explaining that processing and how to withdraw it. The authorization-only pilot does not enable that processing. To withdraw consent for further processing of existing Garmin data, email privacy@riina.io.

Service providers and sharing

Fly.io hosts our application, database, object storage, and self-hosted processing infrastructure. Anthropic and Google process the AI inputs described above. Where enabled, Customer.io receives account/contact details and workout-derived information, including activity type, completion time, effort changes, workout counts, point totals, streaks, and team results, for reminders and recaps. Expo processes push tokens and notification content to deliver notifications. These providers may therefore process information derived from Garmin workouts. Raw heart-rate samples and routes are not included in our Customer.io workout events or recap attributes. We do not pass Garmin workout or health content to Meta or Google AdMob.

Disconnecting, retention, and your rights

You can remove official authorization in Connected Services or revoke it through Garmin Connect. Removing it in Riina removes the local official connection and queues revocation with Garmin. Encrypted credentials needed to complete revocation may remain temporarily while we retry a failed request. Removing official authorization does not disconnect a separate existing Garmin connection or stop sharing through Apple Health or Health Connect; disconnect those sources too if you want all Garmin imports to stop.

Disconnecting does not automatically delete workouts already imported. To access, correct, export, or delete your Garmin-derived data, or withdraw consent for its further processing, email privacy@riina.io. You can also request account deletion in the app. The retention periods, backup handling, and limited retention of non-identifying game results under How long we keep your data apply. Withdrawal does not affect processing that lawfully took place before it.

What data we collect

Account & profile: username, email, profile picture, sign-in and biometric-login preferences, referral relationships. If you sign in with Google or Apple, we receive your email address, basic profile (name and picture), and the provider’s account identifier.
Workout & activity data imported from Apple HealthKit, Android Health Connect, and — if you connect it — the Google Health API, as well as Garmin workouts described above: heart-rate samples, resting heart rate, start/end times, calories, activity type, distance, speed, steps, elevation gain, body weight, and extended workout metrics.
Health-profile values: resting heart rate, max heart rate, ventilatory thresholds, weight, height, age, and gender.
Location: GPS route points, only when route data is included with a workout.
Content & social: workout photos and videos, post content, comments, reactions, team and direct chat messages, and timestamps.
Usage & device: app session and screen-view events (analytics), and a push-notification token if you enable notifications.
Crash diagnostics: app versions with crash reporting send error types, technical stack traces, app/build versions, update identifiers, device model, operating system, and memory diagnostics to Sentry to help us diagnose failures and keep the service reliable. We configure reporting to exclude account details, health and workout content, messages, screenshots, session recordings, and network request contents. Server-side filters remove exception text, IP addresses, user location, and device identifiers from stored reports. Crash reporting is separate from advertising measurement.
Website visits: if you accept cookies on riina.io, the pages you view there, your IP address, and your browser user agent, via the Meta Pixel. Nothing is collected if you decline.
Advertising measurement in the app: where you allow it, your device’s advertising identifier (Apple’s IDFA or Android’s advertising ID) and a short list of milestone events — that you created an account, synced a workout that scored, created or joined a challenge, or accepted a team invitation. The events carry the fact that something happened and nothing more: no workout, health, location, or message content. See Analytics and tracking.

Why we use your data and our legal bases

Run the app and your account, sync and store workouts, calculate scores, leagues, drafts, and leaderboards — performance of our contract with you (Art. 6(1)(b)).
Process health metrics for heart-rate zones and scoring — your explicit consent (Art. 9(2)(a)), with contract as the Art. 6 basis.
Social and game features you choose to use (posts, comments, live game views) — contract, and your consent for any optional sharing.
Analytics and product improvement — our legitimate interests in improving the app (Art. 6(1)(f)); you can opt out in settings, and where required we will ask for consent.
Measuring our advertising — on the riina.io website (the Meta Pixel) and in the app (Meta App Events). Your consent (Art. 6(1)(a)), given in the cookie banner on the website and, in the app, through Apple’s tracking prompt on iOS or our own consent sheet on Android. You can withdraw it at any time.
Security, abuse prevention, and keeping the service reliable — legitimate interests (Art. 6(1)(f)).
Meeting legal obligations (e.g. responding to lawful requests) — legal obligation (Art. 6(1)(c)).

Machine learning and AI processing

Workout classification and effort scoring run on Riina’s own self-hosted machine-learning service — not a third-party AI provider. Heart-rate samples, resting and max heart rate, and activity type are processed there to classify workouts and estimate effort. This service runs on our own infrastructure in the EU.
Game commentary is generated using Anthropic’s Claude API. The prompt we send contains only game-summary context — usernames, team rosters, standings, MVP/LVP and top-scorer information, and workout-based point totals. It does not include raw health data such as heart rate, GPS routes, or body metrics.
Support assistant: Google’s Gemini service processes messages and images you submit, together with device and sync context, to answer questions about Riina and wearable connections.
These processes do not make decisions that produce legal or similarly significant effects about you within the meaning of Art. 22 GDPR.

International data transfers

Your data is stored in the European Union (Amsterdam). Some providers, such as Anthropic, are based in the United States, and Meta may transfer website pixel data to the United States where you have accepted cookies. Where data is transferred outside the EU/EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) together with additional safeguards. You can contact us for more information about these transfers.

How long we keep your data

We keep your personal data while your account is active and as needed to provide the service.
When you request deletion, we delete or anonymize your personal data without undue delay and within one month, except where the law requires us to retain certain information.
Some derived, non-identifying league and game results may be retained as part of competition history.
Backups are rotated on a routine schedule and purged in the ordinary course.

Your rights

Under the GDPR / UK GDPR you have the right to:

Access a copy of the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data (“right to be forgotten”) — see the account deletion page.
Restrict or object to processing, including processing based on legitimate interests.
Data portability — receive your data in a structured, commonly used, machine-readable format.
Withdraw consent at any time, including for health-data processing, without affecting prior processing.
Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email privacy@riina.io or use the in-app controls. We respond within one month. You can also complain to your local EU member-state supervisory authority, or, in the UK, to the Information Commissioner’s Office (ICO).

Analytics and tracking

In the app

The app records app-session and screen-view events through an internal analytics system. Your user ID is hashed with SHA-256 and only a shortened hash is stored. You can disable analytics in the app settings.

Advertising measurement in the app

Where you allow it, the app tells Meta Platforms when you reach one of five milestones — you created an account, synced a workout that scored, created a challenge, joined one, or accepted a team invitation — along with your device’s advertising identifier. This is how we learn which of our Facebook and Instagram ads led to people actually using Riina, rather than only to installs.

It is the fact of the milestone that is sent, and nothing beneath it: no workout, no heart rate, no route, no photo, no message, no health data of any kind. Riina does not show advertising inside the app, and your health data is never used to target advertising anywhere.

In the EEA and the UK it is off until you turn it on. On iOS you are asked through Apple’s App Tracking Transparency prompt; on Android, through our own consent sheet. The legal basis is your consent (Art. 6(1)(a) GDPR). Decline, and the advertising identifier is never read and no events are sent. You can change your mind at any time — on iOS under Settings → Privacy & Security → Tracking, and on Android in Riina’s own settings — and we stop. Outside the EEA and the UK, where consent is not legally required for this, measurement is on by default on Android and can be switched off in the same place; on iOS Apple’s prompt is shown everywhere.

Meta Pixel on riina.io

Our website — and only the website, never the app — can load the Meta Pixel, a measurement tag from Meta Platforms that tells us which of our Facebook and Instagram ads lead to visits, so we can measure and target our advertising. It sets the _fbp cookie and sends Meta your IP address, browser user agent, and the page you are viewing.

The pixel is off by default. It loads only after you choose Accept in our cookie banner — the legal basis is your consent under Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive. If you decline, no script is loaded, no request is made to Meta, and no cookie is set. You can change your mind at any time through Cookie Settings in the site footer; withdrawing stops further collection and deletes the pixel’s cookies from your browser.

The pixel never receives your account, workout, or health data. For the collection and transmission of website data to Meta, we and Meta Platforms Ireland Ltd. act as joint controllers within the meaning of Art. 26 GDPR under Meta’s Controller Addendum; Meta’s own further processing is governed by its privacy policy.

Children

Riina is not intended for children. You must be at least 16 years old to use Riina. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact privacy@riina.io and we will delete it.

Security

We store application data in PostgreSQL and media (photos and videos) in object storage, hosted in the EU. Uploads use signed URLs. We apply technical and organizational measures appropriate to the sensitivity of health data. If a personal-data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected users where required.

Changes to this policy

We will update this policy when our data practices change — for example around media access, route visibility, analytics, AI processing, or new service providers — and we will revise the effective date above. For material changes we will give notice in the app or by email where appropriate.