Riffgame
Get the app
MenuClose

Privacy Policy

Last updated: 9 October 2026

Riffgame is built by PitchCall, Inc. ("we", "us"). This policy explains what we collect when you use the Riffgame app on iOS and Android, the games at games.riffgame.com and this website, why we collect it, who we share it with, and what you can do about it. We keep it as short and plain as we can.

What we collect

Your account

The first time you open the app we create an account for you with a random user ID. You do not need to sign up to play or to make games. When you tap "Agree & get started" we store which version of our terms you agreed to and when.

Linking an account (optional). You can play, make and post games without one. If you choose to save your games with Sign in with Apple or Google (so they stay safe when you change or reinstall your phone), we receive an account identifier from Apple or Google and, if they provide them, your email address and name. Apple may give us a private relay email address instead of your real one. We use these only to sign you in and to find your account if you contact us. They are never shown to other users. If you use Sign in with Apple, we may also keep a token from Apple that lets us revoke Riffgame's access to your Apple ID when you delete your account.

Your age

When you first open the app (or, for an account made before this question existed, at your next app open or before your next build) we ask "What year were you born?" once. The year you type is the only way we learn your age: we do not ask Apple or Google for it.

On our servers we store only an age group (under 13, 13–17, or 18 and over), where it came from (the year you typed, or our team) and when. We never store your birth year. A year you type stays on your phone only until our servers have stored the age group (for example while you are offline), and it is never sent to analytics, crash reports or our purchase provider.

Your creator profile

You do not need a linked account to post games. Your public profile has a username (generated for you when you first open the app and claimed when you first post; Pro members can choose their own, and every username is checked against our rules) and an avatar from a fixed set of pictures. Riffgame has no free-text bios, comments, chat or direct messages.

Your prompts and games

We store what you type to describe or change a game, the plans and replies the AI writes, the generated game code and files, the game's title, description and cover screenshot, and every saved version. This is stored with Google Cloud (Firebase) and Cloudflare. Please do not put personal information in your prompts.

Social activity

Likes, follows, remixes, the reports you send (the reason and any details you add), the users you block, your Activity feed and your notification and privacy settings.

Purchases and riffs

Subscriptions and riff packs are paid through Apple (In-App Purchase) or Google Play Billing. We never see your card or bank details. We use RevenueCat to check purchases. We receive the product, price, currency, country, store transaction IDs and subscription status, linked to your user ID, and we keep a record (ledger) of riffs added to and spent from your account. On iOS, RevenueCat also receives Apple's AdServices attribution token so we can tell whether an install came from an Apple Search Ads campaign.

Free riffs: one grant per device

New devices get a one-time grant of free riffs. To stop that grant being claimed again and again on the same phone:

We use these hashes only to check whether a device has already received the grant. The app also uses Firebase App Check (Play Integrity on Android, Apple DeviceCheck on iOS) to confirm that requests come from the genuine app.

Push notifications

To tell you when a game is ready, the app registers your device with Firebase Cloud Messaging (Google), which delivers notifications through Apple Push Notification service on iPhone and Google Play services on Android. We store the device's notification token with your account ID, your app language and app version, and delete it when you delete your account or when the token stops working. We send notifications only if you allow them; you can turn them off in the app's Settings or in your phone's settings. Older app versions (2.0.0 and earlier) used OneSignal (United States) for the same purpose: it received your user ID, your device's push token, language, device type, operating system and app version.

Analytics and crash reports

We use PostHog (United States) and Google Analytics for Firebase to understand how the app is used: for example which screens and features are used, builds started and finished, purchases started and completed, and links opened (including campaign tags). These events include your user ID, device model, operating system, app version, language and an approximate location (country or city) worked out from your IP address. We use Firebase Crashlytics to collect crash reports and related diagnostic data (device state, the error), linked to your user ID.

Analytics and crash reporting start only after you tap "Agree & get started". You can turn both off at any time in the app: Me → Settings → Share usage analytics and crash reports. The switch applies to the phone you set it on; while it is off, the app sends no analytics events and no crash reports from that phone. They are always off for anyone who tells us they are under 13: on first launch the events wait until the age question is answered, and are deleted without being sent if the answer is under 13.

Playing games on games.riffgame.com

Every game is a web page. When a game page opens, a small script records the open and how long the page stays open, using a random session ID created for that browser tab. With the open we also record where the visit came from: the name of the site that linked to the page (for example reddit.com, never the full address of the page you came from), any campaign tags in the link (such as utm_source), and your country, which Cloudflare works out from your IP address. None of this is linked to your account. We use it to count plays, rank games and see which places send players. Cloudflare, which delivers the pages, processes your IP address to do so; we do not store it.

Support

If you email us, we keep your email and any details you send. The app's Help button adds your account ID and app version to the email so we can find your account. An email about an account that is blocked as under 13 (for example to show that the year was a mistake) is used only to decide that request, and we delete it once we have decided; we keep only the decision.

"Entered the wrong year?" requests

If the app shows the 13+ notice, its "Entered the wrong year?" link lets you send the Riffgame team a request with an optional note (up to 500 characters; please do not include your name, address or phone number), and gives our support email address for the proof. We store the request with your account ID, the age group and where it came from at that time, and your platform (iOS or Android) and language. Only the people who run Riffgame read it, and only to decide the request. We reopen an account only with evidence, for example a parent or guardian confirming by email; a note on its own is not enough. Nothing reopens an account automatically.

What we do NOT collect

Games open in an in-app browser view (Safari View Controller on iOS, Chrome Custom Tabs on Android). Games get no access to your account, your device's features or any of the data above.

How your data is used

We do not sell your personal data, we do not show ads, we do not share your data with advertisers, and we do not track you across other companies' apps or websites. We do not use your prompts or games to train AI models.

If you are in the EU, the UK or a similar jurisdiction: we process your data to provide the service you asked for (contract), for our legitimate interests in keeping Riffgame safe, preventing fraud and improving the app, with your consent where we ask for it (AI processing on the Welcome screen, analytics and crash reports, notifications), and to meet legal obligations.

AI processing

When you describe or change a game, remix a game, or post a game, the text you wrote, the AI's plan and the game's code and title are sent to our AI provider. The provider uses them to write and fix the game and to check content against our rules. It does not receive your name, email address or payment details. You agree to this on the Welcome screen ("Agree & get started").

How long we keep it

How to delete your account and what happens then: riffgame.com/delete-account.

Sharing with third parties

We share data only with the service providers that run Riffgame for us, and only what each one needs:

Each provider has its own privacy policy. Other users see only what you make public (see "Public games and profiles" below). We may also disclose data when the law requires it, to protect people's safety (for example, reporting child sexual abuse material to the authorities), or as part of a sale or merger of our business.

International transfers. Our main servers are in the United States. Prompts and game code are processed in the People's Republic of China by DeepSeek, and Cloudflare serves pages from data centres around the world. These countries may not have the same data protection laws as yours. We rely on the safeguards our providers offer for these transfers where they are available.

Your rights and choices

Depending on where you live (for example under the GDPR, the UK GDPR or the California Consumer Privacy Act), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict some processing, and to withdraw consent. Email [email protected] from the email address linked to your account, or include your account ID (shown at the bottom of the Me tab). We answer within 30 days. You can also complain to your local data protection authority. We do not sell or share personal information for cross-context behavioural advertising.

Children

Riffgame is for people aged 13 and over (or older where the law of your country requires it). It is not directed at children under 13, and we do not knowingly collect personal data from them. We ask everyone's age once when they first open the app (see "Your age") and keep only the age group.

If someone tells us they are under 13, Riffgame stops working for that account: the app shows a notice instead, our servers refuse to build games, post, like, follow or change the profile for it, the app sends nothing they type to our AI provider any more, and analytics and crash reports are turned off on that phone. From the notice they can delete the data saved for the account. Deleting the data does not remove the under-13 marker: we keep only the fact that the account told us it is under 13, where that came from and when, so the account stays blocked. The app also remembers on that phone that someone said they were under 13, so starting again as a new guest does not reopen it. If the year was a mistake, "Entered the wrong year?" on the notice lets them ask us to check (see above): a year typed again never reopens an account, and we reopen one only with evidence. People under 13 can never post games or have a public profile. If you believe a child under 13 is using Riffgame, email [email protected] and we will delete the account.

Public games and profiles

If you have told us you are 18 or older, every new game you make is public by default as soon as it passes our automatic safety check, whether or not you have linked an account (Pro members can keep new games private). Your first public game claims the username generated for you. Games you made before you answered the age question are not posted automatically. A public game shows on Home, in Explore and search, on your profile and on riffgame.com/games, together with your username, avatar, the game's title, cover, description and genre, and its play, like and remix counts. Anyone can play a public game, and other users can remix it unless you turn remixing off. Public games and profiles can appear in search engines.

If you are 13 to 17, your games are private: they are never posted automatically, and you cannot post them publicly. If you share one, it is unlisted: only people who have its link can play it, other users cannot remix it, and it never shows on Home, in Explore or search, on your profile or on riffgame.com/games. You can take it back at any time.

Games made by someone under 13, or by an account that has not answered the age question, are not listed publicly. But every game is a web page at its own link on games.riffgame.com, and anyone who has that link can play it. Treat shared links accordingly. Remixes that other people made before you removed a game stay theirs.

Security

Data is encrypted in transit (HTTPS) between the app, our servers and our providers, and access to production systems is limited to the people who run Riffgame. No system is perfectly secure; tell us at [email protected] if you find a problem.

Changes to this policy

If we change this policy we will update the "Last updated" date above. If a change is material, we will tell you before it takes effect, for example in the app's update notes or in the app.

Contact

PitchCall, Inc.
[email protected]