Privacy Policy

1. Scope

This policy covers the Reva iPhone application and this website. You can use all of Reva without registering or signing in. If you do not sign in, we hold no profile of you and cannot identify you from the information described below. If you choose to sign in, we hold one account record, described in section 5.

2. Information held on your device

The application stores the following locally: your questionnaire answers, the description generated from them, every pause and its outcome, your progress through the programme, each weekly summary, and any text you have entered.

None of this is synchronised between devices or recoverable by us. It reaches our servers only inside the encrypted backup described in section 6, if you choose to make one, and we cannot read it there. Removing the application removes it from the device.

3. Information that leaves your device

Six recipients receive anything at all, and each is limited to what is listed here. Two of them receive nothing unless you choose to use the feature they serve.

• Product analytics

  Events the application sends deliberately: views of named screens, sent by the application itself, with automatic screen and app-lifecycle capture switched off; which question of the assessment was on screen and how long it took, never the answer chosen; the assessment's result, meaning its scores, severity band and the parts of the persona; and escalation and level events, which carry an opaque hashed ID for each blocked app, never its name. Plus your region, App Store storefront and age band. No individual pauses, no text you have written, and no account ID or email address.

  PostHog · European Union
• Crash and error reporting

  Crashes, hangs, and errors the application reports about itself, including the technical description of the error. No account ID or email address.

  Sentry · European Union
• Your account, only if you sign in

  The account record described in section 5, through Firebase Authentication and Cloud Firestore, and a device attestation from Apple's App Attest or DeviceCheck through Firebase App Check, so that only the genuine application can reach it. The application does not contact Firebase at all unless you sign in.

  Google Firebase · United States (multi-region)
• Purchases

  What you bought and whether your subscription is active. Apple processes the payment; RevenueCat records the subscription status. RevenueCat knows you by a random anonymous ID, or by your account's user ID once you sign in.

  Apple · RevenueCat
• The daily number, only if you nominate someone

  Four values once a day: the date, how many pauses you walked away from, how many there were, and whether the pause changed that day.

  reva.otterwright.com · United States
• Update check

  The application's bundle identifier, sent to the App Store's public lookup service to check whether a newer version has been released.

  Apple

The application contains no Firebase Analytics and no advertising or attribution SDK of any kind.

Screenshots, interface hierarchies and the addresses the application contacts are explicitly disabled in crash reporting, rather than left at their default settings.

4. Information that never leaves your device

The following are prevented in the application’s code, not merely by policy. Two things cross this line, and each says so: your age band, below, and the encrypted backup in section 6, if you make one, which carries what the application stores, locked with a key only you hold.

• Your pauses

  Every pause, how long you took over it and what you decided remains on the device. No event carries this, and it is not reconstructed from a screen view and a timestamp.

• Your answers

  Analytics records which question was on screen and how long it took, never the option you selected. The result your answers produce, meaning its scores, severity band and the parts of the persona, is sent to analytics; the answers behind it are not.

• Your age band, which does leave

  It comes from a separate question, "Roughly how old are you?", not from the nineteen assessment items. The band is sent to analytics, and stored with your account if you sign in, as sections 3 and 5 say.

• Text you write

  A name you enter, a description you rename, a sentence you type at a pause. None of it appears in an analytics event, a crash report or a diagnostic trail.

• Which apps, and for how long

  Screen Time gives Reva opaque tokens for the apps you choose, never their names or the minutes you spend in them, and Reva hashes those tokens before storing them. The hashed ID is all that escalation and level events carry.

• Who you are, in analytics or crash reports

  No account ID and no email address is attached to anything sent to PostHog or Sentry.

• Error messages, in analytics

  Crash reporting receives the error text, because diagnosing a fault requires it. Analytics receives only the shape of the failure: the operation, the error category and the code.

5. Your account, if you create one

Signing in uses Sign in with Apple and is never required. The free features, the pause, the crisis path and the helpline links all work signed out. An account does two things: Reva Plus follows it to a new or second phone, and it gives the encrypted backup in section 6 somewhere to live.

The account is held by Google Firebase, as one record in Cloud Firestore identified by the user ID Firebase assigns. It holds the following, and nothing else.

• Apple identifiers

  The user identifier Apple assigns you for Reva, and Apple's transfer identifier.

• Email address

  The address Apple provides, which may be an Apple private-relay address, and a flag recording whether it is one.

• Purchase IDs

  The RevenueCat user IDs linked to the account, so a subscription can follow it.

• Profile

  Your market (region and App Store storefront), your age band, whether you completed onboarding, the application version, and when the application was last seen.

• Timestamps

  When the record was created and when it was last updated.

• Encrypted backup

  Only if you made one, and only in the encrypted form described in section 6.

Once you are signed in, RevenueCat receives your Firebase user ID in place of the anonymous ID it used before, so that a subscription can follow the account.

6. Encrypted backup

If you are signed in, you can keep a backup of what the application stores. It is compressed and then encrypted on your phone, with ChaCha20-Poly1305, using a key generated on your phone. The key is kept in this device’s Keychain only and is not synced to iCloud. It is shown to you once so that you can copy it.

Our server stores only the encrypted backup. We cannot read it, and we cannot recover a lost key. If you lose the key, you lose the backup.

To restore on a new phone, sign in and paste the key. You can also restore from an exported file (section 10) without any account.

7. The daily number

You may optionally nominate one person to receive a single figure once a day: how many of that day’s pauses you walked away from. They receive the four values listed in section 3 and nothing further — not which applications, not the time of day, not any text you have entered, and not the description generated from your answers. The name you give them stays on your phone. The application will not start if that set of fields is widened.

Only the most recent day’s figures are retained; each day replaces the last. No history is kept and no trend is calculated. The recipient needs no app and no account, and is asked for no information about themselves.

The recipient may decline at any time from the page they were sent, which stops the figures being sent, without our involvement and without being asked to notify you; you would see the nomination is no longer listed in the application’s settings. You may also end it yourself at any time, which deletes the stored figures. This feature is not offered to users under 18.

8. This website

This site sets no cookies, runs no analytics and stores nothing in your browser. An earlier version of the home page kept two timing measurements in your browser’s local storage, on your own device, and never transmitted them. If your browser still holds them, the site deletes them the next time you visit.

Typefaces are served by a third-party font service, which necessarily receives your IP address and browser details in order to deliver them. Our hosting provider keeps standard server logs for security and reliability.

Pages carrying a daily number for a nominated recipient are excluded from search engines, send no referrer information to any other site, and carry no analytics, navigation, marketing or account links.

If you are reading this on an Android device and leave an email address to be told when there is an Android build, that address is held on our server in the United States. It is the only thing stored: no device details, no page you came from, and nothing that identifies the visit. It is used for one message about that build, it is never sold or passed to anyone else, and writing to support@reva.otterwright.com removes it.

9. Retention

Information on your device is retained until you delete it or remove the application. Your account record and encrypted backup are retained until you delete them from the application; after that, only a marker holding the record’s ID, a deleted flag, and the dates it was created and deleted remains. The daily number is retained only until the following day’s figure replaces it, or until the nomination ends. An address left for word of an Android build is retained until that message is sent or you ask for its removal, whichever is first. Analytics, crash reporting and purchase records are retained according to the standard retention periods of the respective providers.

10. Your choices

Export. Settings → Your data → Export everything gives you a complete copy of everything the application holds about you, free of charge, as a single JSON file. It contains every answer with the time spent on it, every description generated, your programme and its progress, every pause, every weekly summary and any nomination. Two internal classification values are deliberately excluded. The same file can be restored on a new phone, with no account.

Deletion. Settings → Delete everything. If you are signed in, it first revokes the application’s Sign in with Apple token, deletes your Firebase sign-in, and wipes your account record down to the marker described in section 9: your email address, Apple identifiers, profile, backup and RevenueCat IDs are removed. It then removes the local database and both preference stores from the device, and ends any nomination on our server. The device is erased either way. If a server step cannot be confirmed, for example because the phone is offline, the application tells you so rather than reporting success, and your account stays until you open Reva online and sign in again, or write to support@reva.otterwright.com.

Deletion does not itself remove what the analytics, crash reporting and purchase providers already hold; section 9 covers how long they keep it. Nor does it cancel a subscription: subscriptions are billed by Apple and cancelled in your iPhone’s Settings → Apple Account → Subscriptions.

Notifications. The application sends one notification, a morning check-in, and only if you switch it on and choose a time. It is off by default.

Blocking permission. The permission allowing the application to place a pause in front of other applications is managed by iOS, and you may withdraw it at any time in the iOS Settings app. We are never told which applications you selected.

11. Children

Reva is not intended for children under 13, and we do not knowingly collect information from them. The questionnaire, its wording and its safety routing are written for adults and older teenagers. Users under 18 are not offered the daily number described in section 7.

12. Changes and contact

If what the application does changes, this page is updated in the same release. The date at the top reflects the most recent revision.

For any question about this policy, or to report anything here that does not match what you see in the application, write to support@reva.otterwright.com.