App privacy policy

1. Who we are and what this policy covers

Riar is run by H. Ameh, Lyster Square, Portlaoise, Co. Laois, R32 CV97. Riar is the data controller for the personal data this app collects. We're based in Ireland, and this policy is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679), the Irish Data Protection Act 2018, and the ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC), transposed into Irish law by S.I. No. 336 of 2011.

This policy covers the Riar mobile app, the riar.ie website, and any account you hold with us. Riar is currently built, marketed and supported for Ireland only. We don't operate, advertise, or provide support in any other market. This describes our operating scope, not a restriction on who may use the app.

The waitlist on riar.ie and the beta signup form are also described here, and in short in the waitlist privacy notice.

We haven't appointed a Data Protection Officer. Under Article 37 GDPR one isn't currently required for a service of our size and type, and we'll review that as Riar grows. The contact address below reaches the person responsible for data protection directly.

Questions about this policy or your data go to privacy@riar.ie. Full detail is under "How to contact us" at the end of this page.

2. What personal data we collect, and where it comes from

We only collect what the app actually needs to work. Specifically:

• Account and sign-in data: your email address, phone number, or Apple/Google/Microsoft account identifier, depending on how you sign up. Passkey credentials if you set one up. If you sign in with your phone number, we send the sign-in code by text message through an SMS provider (see Section 7).
• Connected email (Gmail/Outlook): read-only access, covering the last 90 days at connection and new mail after that. We classify messages into the item types Riar supports; anything else is ignored and never stored.
• Photos and documents you send us, for extracting dates, amounts and provider names.
• Content you actively forward: screenshots, text, SMS or WhatsApp messages sent via your phone's share function, or emails forwarded to your personal Riar email address. We never access these unless you send them to us yourself.
• Item details you type in: titles, dates, amounts, notes, attachments.
• Location, only if you switch on geofenced nudges for bin collections or the M50 toll. This uses on-device region monitoring, not continuous GPS tracking, and can be turned off any time.
• Dates from your calendar, only if you choose to import them. Your phone gives Riar access to all your calendars, so Riar limits itself: it reads only the calendars you pick, looks only for dates that repeat every year (such as birthdays and anniversaries), and does this on your phone. Only the dates you tick are saved, as a title you can edit and the date. Riar never uploads your calendar, keeps a copy of it, or sends it to our AI provider, and after an import we suggest you turn calendar access off.
• Adding reminders to your calendar: if you choose this, Riar opens your phone's own Add event screen with the details filled in. You pick the calendar and confirm. Riar can't read your calendar this way and receives nothing back.
• Household data: if you share items with other people in your household, they see what you've explicitly shared and nothing else.
• Dependant profiles: details you enter about a child or person you look after, entered by you as the adult account holder.
• Device and diagnostic data: crash reports, app version, device type. Standard technical information needed to keep the app running.
• Waitlist (riar.ie): your first name, email address, which form on the page you used, and when you signed up, plus the reminder types you picked on the page, if any. Only types from our list are saved, never anything you typed as a custom reminder. You also confirm you're 16 or over.
• Beta signup form: your name and email, plus the answers you choose to give: age bracket, housing situation, who you live with, whether you switch providers to save money, what you're most likely to forget or overpay on, and whether you'd like to join weekly check-ins.
• Beta emails: we don't track whether you open our emails or click their links.
• Information other people give us about you: if someone invites you to their household, shares an item with you, or sets up a "managing for" profile with your recorded consent, we receive your email address or phone number and the items they choose to share. We tell you who invited you the first time you're contacted, and you can decline or leave at any time.
• What we don't collect: payment card details (Apple and Google handle subscription billing), your contacts, anything from your calendars beyond the yearly dates you tick, or anything from your inbox that isn't a supported item type.

3. Why we process your data, and our legal basis

We also look at which custom items (ones outside our built-in categories) come up often, to decide what to add as a new built-in category. This is legitimate interest (Art. 6(1)(f)), and it's always aggregated and de-identified first: a pattern is only reported once it appears across a minimum number of distinct users, never as your individual wording.

We do not process your data for advertising, profiling for marketing purposes, or any purpose you haven't been told about here.

Do you have to give us this data? No law requires you to. Your sign-in details are needed to create an account, because we can't run the service without them. Everything else is optional: if you don't connect an inbox, forward emails or send photos, Riar simply has less to remind you about, and you can add items by hand instead. Joining the waitlist is entirely optional and has no effect on whether you can use Riar later.

Information about other people that you add

Some reminders are about other people, for example a friend's birthday you import from your calendar or type in. For these we store only what you enter (usually a name you choose and a date), use it only to remind you, and delete it when you delete the item or your account. We rely on legitimate interests (Art. 6(1)(f)) for this: it's what you asked us to do, it's minimal, and the people concerned aren't contacted by Riar. We don't notify them individually, because that would mean collecting more about them than we hold (Art. 14(5)(b)).

4. Special category (health) data

The optional Health pack lets you track appointments, repeat prescriptions, medical card and GP visit card reviews, vaccinations (including a child's vaccinations, added by a parent or guardian) and similar items. Some of this counts as "special category" health data under Article 9 GDPR, which needs a higher bar than ordinary personal data.

• We only process it with your explicit consent, under Article 9(2)(a). Switching on the Health pack is that consent, and switching it off (with deletion) is always available in Settings.
• We minimise what's stored by default: Health pack items use generic titles like "Appointment" rather than the specific reason for a visit, unless you choose to add more detail yourself.
• Health data is never used for anything beyond reminding you: no analytics, no profiling, no sharing with any third party.
• Calendar import skips one-off events, which keeps appointments out. If a date you choose to import looks health-related, Riar asks for Health pack consent before saving it.

5. Dependants, children, and Article 8

Riar is for people aged 16 and over. That's both our own age gate and Ireland's chosen age of digital consent under Article 8 GDPR, so nobody under 16 holds a Riar account, joins the waitlist, or agrees to anything themselves through the app. If we learn we've collected data from someone under 16, we delete it.

Dependant profiles work differently: when you add a child or someone you look after, that's you, the adult account holder, entering and consenting to that processing yourself. The dependant isn't a Riar user, hasn't agreed to anything, and can't access the app. You're responsible for what you record about them, the same as you would be for any other note you kept about your family.

If you're managing reminders for another adult (a "managing for" profile), we require their recorded consent before that access is set up.

6. How automated extraction and AI processing works

When you connect an email account or send us a photo, Riar uses automated processing, including AI language models, to identify dates, amounts, providers and item types.

This isn't a solely automated decision with a legal or similarly significant effect on you under Article 22 GDPR: nothing acts on your behalf without your review. Anything below our confidence threshold goes to a "Check these" list for you to confirm yourself, rather than straight into your reminders.

Under Article 50 of the EU AI Act (Regulation (EU) 2024/1689), in force since 2 August 2026, providers must tell people plainly when they're interacting with an AI system. This is that notice: extraction is AI-assisted, not read or reviewed by a person at Riar. Extraction currently runs through Anthropic's Claude models. See "International data transfers" below for how that's handled. Dates imported from your calendar are never sent to an AI model.

7. Who we share your data with

We do not sell your data, and we do not show ads or share data with advertisers. This is a permanent product commitment, not a launch-phase promise.

Data is shared only with processors acting on our instructions, under contract:

Google user data. Riar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice: Gmail data is used only to find the items you asked Riar to track; it is never used for advertising, never sold, never used to train AI models, and no person at Riar reads it unless you ask us to for support, it's needed for security, or the law requires it. The same rules apply to data from your Microsoft account.

The comparison links shown for renewal items (Bonkers.ie, Switcher.ie, Chill.ie, Mortgages.ie, and hia.ie, the Health Insurance Authority, for health insurance) are plain hyperlinks with no data shared, no tracking, and no commercial or referral relationship of any kind. We get nothing from these clicks, and neither do they get anything from us.

We'd only disclose data if legally compelled to (for example, a valid court order). This hasn't happened, and we'd tell you if we were legally permitted to.

8. International data transfers

Our core infrastructure (Supabase) is hosted in the EU, so your data stays inside the EEA by default.

Some processors (Apple, Google, Microsoft, Anthropic) may process data outside the EEA as part of their own global infrastructure. Where that happens, we rely on Standard Contractual Clauses or an applicable EU adequacy decision, as required by GDPR Chapter V, and only ever send what's strictly necessary for the feature involved.

You can ask us for a copy of the safeguards that apply to any transfer, using the contact details in Section 14.

The riar.ie website and the waitlist run on Lovable's Europe hosting region. The beta signup form runs on Google Forms, and Google may process those answers in the United States; that transfer relies on the EU-US Data Privacy Framework, with Standard Contractual Clauses as the fallback.

9. Retention, and your control over your data

The app's "Your data" screen always shows every source you've connected and every item stored, with one-tap export and delete-all available whenever you want it.

We keep your data while your account is active. If you delete your account, we delete your data within [30] days, except where we're legally required to keep something longer (for example, payment records, if you're a paying subscriber).

Disconnecting a connected email account deletes its access tokens immediately. We don't retain a copy of your inbox once you disconnect.

Waitlist and beta signup details are kept until the beta opens and you've received your invite. If you don't go on to create an account, we delete them within [3] months of that invite. If you unsubscribe, we remove you from the list straight away and keep only a one-way hash of your email address on the unsubscribe list described in Section 3.

10. Security

• We connect email accounts using read-only OAuth scopes only. Riar can never send email or delete anything in your inbox.
• Data is encrypted in transit and at rest.
• Reminders are scheduled on-device, so they fire reliably even without a network connection, and don't depend on our servers being reachable.
• Access to production data is restricted to what's needed to run the service; we run a formal Data Protection Impact Assessment for higher-risk processing (such as the Health pack) before launch.

[This section should be reviewed and expanded once the technical build is finalised: specific encryption standards, access control model, and incident response process should be named here rather than described generically.]

11. Your rights

Under GDPR and the Irish Data Protection Act 2018, you can:

• Access the data we hold about you (also available directly in-app via "Your data")
• Correct anything that's wrong
• Delete your data (also available in-app, one tap)
• Restrict or object to certain processing
• Take your data with you in a portable format (export, also in-app)
• Withdraw consent at any time for anything based on consent, without affecting what happened before
• Complain to the Data Protection Commission if you think we've got something wrong (see Section 14)

Most of these you can do yourself, instantly, in the app. For anything else, contact us using the details in Section 14 and we'll respond within one month, as GDPR requires.

To stop beta emails, use the unsubscribe link in any of them, or reply with "unsubscribe".

12. Cookies and the website

The Riar app itself doesn't use cookies, because it's a mobile app, not a browser. Our website (riar.ie) sets no cookies, stores nothing on your device and runs no advertising trackers or third-party analytics. Its fonts are served from our own site rather than from Google, so visiting it doesn't send your IP address to any third party beyond our host.

Website visit counts. To see whether the site works, riar.ie keeps simple daily counts: how many times each page was viewed, how many times someone tried the reminder demo, and how many people joined the waitlist. Each count is just a date, a page, an event name and a number. We don't record your IP address, browser, device, where you came from or any identifier, so the counts can't be linked to you or anyone else, and nothing is stored on your device. The counts are kept on our host (Lovable) and deleted after 24 months. We rely on legitimate interests (Art. 6(1)(f)): knowing whether the website is working, with no effect on you.

The waitlist section also shows how many of the first 100 beta places are left. That's a single number worked out from the signups; nobody visiting the site can see who signed up.

13. Changes to this policy

We'll update this policy as the product changes, and the date at the top will always show the latest revision. If a change is material, we'll tell you directly in the app rather than relying on you checking this page.

14. How to contact us, and how to complain

For anything to do with your data or this policy: privacy@riar.ie.

If you're not satisfied with our response, you have the right to lodge a complaint with Ireland's Data Protection Commission: