Privacy

The short version

Your library is kept on your account. Every score, note, review, list, favourite and backlog item is saved to it as you make it, and reaches your other signed-in phones within seconds. Each phone also keeps a copy of its own, so the app is fast and keeps working without a connection.

You make an account the first time Ryfa opens. There is no password; you sign in with Apple or with an emailed code.

Everything that leaves the phone is listed below, with the reason it has to.

Who is responsible

Controller

[to be supplied]

Address

[to be supplied]

Email

[to be supplied]

The controller for this processing is the provider named in the Impressum.

What is kept on your account

Ryfa sets up an account the first time it opens and cannot be used without one, so this applies to everybody who uses it.

• Which works are in your library, and whether each is rated, logged, queued or abandoned.
• Your scores, with the date you gave each one and any note written with it, including scores brought in from an import, which stay marked as imported.
• Your reviews, your notes and scores on single tracks and episodes, your lists with their names and order, and your favourites.
• Enough about each work to draw it again on a new phone: its title, who made it, its year, its cover, and the identifiers the catalogue sources use.

This exists so your library is the same on every phone you sign in to and survives a lost or replaced one. It is readable by you and by nobody else: every row is tied to your account and the database refuses a request for anybody else's. Your friends see only what the Friends section describes, never your notes, your reviews or an imported score.

When something changes, the phone sends it to your account, and the account sends your other phones a signal with no content in it, on a channel only your account can open, so they fetch the change straight away.

Removing something, whether a work, a review, a note or a list, removes it from your account too. What remains is a marker that it was removed, so your other phones remove it as well; a removed review or note leaves no text behind.

• Legal basis: Article 6(1)(b) GDPR. Keeping your library is the service the account is for.

What stays only on this phone

• Cover art you chose yourself.
• Your settings, including the metadata language.
• Pictures and catalogue answers the app has saved so it does not have to fetch them again.

None of this is sent anywhere. It is included in an iPhone backup, because the whole app container is, and it is removed when you delete the app.

Your name and your picture

Ryfa asks what to call you when you make your account, and the name you give is kept on it. Sign in with Apple offers the name on your Apple Account; Ryfa shows it to you on that screen rather than taking it, so nothing is stored that you have not seen and accepted.

A picture is optional. Until you set one, your profile draws a pattern of dots worked out from your account number — it is not a photograph of anything and it is not stored anywhere, because it can always be drawn again.

If you do set one, the picture is cropped square, converted to black and white and made small on this phone before any of it is uploaded, so the file that leaves is not the file you picked: no location, no camera details, and none of the original pixels. Ryfa asks the system for one image at a time and never for your photo library.

Your page is what a friend sees when they open you: your name and picture, how many things you have rated in each medium, your favourites shelves, and the line for each thing you rate. Never a note, a review, an imported score or a list. If your profile is public, anybody signed in sees the same page.

Your name and picture are shown to friends beside what you rated, and on any link you mint. The picture is served from a public address so that a link opened by somebody who is not signed in can show it. Removing the picture deletes it from the server; changing it replaces the same file rather than leaving the old one behind.

• Legal basis: Article 6(1)(b) GDPR. A profile that can be recognised is part of what an account is for.

The calendar link

Off unless you turn it on in Settings. When it is on, each evening you schedule is also kept on your account — its title, the note Ryfa writes into the event, and when it starts and ends — and served as a calendar at a private address, so that Vael, Google Calendar or any other calendar app you give the address to can show it.

Anyone who has the address can read those bookings, which is how a calendar subscription works. Making a new link in Settings stops the old address working everywhere. No score and nothing else from your library is ever part of it.

• Legal basis: Article 6(1)(b) GDPR. Showing your bookings in the calendars you choose is what you turned it on for.

What leaves the device

Catalogue searches. When you search or open a title, the query goes to the Ryfa proxy, which forwards it to the source that can answer it. The proxy holds the keys for TMDB and IGDB so that no key has to sit inside the app.

A per-install identifier travels with those requests. It is a random value created on this device, it is not your Apple Account and it is not linked to you. It exists so one copy of the app cannot exhaust the request budget everyone else is sharing.

Reports and blocks, if you send one. These need an account, which is described below.

• Legal basis: Article 6(1)(b) GDPR, because answering a search is the service you asked for.
• The per-install identifier and the request ceiling rest on Article 6(1)(f), the legitimate interest in keeping the service usable and not paying for abuse.

The account

Ryfa cannot be used without an account, because your library is kept on it. You make one the first time it opens, with Sign in with Apple or with a code sent to your email. It is also what a username, a report, a block, a shared link or an entry contributed to the shared catalogue belongs to.

There is no password. With Sign in with Apple, Ryfa asks Apple for an email address and nothing else — never your name — and Apple may give it a private relay address instead of your own. With email, the address is held by the sign-in service and used to send you a code, and for nothing else. Either way the address is how the account is reached from a new phone.

You can erase it from Settings at any time. That deletes the account and everything attached to it, and it is not reversible. What survives is described under Keeping and deleting.

Who else sees a query

A search reaches whichever source can answer it. These are independent providers with their own privacy terms, and what they receive is the search itself plus the network connection it arrives on.

• TMDB, for films and television.
• MusicBrainz and the Cover Art Archive, for albums and songs.
• IGDB, through Twitch, for games.
• TVmaze, Deezer, iTunes and ListenBrainz, as fallbacks and for recommendations.

Some of these are outside the European Economic Area, so a search can reach a country whose data protection law is not the same as European law.

Artwork is fetched by your phone straight from the image host, so those hosts see a request for a picture. No image ever passes through a Ryfa server, which is also why they are fast and cost nothing.

What Ryfa does not do

• No analytics, no telemetry, no crash reporting, no advertising and no tracking of any kind.
• No profile is built about you, and nothing is sold or shared for marketing.
• No account average, no vote count and no ranking is shown to you, so nothing about other people needs to be gathered in order to draw a screen.

Keeping and deleting

• Your library is kept on your account for as long as the account exists. Deleting the account deletes it, and anything you remove goes before that.
• Bookings sent to the calendar link are kept until you empty the link or delete the account. Emptied bookings stop being served at once and are deleted with the account.
• Cached provider responses expire on their own. IGDB material is held for at most twenty four hours, which is a term of its licence rather than a preference.
• The per-install request counters are short lived and hold no content.
• Reports are kept after the account that sent them is deleted, with everything identifying the sender removed. A provider has to be able to show why it acted on a notice.
• A record that an account was erased is kept: a one way hash of the account identifier, the date, and how many rows went. It cannot be turned back into an account.

Your rights

Under the GDPR you can ask for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests.

• Access and portability: Settings, Export everything. It writes two files holding every score, note, list and favourite — one a machine can read, one you can.
• Erasure: Settings, Delete account, which deletes your library from the account and from every phone. Delete everything on this device clears only the phone you are holding.
• Everything else: write to the address in the Impressum.

You can also complain to a supervisory authority. In Germany that is the data protection authority of the state the provider is established in.

Children

Ryfa is not aimed at children and asks for no age. If a report shows that an account belongs to a child under the age at which they can consent for themselves, the account is deleted.

Changes

A material change to this policy will be shown in the app before it takes effect, not published quietly.