Privacy Policy

Last updated 20 October 2026

Who we are

riwer (riwer.io) is a workspace for documents, lists, slideshows and the conversations around them. It is built and run byTUUSIX OYUN YAZILIM VE DIŞ TİCARET LİMİTED ŞİRKETİ (“TUUSIX”, “we”, “us”), Ihlamurkuyu Mah. Kırkpınar Sk. No:8 İç Kapı No:3, Ümraniye, İstanbul, Türkiye, registered e-mail (KEP) tuusixoyun@hs01.kep.tr. For anything about your information, write to support@riwer.io. In Türkiye, the KVKK notice says the same in Turkish.

What riwer keeps, and why

• Your account: your email address, and the name and picture you give it — or that Google or Apple share when you sign in with them. Also anything you choose to add to your profile: a username, job title, short bio, phone, location, time zone or cover picture. We use these to sign you in and to show your teammates who wrote what.
• What you make in a project: documents, lists, slideshows and their pictures, files you attach, how you arrange the board, notes, dates and reminders, and what you write in Talk — messages, comments, marks on a document and direct messages. We keep these so they are there when you and your team come back, and a document’s earlier versions — for 7 days on Free and a year on Team — so a change can be undone.
• Who is in a project: its members and their roles, so riwer knows who may read, write or manage it.
• If you pay for Team: which plan your project is on, how many editors it pays for, how often it is billed and when it renews, and the customer and subscription numbers Paddle gives it. Paddle takes the payment: your card details go to Paddle, never to riwer.
• Getting-started emails: in your first ten days, riwer sends you at most five short emails about using it — skipped once they no longer apply, never with an offer, and each with a link that stops them all.
• What happens in riwer, counted: when somebody edits a document (noted at most once in half an hour), joins with an invite, opens or completes a checkout, or reaches a plan’s limit, riwer notes who, in which project and document, and when — never what was written. These are kept in our own database and, under your account’s id, sent each night to Mixpanel too, with an account or a project made and Team started, ended or refunded — from our server, with nothing kept in your browser for it. We use them to see whether riwer works for the teams using it and to run the business, our legitimate interest. When an account is deleted, its records stay only as numbers, without the person, and the id they carry no longer names anybody.
• Analytics, with your OK: riwer counts what people do in it — a project started, a file made and of what kind, a person invited, a file exported, a theme changed, which screen was open, a sign-in and by which way — with the browser, operating system, screen size and the site you came from, in Mixpanel, with the data kept in the European Union. It is tied to a random id kept in your browser, and once you sign in to your account’s id — never your email or name, never what anybody writes, never a page’s address. We use it to see which parts of riwer work and which do not. In the EU and EEA, the UK, Switzerland and Türkiye nothing in your browser is counted until you say yes, as your consent is its basis there; elsewhere it is our legitimate interest in improving riwer, and you can say no. Either way, Cookie settings changes your answer at any time, and a no stops it at once.
• What the service needs to run: our hosting and database providers keep short-lived technical logs (such as IP address, browser type and the time of a request) to deliver the service, keep it secure and fix faults.

Files on your computer

riwer can open and save files on your own computer, with or without an account. Signed out, a file opened that way is read and written in your browser and stays on your device. Signed in, opening a file keeps it in your current project as a private document: riwer stores it so it saves itself, and nobody else can see it until you choose Share with the project.

Signing in with Google or Apple

If you sign in with Google, Google shares your name, email address and profile picture with riwer — nothing else. riwer does not ask for, and cannot reach, your Gmail, Drive, Calendar, contacts or any other Google data. riwer’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you sign in with Apple, Apple shares your email address — or a private relay address, if you choose to hide yours — and your name, if you choose to share it.

Who can see your things

• Documents and conversations in a project are seen by that project’s members.
• A document you keep private is seen only by you. A direct message is seen only by the two people in it.
• Your name and picture are seen by the people you share a project with.
• We do not sell, rent or trade your information, show you ads, or use your documents to train AI. We look at your content only if you ask us to help with it, or if the law requires us to.

Services that work for us

riwer runs on a few providers who process information only to provide their service to us:

• Supabase — accounts, the database, live updates and some file storage.
• Cloudflare — storing the files and pictures you add to projects, and profile pictures; and, when you ask for a sign-in email, checking that the request comes from a person (Turnstile), under Cloudflare’s Turnstile privacy addendum.
• Vercel — hosting and delivering the riwer app.
• Paddle — our reseller: it sells Team, takes the payment and handles invoices, taxes and refunds, under its own privacy notice.
• Resend — sending riwer’s own emails: invites, and notices about storage and billing.
• Mixpanel — counting what people do in riwer (in your browser, only with your OK), with the data kept in the EU.
• Google — Sign in with Google, and the email that sends your sign-in links.
• Apple — Sign in with Apple.

Their servers may be in a country other than yours; they protect what they hold under their own security and privacy terms. The full list, with where each one is, is at riwer.io/subprocessors.

Cookies and your browser

riwer uses no advertising cookies. Your sign-in session, and small preferences such as your theme, panel layout, the documents you opened recently and how your board was zoomed, are kept in your browser’s own storage and are never sent to us. With your OK, the analytics above keeps its random id there too. The cookie notice says more, and its Cookie settings change your answer. When you pay, Paddle’s checkout opens inside riwer from Paddle’s own site, and uses what it needs to take the payment safely.

How long we keep it

We keep your account and projects for as long as you use riwer. A document, file or message you delete is deleted. Deleting a project deletes its documents, conversations and files. You can delete your account yourself, in your account’s settings: your private documents and any project only you are in go with it, and a project shared with others, your Personal one too, passes to one of them, keeping what you made there, without your name. Or write to support@riwer.io and we will do it within 30 days. Copies in our providers’ backups expire on their own schedule.

Your choices and rights

You can see and correct your profile in riwer at any time, and export your documents as Markdown, Word or PDF. You can also ask us for a copy of what we hold about you, to correct or delete it, or to stop using it — write to support@riwer.io. Depending on where you live, you may also complain to your data protection authority.

Keeping it safe

Everything travels between your browser and riwer encrypted (HTTPS). Who may read or change each document, file and message is enforced by the database itself, project by project, and our providers encrypt what they store.

Children

riwer is not meant for children under 16, and we do not knowingly keep information about them.

Changes

If we change this policy, we will update the date at the top, and tell you in riwer before a change that matters takes effect.

Questions? support@riwer.io · Terms · Refunds · Acceptable use · Sub-processors · Security · Cookies · DPA · KVKK · Back to riwer