Privacy Policy

Ritualivity is run by Strategic Virtus Global LLC, a company registered in Delaware, United States (1207 Delaware Ave #3043, Wilmington, DE 19806, United States), who is the data controller for the service at ritualivity.com and app.ritualivity.com. Contact: polymedialabs@gmail.com.

Ritualivity is open-source software (AGPL-3.0). Anyone can run their own copy; an instance hosted by someone else is run by that operator, and this policy does not cover it.

• Account: your e-mail address and name; your password, stored only as a one-way hash; if you sign in with Google, your Google account identity and profile picture; if you turn on two-factor sign-in, its secret and backup codes.
• What you write in the app: workspaces and their members, tasks, subtasks and notes, channels, contexts and folders, time entries, timeboxes, objectives, rituals, daily wraps and journal entries, the history of changes to your tasks, and your preferences (language, time zone and similar).
• Calendars: the address of each ICS calendar feed you add (encrypted), and the events read from those feeds and from Google Calendar: title, time, description, location, attendees, conference link and event type.
• Technical data: your sign-in sessions with the IP address and browser they came from, short-lived rate-limit counters keyed by IP address, and server logs. The logs leave out passwords, tokens and cookies.

• To provide the service you signed up for: storing and showing your plans, syncing your calendars (GDPR art. 6.1.b, contract).
• To keep the service secure: sessions, rate limits and logs that help us stop abuse (art. 6.1.f, legitimate interest).
• Google Calendar and browser notifications are used only after you turn them on (art. 6.1.a, consent), and you can turn them off at any time.

Sign in with Google asks for your name, e-mail address and profile picture (scopes openid, email, profile).

Connecting Google Calendar asks for https://www.googleapis.com/auth/calendar.readonly and https://www.googleapis.com/auth/calendar.events. With them we read your list of calendars and the events of the calendars you choose, refreshed about every 10 minutes, and keep the events from 30 days ago to 90 days ahead, including attendees and the event type. We write events only for the timeboxes you plan, and only on the one calendar you pick for them: we create, update and delete those events and no others. The Calendar access tokens are stored encrypted (AES-256-GCM).

Ritualivity's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to show and sync your calendars inside Ritualivity, and your Google sign-in profile only to create and identify your account. We never sell this data, never transfer it to others, never use it for advertising, and no person reads it, unless you ask us for help with a specific problem and agree to it, or it is needed for security or required by law. We do not use Google user data to develop, improve or train generalized AI or machine-learning models.

To stop the access: in Ritualivity, Settings → Calendars → Remove. This revokes the access at Google and deletes the tokens, the calendars and the events we stored; the timebox events already on your Google Calendar stay there. You can also remove Ritualivity, including the sign-in permission, from your Google account permissions.

We use only functional cookies: the session cookies that keep you signed in (and, during sign-in, short-lived cookies for two-factor and Google sign-in), and preference cookies named ritualivity.* for the theme, the language, the last workspace, the sidebar and dismissed ritual banners. The browser's local storage keeps a few display settings under the same prefix.

No analytics, no tracking, no advertising cookies, no third-party scripts. One exception you should know: Google profile pictures load directly from Google's servers.

• DigitalOcean hosts our server in Amsterdam, the Netherlands (EU) as our processor. The PostgreSQL database runs on the same server, managed with Coolify, with daily backups kept for 14 days on that server.
• Google (Google LLC): when you sign in with Google or connect Google Calendar, Google handles your Google account data as an independent controller under its own privacy policy; the Calendar requests we make on your behalf are governed by Google's API terms.
• Cloudflare answers the DNS queries for our domains only: your traffic does not pass through it. Let's Encrypt issues our HTTPS certificates and receives no data about you.
• Calendar feeds you add are fetched from the address you gave. We send no e-mail and use no e-mail provider.
• DigitalOcean, Google and Cloudflare are US companies. Where your data may reach the United States, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

• Your account data: until you delete your account.
• Deleted tasks: kept 30 days so you can restore them, then erased.
• Sign-in sessions, with their IP address and browser: valid up to 30 days; the records, expired ones included, are kept until you delete your account.
• Rate-limit counters keyed by IP address: up to about a day. The sign-in protection counters (IP address and page) are not yet deleted automatically.
• Request keys that prevent double saves: about a week.
• Backups: a deleted account disappears from them within 14 days.

Export: Settings → Account downloads your data as one JSON file (see the export format document, available on request); sign-in sessions, credentials and copies of calendar events are left out. Delete: Settings → Account deletes your account and your workspaces at once. If you share a workspace with someone, leave it or remove them first.

Under the GDPR you can also ask to access, correct, erase or move your data, restrict or object to its use, and withdraw consent: write to polymedialabs@gmail.com and we will answer within one month. If you are in the EU, you can complain to your local data protection supervisory authority, for example the Italian Garante (Garante per la protezione dei dati personali).

Ritualivity is not meant for anyone under 16. Do not create an account if you are.

We post every change on this page with a new date at the top. If a change affects how we use your data, we will announce it on this website before it applies.

Questions or requests about your data: polymedialabs@gmail.com. Strategic Virtus Global LLC, 1207 Delaware Ave #3043, Wilmington, DE 19806, United States.