River Privacy Policy
Version of 8 November 2026. Effective date: 9 November 2026.
River Poker School ("River") is an app for learning No-Limit Texas Hold'em poker on iPhone, iPad and Android (phones and tablets). This policy explains which data River processes, for what purpose, on what basis, for how long, with whom it is shared and what your rights are. It applies to the app on all these platforms and to River's web pages (privacy, terms of use, support, responsible gaming and account deletion).
It takes into account the Swiss Federal Act on Data Protection (FADP) and the European Union's General Data Protection Regulation (GDPR), as River is also offered in countries of the European Union.
In short
- River works without a name, an email address or a password: an anonymous account is created automatically.
- You can link this account to your Apple ID or, on Android, to your Google account, to find your progress on another device. River then keeps a technical identifier, never your email address or your name.
- The full history of your simulated hands stays on your device. Only your progress and your evaluated decisions are synchronised.
- No advertising, no advertising identifier, no tracking, no third-party analytics or crash-reporting tools in the app.
- Usage analytics and diagnostics only run with your consent, which you can change at any time.
- Payments are processed by Apple (App Store) or by Google (Google Play): River receives no payment data.
- You can delete your account and your data directly in the app, on all platforms.
1. Controller
ILYGO Sàrl (company name in the commercial register of the Canton of Vaud: Ilygo Sàrl), with its registered office in Montpreveyres (VD), Switzerland.
- Postal address: Chemin des Bossons 5, c/o Julien Tscherrig, 1081 Montpreveyres, Switzerland
- Swiss business identification number (UID): CHE-135.509.084
- Data protection contact: info@ilygo.ch
- Representative in the European Union (Art. 27 GDPR): Julien Tscherrig, ILYGO Sàrl, info@ilygo.ch. People residing in the European Union send their requests about their data there.
2. Data processed
2.1 Account and device
The first time the app is launched with an Internet connection, River creates an anonymous account without any action on your part. This account includes:
- a random internal identifier;
- a second random identifier, separate from the first, sent to the store (Apple or Google) when you make a purchase so that the purchase can be linked to your account;
- the account creation date, the app language, the date on which you confirmed that you are 18 or older, your choice regarding usage analytics and your starting level (placement test);
- sign-in tokens: an access token valid for 15 minutes and a renewal token valid for at most 90 days. The server keeps only a fingerprint of them. On iPhone and iPad, they are stored in the iOS keychain; on Android, they are encrypted with an Android Keystore key that cannot be extracted from the device;
- for each device: a random installation identifier generated by the app, the platform (iOS or Android), the app version, the system version and the date of the last connection. This identifier is neither an advertising identifier nor a device identifier provided by the system (on Android, it is never the ANDROID_ID).
River does not record your name, your email address or your phone number.
2.2 Link with Apple or Google (optional)
If you choose "Save my progress", River links your account to the identifier of your choice. The same account can be linked to an Apple ID and to a Google account.
- Sign in with Apple, on iPhone and iPad: River records the stable identifier that Apple provides to River for your Apple ID, as well as an Apple token, stored encrypted and used only to revoke the link with Apple when your account is deleted, as required by Apple. River asks Apple for neither your name nor your email address.
- Apple on the web, on Android: sign-in goes through an Apple page opened in a tab of your browser. River records the same data as on iPhone, plus an indication that the link was made on the web, which is needed to revoke it. During sign-in, the server keeps, as a fingerprint and for a single use, a random value valid for 10 minutes, then a result ticket valid for 2 minutes. This is how you find on Android an account created on iPhone.
- Google, on Android only: River receives an identity token from Google, verifies it and keeps only the unique and stable identifier of your Google account ("sub"). Your email address, your name and your profile picture, even if they appear in this token, are never recorded. No Google token is kept: Google does not require revocation. So that an identity token can only be used once, the server keeps only a fingerprint of it until it expires; the fingerprint is then erased by the daily purge.
If you withdraw River's access to your Apple ID (in your Apple account settings), Apple informs River: the link with Apple is removed and your sessions are closed, but your account and your progress are kept. If you delete your Apple ID, Apple also informs River, which then deletes the linked River account and its data (section 9).
2.3 Progress and learning
Your progress is recorded on your device as events, then synchronised with the server. These events are the same on iPhone, iPad and Android:
- placement test, lessons started, steps and lessons completed, exercise answers, exams, reviews, answers to the daily puzzle, uses of the "What if?" mode, hands played in free play (for the daily limits), scenarios completed, quick drill sessions completed, streak freezes used and settings changes (without personal data);
- for each decision evaluated by the coach: the game situation, the action chosen, the reference action, the loss of expected value (EV) and the difficulty of the situation;
- for each event: the date and time, the local date and the time-zone offset, which are used to calculate your streak, the daily limits and review due dates.
The server also keeps a summary state (progress, decision index, review queue, streak, counters) to restore your progress quickly, as well as your daily puzzle results (date, puzzle, success, time of the answer), which are used to display an overall success rate.
The full history of your simulated hands is never sent: it stays on your device, limited to the last 500 hands.
2.4 Purchases and subscription
Purchases are made through your device's store: the App Store on iPhone and iPad, Google Play on Android.
App Store. River receives signed information about your transactions from Apple, kept as Apple provides it:
- identifiers of the transaction and of the original transaction, product purchased, purchase and expiry dates and, where applicable, revocation date (for example after a refund);
- type of offer (for example the free trial), environment (real purchase or test purchase) and the random identifier linked to your account (see 2.1);
- storefront country, price and currency, as stated by Apple in this information;
- notifications sent by Apple to River's server: renewal, expiry, refund, billing failure.
Google Play. The app sends River's server the purchase token provided by Google Play. The server queries Google to verify the purchase, acknowledges it with Google if necessary and keeps Google's response:
- subscription state (for example active, in grace period, on hold or expired) and its acknowledgement state, product, offer (monthly or annual) and any promotional offer, including the free trial, expiry, identifier of the latest order and whether it is a test purchase;
- the purchase token and, after a change of offer or a resubscription, the token of the replaced subscription;
- the random identifier linked to your account (see 2.1), sent to Google when you make the purchase;
- notifications sent by Google to River's server (for example renewal, grace period, hold, cancellation, expiry, refund): River never relies on their content and reads the subscription again from Google.
River keeps no other information from Google's response: not the country, the price or the start date of the subscription, nor any answers you give to Google's cancellation survey.
From this, River determines your Premium access: status, expiry date and any grace period. This access applies on all the devices of your account, whichever store the purchase was made in.
River receives no payment data (card number, billing address): payment is handled entirely by Apple or by Google.
2.5 Usage analytics and diagnostics, only with your consent
If you accept, on the privacy screen at first launch or in Settings → Privacy, River sends:
- named usage events (for example "lesson completed" or "offer displayed"), with non-personal properties, the app version and the time; the server adds the platform (iOS or Android);
- technical diagnostics provided by the system: on iPhone and iPad, those of MetricKit (crashes, hangs, energy use and other performance measurements); on Android, the reasons for abnormal app exits recorded by Android (crashes, including in native code, and "App not responding" hangs). These diagnostics are reduced to a technical summary, without personal data.
These events are linked to a pseudonym calculated from your account identifier using a secret key, not to the identifier itself.
Without your consent, no event is sent. If you withdraw your consent, no further events are sent and those waiting to be sent are deleted from your device.
Apple may also provide ILYGO, in App Store Connect and Xcode, with statistics and crash reports, depending on the sharing settings with developers that you have chosen in iOS. Likewise, Google may provide ILYGO, in the Play Console (Android vitals), with statistics and crash reports, depending on the usage and diagnostics settings of your Android device.
2.6 Security
- Audit log: River records sensitive operations on accounts (creation of an anonymous account, link with Apple or Google, removal of the link with Apple, account merge, deletion, linking, transfer, update and revocation of an App Store or Google Play subscription) as well as all administration operations. Each entry records, in particular, the account concerned, designated by its pseudonymous internal identifier, the operation, its result and its date; it contains no identifying data (no Apple or Google identifier, IP address or installation identifier) and no secret.
- Request limiting: to protect the service against abuse, the server counts requests per IP address and, depending on the operation, per account, per installation or per family of renewal tokens (one per device). These counters contain only a fingerprint calculated with a secret key (HMAC), never the IP address or the identifier in clear, and are erased at the latest about 24 hours after the last request concerned.
- Technical logs: the API's technical logs contain no IP address, no token, no full purchase token and no secret. They reproduce the audit log entries identically and may therefore contain, like them, the pseudonymous internal identifiers of an account, its devices or its subscriptions. They are kept for at most 90 days.
2.7 Data kept only on your device
- events awaiting synchronisation and the state of your progress;
- the history of simulated hands (last 500 hands);
- downloaded learning content;
- your preferences, including your privacy choices and reminder time;
- the last known state of your Premium access.
Reminders are local notifications scheduled on the device (on Android, through a system alarm): River does not collect any push notification token and uses no push notification service. On Android 13 and later, permission to show notifications is only requested after you complete your first lesson; a refusal is respected.
On iPhone and iPad, the local database is excluded from iCloud backup; the sign-in tokens, stored in the iOS keychain, remain on the device after the app is uninstalled, so reinstalling on the same device resumes the same account. On Android, the local database, the tokens and sensitive settings are excluded from device backups, and nothing remains after the app is uninstalled.
2.8 Web pages
River's web pages use no cookies and no trackers. Links shared from the daily puzzle lead to a redirect page, without any personal parameter: for an Android device, to Google Play when River's listing is published there, otherwise to River's pages; for other devices, to the App Store. To choose the destination, the server reads the device type indication sent by your browser ("User-Agent"), without recording it.
2.9 Support requests
If you contact support, ILYGO processes the information you send (your message, the address to reply to) and, if you provide it, the support ID shown in Settings, which is used to find your account.
3. Purposes and legal bases
| Purpose | Data | Legal basis under the GDPR |
|---|---|---|
| Providing the app: account, link with Apple or Google, saving and synchronising progress, restoring on another device, merging accounts | 2.1, 2.2, 2.3 | Performance of the contract (Art. 6(1)(b)) |
| Verifying purchases and managing Premium access on all the devices of the account (restore, renewal, refund, acknowledgement of Google Play purchases, daily reconciliation with Apple and Google) | 2.4 | Performance of the contract (Art. 6(1)(b)) |
| Displaying the overall success rate of the daily puzzle | Puzzle results (2.3) | Performance of the contract (Art. 6(1)(b)) |
| Restricting the app to people aged 18 and over | Date of age confirmation (2.1) | ILYGO's legitimate interest in restricting the app to an adult audience (Art. 6(1)(f)) |
| Usage analytics and diagnostics, to improve the app and fix crashes | 2.5 | Consent (Art. 6(1)(a)), which can be withdrawn at any time |
| Aggregated statistics on the use of the service (progress, retention, trials and subscriptions), without individual data | 2.1 to 2.4, and 2.5 only with your consent | ILYGO's legitimate interest in managing the service (Art. 6(1)(f)); consent for the data in 2.5 |
| Security: preventing abuse, protecting accounts, recording sensitive operations | 2.1, 2.2, 2.6 | ILYGO's legitimate interest in the security of the service (Art. 6(1)(f)) |
| Support and exercise of your rights | 2.9 and data required for the request | Performance of the contract (Art. 6(1)(b)); legal obligation for requests relating to your rights (Art. 6(1)(c)) |
| Accounting obligations relating to sales | Sales reports provided to ILYGO by Apple and Google, without any River account identifier (section 4) | Legal obligation (Art. 6(1)(c)): retention of accounting records (Art. 958f of the Swiss Code of Obligations) |
Under the FADP, ILYGO processes your data lawfully, in good faith and proportionately, only for the purposes set out above, and obtains your consent where required.
River does not sell any data and does not use it for advertising purposes.
4. Retention periods
| Data | Retention period |
|---|---|
| Account, devices, Apple and Google identities, progress, synchronised events, puzzle results | Until the account is deleted. An anonymous account, that is, one linked neither to an Apple ID nor to a Google account, with no activity for 13 months is deleted automatically, unless it holds an ongoing subscription (active, in grace period or awaiting a new billing attempt). |
| Renewal tokens | At most 90 days; replaced at each use and revoked on sign-out, then erased when they expire. Deleted immediately with the account. |
| Purchase data (App Store transactions, Google Play subscriptions, Premium access) | Until the account is deleted: they are then deleted with it. |
| Accounting records of sales (sales reports provided by Apple and Google) | 10 years, as required by Swiss law (Art. 958f of the Code of Obligations). ILYGO keeps these reports outside River's server; they do not contain your River account identifier. |
| Apple notifications relating to purchases | 13 months, and at the latest until the account is deleted. |
| Google Play notifications relating to purchases | 13 months, and at the latest until the account is deleted. |
| Encrypted Apple token | As long as the account is linked to Apple. After a deletion, at most 7 days, only if revocation with Apple has to be retried. |
| Apple web sign-in values (Android) | Usable only once, for 10 minutes (2 minutes for the result ticket); deleted with the account. Once expired, they are erased by the server's daily purge, at the latest about 24 hours after they expire. |
| Usage analytics and diagnostics (2.5) | 13 months; deleted with the account. Events already received before you withdraw your consent are kept until this period expires, unless the account is deleted. |
| Audit log | 90 days, including after the account is deleted (pseudonymous internal identifier of the account, without identifying data or secrets). |
| API technical logs | At most 90 days. |
| IP addresses and other counters used to limit requests | Never in clear: only a fingerprint (HMAC) is used as a counter, erased at the latest about 24 hours after the last request concerned. |
| Support requests | 3 years after the request is closed. |
| Server backups | Deleted data remains in the encrypted database backups until these backups expire, then disappears automatically: recent backups 30 days, weekly full backup at least 62 days, monthly full backup at least 366 days. Deleted data therefore disappears from the backups at the latest when the last monthly backup containing it expires, that is, about 13 months after its deletion. |
| Data on your device | Until the account is deleted or until sign-out, after confirmation; on Android, at the latest until the app is uninstalled. Hand history: last 500 hands. |
Deleting the app from your device does not delete your account on the server: to do so, use "Delete my account and data" (section 9).
5. Recipients and processors
- ILYGO: only the people and agents authorised by ILYGO to operate the service access the data, to the extent necessary.
- Hosting: River's application servers and database are hosted in Switzerland, on the Public Cloud of Infomaniak Network SA. The encrypted database backups are kept on a dedicated OVHcloud server in the European Union.
- Apple: Sign in with Apple (including on the web, on Android), App Store (payment, subscription management, refunds), Apple's purchase verification services and notifications. Apple processes this data under its own terms and its own privacy policy.
- Google, for Android: Google Play (payment, billing, subscription management and cancellation, refunds), the Google Play Developer API (verification and acknowledgement of purchases), subscription notifications delivered by Google Cloud's Pub/Sub service, and sign-in with Google. Google processes this data under its own terms and its own privacy policy.
- Artificial intelligence agent (processor): ILYGO may use an artificial intelligence agent, supplied by a provider acting as a processor and bound to ILYGO by contract, for the technical operation of the service and the handling of support requests. This agent uses a dedicated administration interface with limited permissions, and each of its operations is recorded in the audit log. It can access the data of an account (account summary without the content of events, export or erasure on request) only if ILYGO has given it explicit authorisation. The indicators it otherwise consults are aggregated and contain no individual data.
- Authorities: where required by law.
6. Transfers outside Switzerland and the European Economic Area
River's servers and database are hosted in Switzerland; the encrypted database backups are kept in the European Union, whose level of data protection Switzerland recognises as adequate. Some recipients, such as Apple, Google or the provider of the artificial intelligence agent, may process data in other countries. In that case, ILYGO relies on the safeguards provided by law, for example an adequacy decision of the Swiss Federal Council or of the European Commission, or standard contractual clauses. The provider of the artificial intelligence agent receives data only with appropriate transfer safeguards, provided for by contract.
7. Security
- All exchanges between the app and the server are encrypted (TLS), with no exception for cleartext traffic.
- On iPhone and iPad, sign-in tokens are stored in the iOS keychain. On Android, they are encrypted with an Android Keystore key that cannot be extracted from the device, and are excluded from device backups.
- On the server, renewal tokens are kept only as a fingerprint, the Apple token is encrypted, no Google token is kept and backups are encrypted.
- Usage analytics data and request-limiting counters are pseudonymised.
- Administrative access is restricted to technical accounts with limited permissions, and each operation is recorded.
8. Your rights
Within the limits provided by law, you may:
- access your data (Art. 25 FADP, Art. 15 GDPR);
- receive your data in a common electronic format or have it transmitted to another controller (Art. 28 FADP, Art. 20 GDPR);
- have inaccurate data rectified (Art. 32 FADP, Art. 16 GDPR);
- have your data erased (Art. 32 FADP, Art. 17 GDPR), directly in the app (section 9);
- request restriction of processing (Art. 18 GDPR);
- object to processing based on legitimate interest (Art. 30 and 32 FADP, Art. 21 GDPR);
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR);
- lodge a complaint or report with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the European Union, the authority of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).
How to exercise your rights:
- Usage analytics: Settings → Privacy, on all platforms.
- Erasure: in the app (section 9) or, if you can no longer open it, by a request to support as described on the "Delete my account" page.
- Access and portability: the app does not yet offer an export. Send your request to info@ilygo.ch, stating the support ID shown in Settings. ILYGO replies within 30 days and provides your data in JSON format.
Because River knows neither your name nor your email address, the support ID is used to find your account. ILYGO may ask you for additional information to verify that the request comes from the account holder.
9. Deleting your account and your data
In Settings → Account, choose "Delete my account and data", then confirm. This function is available on iPhone, iPad and Android, including for an anonymous account. The "Delete my account" page of this site also explains how to request deletion without the app.
- On the server: your account data is deleted (account, Apple and Google identities, devices, progress and synchronised events, puzzle results, App Store and Google Play purchase data, usage analytics). Your renewal tokens are deleted immediately: all your sessions are closed. The link with Apple, made in the iOS app or on the web, is revoked with Apple straight away; if Apple cannot be reached, further attempts are made at increasing intervals (from a few minutes to 6 hours) for at most 7 days. As Google does not require revocation, the Google identity is simply deleted.
- On your device: River's data is erased (on Android: database, files, preferences and Keystore key) and the app returns to the state of a new installation.
- Offline: the deletion is queued and sent as soon as the network is back. In the meantime, only the minimal information needed to complete the deletion remains on the device.
- What remains temporarily: the audit log and the technical logs (at most 90 days), which keep the pseudonymous internal identifier of the account, without any identifying data or secret; the request-limiting counters, as fingerprints (HMAC), for about 24 hours at most; the encrypted Apple token if revocation with Apple has to be retried (at most 7 days); encrypted backups until they expire (at the latest about 13 months, section 4).
- Subscription: deleting your account does not cancel your subscription. It continues to be billed by the App Store or Google Play until you cancel it in the store where it was purchased; the deletion screen offers a link to that store's subscription management. If you later restore your purchases on a new account, the Premium access of an ongoing subscription is transferred to it.
Signing out (Settings, account linked to Apple or Google) is different: after confirmation, it erases River's data on the device (on Android, also the device's Google sign-in state) but keeps your account on the server.
10. Minimum age
River is restricted to people aged 18 and over. At first launch, on all platforms, the app asks you to confirm this. Without this confirmation, it displays an explanation, gives access to no content and sends no data.
11. Automated evaluations
River's coach and decision index automatically evaluate your game decisions, by calculation, for learning purposes only. These evaluations are calculated on your device, have no legal effect and do not significantly affect you. River makes no automated individual decision within the meaning of Art. 21 FADP and Art. 22 GDPR.
12. Changes
ILYGO may update this policy, in particular when the app evolves. The version date is shown at the top of the page. In the event of a significant change, ILYGO will inform you appropriately, for example in the app.
13. Contact
For any question about this policy or your data: info@ilygo.ch.