The short version.
rizzo (the app listed on the App Store as Rizzo: AI Dating Replies) is provided by Cezar Drumea, Grenoble 106, Chisinau MD2006, Moldova ("we", "us"). We are responsible for your personal data under this policy. Privacy questions: support@rizzoapp.io.
This policy covers the rizzo app for iPhone and iPad, its keyboard and share extension, and the rizzo servers the app talks to.
A lot of rizzo works only on your iPhone. None of the following is sent to us unless a later section says so.
Saved chats (messages, nicknames, titles, context and the replies you got), Favorites and your Sound like you samples are stored in rizzo's private storage on your phone, with iOS file protection. They are part of your normal iPhone backup (iCloud or your computer), if you use one. Nicknames are never sent to the AI.
If you pick a photo for a chat with Apple's photo picker, rizzo keeps a small copy (at most 256 px, without location or other photo details) in the same private storage. It stays on this phone and is never sent to us or to the AI provider. It is not synced to your account or your other devices. It is part of your normal iPhone backup, if you use one. It is deleted when you remove the photo, delete the chat or use Clear history.
Your picks (who you text, default tone, length, emoji, language), the daily free count, your AI permission and your settings are stored on your phone and shared only between rizzo's app, keyboard and share extension.
rizzo is for adults. On iOS 26 and later, rizzo asks Apple's Declared Age Range service only whether you are 18 or over. Apple shares an age range, not your birthday. On earlier iOS versions, or if you decline Apple's sheet or it does not appear within 3 seconds, you confirm your age yourself. The result stays on your phone. An under-18 answer is remembered on this install until you reinstall rizzo, or Apple's age range confirms you're 18 or older.
Face ID, Touch ID and passcode checks are done by iOS. rizzo never receives your face or fingerprint data. rizzo does not send you notifications.
Nothing is sent to the AI until you tap Agree and continue on the "rizzo uses AI to write your replies" screen. You can withdraw that permission anytime in Settings › Privacy › AI data sharing; rizzo then asks again before the next AI action.
What is sent when you ask for replies or use a tool:
What is never sent to the AI: the rest of your photo library, nicknames, photos you pick for a chat, faces or profile photos (while Auto-blur is on), your contacts, location or advertising identifier.
How it travels. The app sends the screenshots or text to our server, which builds the request, sends it to OpenAI, checks the answer and sends it back. Our server does not store screenshots, chat text, prompts or answers.
Logs. Two kinds of log exist, both kept for up to 1 day (section 8):
Safety checks. Before the AI writes anything, our server sends all the text in the request (the chat you pasted, the other person's messages included, and what you wrote or added; not the screenshots) to OpenAI's moderation service. A request that shows your intent to self-harm is refused and the app shows a link to free helplines (findahelpline.com). When the other person's messages show warning signs of self-harm, the request is refused too and the app shows what to do when someone else is in danger, with the same helplines. A request that shows your own plan to harm someone (for example drugging, stalking or extortion) is refused. A request with sexual content involving minors is refused. A request that states or suggests an age under 18 (for example "I'm 16", a school grade or a parent's controls in the chat) is refused before the AI runs; if it is your own age you state, the app locks into its under-18 state, as after an under-18 answer in the age check. If you want pictures or sexual content from the other person, the replies drop that topic and never ask for it. Each AI answer is also checked by the same moderation service before you see it: a flagged answer is rewritten once, then blocked. If the moderation service does not answer within 4 seconds, the answer is shown without that check and our server logs that the check failed (without the content). OpenAI handles the moderation checks as part of the same service, under the same terms as below.
OpenAI processes the screenshots and text on our behalf only to read your chat, write your replies and check both for safety. It does not use them to train its models and keeps them for up to 30 days to monitor abuse, unless the law requires longer, and then deletes them. Our server calls OpenAI without asking it to store anything else.
Each request also carries a random install ID that the app creates (it identifies this install of the app, not you) and, if you have Pro, Apple's signed proof of your subscription so the server can check it. The server does not store that proof. It keeps only the hashed Pro counters described in section 3.2. Apple also tells our server when a subscription is bought, renews, ends, is refunded or is revoked. For each of these events we keep Apple's ID for the purchase, the type of event and its date for 12 months. When a subscription is refunded or revoked, we also keep its purchase ID on a list until 30 days after the subscription period it covers ends, so that it stops unlocking Pro. That ID identifies the purchase, not you, and we never receive your name, Apple Account or payment details.
To stop abuse, our server counts requests per install and per IP address, per minute and per day. It stores only a one-way hash of the install ID and a keyed one-way hash (HMAC-SHA-256 with a secret key only our server holds) of the IP address and of its network (the IPv4 /24 or IPv6 /64 block), never the address itself. A daily scheduled job deletes these counters after about three days.
To keep free replies free for everyone, the app also uses Apple's App Attest. Once per install, your iPhone creates a key in its Secure Enclave and Apple confirms to our server that the key belongs to the real rizzo app on a real Apple device. After that, each AI request is signed with that key, so our server can count free replies per install. Our server stores the key's public part, a request counter and, if Apple provides it, Apple's estimate of how many keys rizzo created on that device in the last 30 days, and deletes the key 12 months after it was last used. App Attest tells us nothing about you or your device: no name, no Apple ID, no device identifier. If your device cannot use App Attest, free requests are counted by hashed IP address and hashed network instead. We do not fingerprint your device.
Pro has up to 300 AI actions a day (100 during the free trial), within the fair-use limits in our Terms. To apply them, our server counts each subscription's AI actions per day, on the weekly and the yearly plan alike, and counts how many devices use the subscription each day. These counters are stored under a one-way hash (SHA-256) of Apple's original transaction ID for the subscription. Each device is counted as a hash (SHA-256) of its App Attest key or install ID, never a hardware identifier. The same daily job deletes these counters after about three days.
When you use Settings › Contact support, we receive the topic, your message, a screenshot if you attach one (resized on your phone), and your app version, iOS version and device model unless you turn off "Include app version & device" on the form. The form has no separate email field: it asks you to type your email address into the message if you want a reply, so we receive your email address only if you type it. Everything is stored with the hashed install ID so that Delete all my data can remove it, and a daily job deletes it, your email address included, after 12 months at most. You can also write to support@rizzoapp.io. If you email us, we receive your email address and what you write.
Every AI answer in the app has a Report button; in the keyboard and the share sheet, you report a reply with a long press. When you rate a set of replies, we receive the rating and the choices behind it (tones, length, emoji level, goal, Mirror). If you choose Inappropriate or Report, we also receive the three reply texts and your reason, so we can review them. When you report any other AI answer (openers, tools, scores, safety checks, translations or practice chats), we receive that answer as the app showed it, which feature wrote it and your reason. A reported answer can quote words or names from your chat when the answer itself did. Feedback and reports never include the rest of your chat, are stored with the hashed install ID, are never sent to the AI provider, and are deleted by a daily job after 12 months at most, or earlier with Delete all my data.
When a report or an Inappropriate rating arrives, our server sends us a notice through Sentry (section 3.6) that names the feature and the kind of report, without the reported text, which stays in our database. We review reports within 24 hours.
rizzo works fully without an account. If you choose Sign in with Apple to sync your chats:
To understand which features help, the rizzo app (not the keyboard or share extension) uses PostHog for product analytics, hosted in the EU. Analytics start only after you choose: during setup, rizzo asks "Share usage stats?". Nothing is sent to PostHog before that choice or before the age check, and nothing at all if you say no. You can change your choice anytime with Share usage analytics in Settings › Privacy.
What is sent:
Never sent: chat, reply, context, nickname or profile text, screenshots, the clipboard, anything you type, support messages, Sound like you samples, your account ID, email, advertising identifier, screen recordings or tap locations.
The app contains no crash reporting of its own. If you allow it in iOS Settings › Privacy & Security › Analytics & Improvements › Share With App Developers, Apple shares crash and performance reports with us. Apple controls that choice and what those reports contain.
Our server reports its own errors to Sentry, hosted in the EU: which feature failed, the status code, timing and the code location. It also sends the report notices described in section 3.4. Never the request content, reported text, an install ID or an IP address.
Subscriptions are sold and billed by Apple. We never see your payment details. The app and our server receive Apple's signed purchase information (which plan, dates and a transaction number) to unlock Pro.
Sign in with Apple, in-app purchases, the age range check and app lock use Apple services. Apple's own privacy policy applies to what Apple processes.
Your chats include messages from other people. rizzo blurs names and photos by default, uses their messages only to write your reply, and does not build profiles about them. Please share only chats you are allowed to share.
If you are in the EU, EEA, UK or Switzerland, we rely on:
Your chats can reveal sensitive things about you, such as your love life. We use them only to provide the features you ask for, only after you agree, and never for ads or profiling.
We never sell your data, show ads, or share it with data brokers or advertisers. There is no cross-app tracking. We share data only with service providers that run rizzo for us:
| Provider | What for | Where |
|---|---|---|
| OpenAI | Writing replies and other AI answers, and the moderation checks of requests and answers (section 3.1) | United States |
| Vercel | Hosting our server, which passes AI requests through and receives support and feedback; request logs (section 3.1) | EU (Frankfurt, Germany) |
| Supabase | Accounts and sign-in (with sign-in logs), sync, and the database for support messages, feedback and counters | EU (Frankfurt, Germany) |
| Sentry | Server error reports and report notices | EU |
| PostHog | Product analytics (app only) | EU |
| Apple | Sign in with Apple, payments, age range check | Apple's own terms |
Each of these providers, other than Apple, which acts under its own terms, is bound by a data processing agreement with us. It requires the provider to protect personal data at least as well as this policy and Apple's App Store guidelines require, and to use it only to provide its service to rizzo, never for its own purposes.
We may also disclose data if the law requires it, to protect people's safety, or as part of a sale or reorganization of the business, in which case this policy continues to apply.
AI processing happens in the United States, and some providers may access data from outside your country. Where data leaves the EU, EEA, UK or Moldova, we rely on the safeguards the law requires, such as the European Commission's Standard Contractual Clauses in our providers' data processing terms, or an adequacy decision.
| Data | Kept for |
|---|---|
| Chat screenshots | Not kept by us. Dropped on your phone as soon as reading ends; kept by OpenAI for up to 30 days, unless the law requires longer. |
| Chat text sent for replies | Not stored by our server. Kept by OpenAI for up to 30 days, unless the law requires longer. |
| History, Favorites, samples on your phone | Until you delete them, clear history, delete your data or remove the app. |
| Chat photos on your phone | Until you remove the photo, delete the chat, clear history, sign out, delete your data or remove the app. |
| Synced account data | Until you delete it or delete your account. |
| Support messages (with any screenshot or email address in them), reply feedback and reports | 12 months at most, then deleted by a daily scheduled job. Earlier if you use Delete all my data or ask us to delete them. |
| App Attest keys (public part and counter) | 12 months after the install last used the key, then deleted by a daily scheduled job. |
| Apple purchase notifications (purchase ID, event type, date) | 12 months, then deleted by a daily scheduled job. |
| Refund and revocation records (purchase ID) | Until 30 days after the end of the subscription period they cover, then deleted by a daily scheduled job. |
| The sealed Sign in with Apple token | Until you delete your account. If Apple does not accept the disconnect then, the sealed token is kept apart, only to finish revoking Sign in with Apple: our server retries daily for at most 30 days after the deletion, then deletes it. |
| Our server's own log lines (no content, install ID or IP address) | Up to 1 day. |
| Vercel request logs (including IP addresses) | Up to 1 day. |
| Supabase Auth sign-in logs (signed-in users, including IP addresses) | As long as Supabase keeps them under its standard settings. |
| Rate counters (hashed install ID, keyed hash of the IP address and network) | About three days, then deleted by a daily scheduled job. |
| Pro fair-use counters (hashed subscription ID and hashed device IDs) | About three days, then deleted by a daily scheduled job. |
| Analytics and server error reports | Up to 1 year. |
What deleting does not remove right away, because it is not stored under your install ID or account. Each goes on its own schedule (section 8):
Good to know:
Depending on where you live (for example under the GDPR in the EU, EEA and UK, or under US state laws such as California's), you may have the right to access your data, correct it, delete it, receive a copy (portability), restrict or object to processing, and withdraw consent at any time. You also have the right to complain to your local data protection authority. Our own regulator is the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md), under Law No. 195/2024 on personal data protection.
Most of this you can do yourself in the app. For anything else, write to support@rizzoapp.io. Because rizzo does not ask for your name and has your email address only if you type it into a support message, the easiest way for us to find your data is a request sent from the app (Settings › Contact support), which carries the same hashed install ID. We will answer within one month, as the GDPR requires, and we never charge for it.
We do not sell or "share" personal data for cross-context behavioral advertising, as those terms are defined in California law.
rizzo is only for adults 18 and over. The app checks age before you start (section 2) and does not let anyone who says or is reported to be under 18 continue. If a request states or suggests an age under 18 (for example a school grade or a parent's controls), our server refuses it before the AI runs, and requests with sexual content involving minors are refused too. When a chat shows that anyone in it is under 18, Replies writes only short, kind goodbyes and every other AI tool, Practice included, refuses. Our server enforces these rules. We do not knowingly collect data from anyone under 18. If you believe a minor has used rizzo, contact us and we will delete their data.
All connections use encryption (HTTPS/TLS). The app holds no AI provider key. Your session is in the iPhone Keychain, saved chats use iOS file protection, and you can lock rizzo with Face ID, Touch ID or your passcode. Only our server can write to its own tables; the app's key cannot read them. No system is perfectly secure, so please keep your iPhone protected with a passcode.
If we change this policy in an important way, we will tell you in the app before the change applies. The date at the top shows the current version.
Cezar Drumea, Grenoble 106, Chisinau MD2006, Moldova
Email: support@rizzoapp.io