1. Scope
This draft describes River’s current PWA beta. River offers private play-chip poker, video, voice and chat, with optional simulated one-time art-pack purchases. Optional recoverable accounts now save clubs, scheduled nights, standings and equipped pins. Real payments remain disabled. The operator and public support/privacy contact still need approval before a paid release.
2. Information we use
- Room and game information
- Your chosen display name, guest identifier, room settings, actions, messages, chip stacks, hand records, table scores and tournament state. We use these to seat players, run the game, display the table and recover rooms.
- Account and club information
- For optional accounts, River stores your handle, display name, salted password hash, hashed recovery code, hashed sessions and an opaque billing identifier. It stores club membership, private invitation hashes, scheduled nights, standings and your equipped pin. Club members see names and standings; table players see verified equipped pins and test VIP status. Optional club tools also retain chosen availability, RSVPs, charter acknowledgments, volunteered introductions, learning goals and authored posts. Presence, mentoring, friendly rivalry, named stories and exhibition rosters require the relevant participant choices; joining a club alone does not opt you into them. Private club reports and owner review outcomes stay inside the relevant moderation workflow.
- Session and device storage
- Session credentials, saved home tables, style and media preferences, practice state are kept in your browser. Optional accounts use an HttpOnly session cookie; the server stores its hash. The PWA also caches public app files and artwork so they can load again efficiently. Private decision journals, draft invitations, wardrobes, wishlists and custom scene choices stay in browser storage unless you explicitly save supported preferences to your account or export them. River Compass keeps up to six chosen tool IDs in this browser only. Feature-search text is processed locally and is not sent to a server. Pins can be removed individually; Compass does not read or change seat credentials or grant permissions to the tools it describes. The Daily River keeps answers for up to 30 UTC editions in this browser only. Daily puzzles use authored fictional cards, not cards from your live table. Its journal has no account sync or score upload. The optional copied result contains the edition date, correct-answer tiles and score, plus the public daily-page link; copying does not send a message. Earlier daily history can be cleared inside the journal; today’s first attempt is retained until its browser storage is removed. Wishlist notices are optional in-app notices, not external messages. Optional phone companions use a separate credential kept in that phone tab’s session storage. The server stores its hash and the pairing expiry, never the original credential. Pairing requires approval on the original screen, lasts at most 12 hours, and can be disconnected from either screen. The phone receives your seat’s private cards and betting controls; video and microphone stay on the original device. Pairing links expire after three minutes.
- Optional community contributions
- Club newspapers use completed game results and moderated, permissioned text contributions. Shared introductions, banners and display cabinets contain only what their authors choose to publish. A separate public art proposal can contain your chosen title, approved design choices and description; it requires human approval before public display and does not publish your account identifier. Account votes and proposal review records remain on the server. A public contribution or a file you export may be copied by its recipients.
- Connection and diagnostic information
- Requests necessarily include network addresses and browser connection information. The game exchanges connection details to establish calls. Operational logs contain event types, request identifiers, room/player identifiers, errors and timing needed to diagnose problems and protect the service. Hosting and network providers may also process request metadata. Call diagnostic reports contain browser/platform categories, device on/off states, connection states, playback error categories and traffic counters. Recent events are kept in this tab’s session storage and can be downloaded in Settings. Sanitized failure reports are also sent to River’s server. These reports do not contain recordings, device labels, raw connection descriptions, connection credentials or network addresses.
- Test purchase information
- For signed-in accounts, River contacts RevenueCat with an opaque server-assigned billing identifier when you open the shop or refresh purchases. RevenueCat processes test purchase and entitlement history and connection metadata so River can display prices and verify test access. Authenticated webhook notifications trigger a fresh server ownership check when that integration is configured. The current Test Store does not collect a real payment through River.
- Audio, video and messages you choose to share
- Participants receive what you share at their table. Camera and microphone capture begin only after you choose to enable the device and grant browser permission. Chat messages and game records are stored with the room; live audio and video are not recorded or stored by River’s game server.
River does not use advertising trackers, sell personal information or share it for cross-context behavioral advertising in this beta. RevenueCat’s optional analytics-event and UTM-collection settings are disabled; the purchase service still processes the operational information necessary for its SDK. River does not use facial recognition or infer identity from your video.
3. Camera, microphone and peer connections
Calls use WebRTC. Media travels directly between seated browsers where a connection is possible. Network discovery services help them connect; a relay provider may carry encrypted traffic when direct connections fail and a relay is configured.
Other participants and connection services may learn network addresses used for the connection. WebRTC encrypts media in transit, but a person receiving your video or voice can see or hear it and may record it independently. A private invitation is not a guarantee of confidentiality.
You can keep the camera and microphone off, stop them in the app, revoke browser permissions or leave the table. River does not provide a call-recording feature. The separate, explicit microphone rehearsal can record a brief sample locally for your own playback; River does not upload that sample. Close the rehearsal to release its devices and discard the sample. Avoid sharing information you do not want participants to receive.
Optional screen sharing starts only after your explicit action and the browser's screen-selection prompt. Share a window that excludes private cards, notifications and other sensitive content. A persistent sharing control lets you stop. Catch-up corners have a visible participant list; changing the call audience stops capture and requires you to enable it again. A visual corner is not protection against another person recording.
Optional captions require agreement from the current call audience and a supported on-device recognition system with its language pack already installed. Caption text is sent temporarily to that agreed audience and is not saved in River's database or diagnostic logs. River does not fall back to a cloud transcription service. Captions are unavailable on some browsers, including the current Safari path; preset text cards remain available. Reconnecting or changing participants requires fresh agreement.
5. Storage and retention
Multiplayer room state is stored on River’s server. Normal rooms expire after 48 hours of inactivity; saved home tables expire after 30 days of inactivity. Activity can extend these periods. Guest credentials normally expire after 72 hours. Clearing your browser does not immediately erase room information already held on the server or a provider’s records.
Account profiles, club membership and group standings are retained for the account. Deletion requests currently require manual handling; there is no self-service account deletion tool. Account sessions expire after 30 days; used recovery codes are replaced. Purchase-event receipts and club retry receipts are retained for 30 and 7 days respectively, then removed during maintenance. Local preferences and cached public files remain until you clear them or the app replaces them. Daily VPS snapshots keep seven copies. Encrypted offsite copies on the operator’s Mac keep seven successful copies; a restore check runs before a copy counts as successful. Deleted information can remain in these rolling backups until those copies expire. Manual backups, operational logs and RevenueCat records have separate retention. Their final retention and deletion procedures must be fixed before a paid release; this draft does not promise immediate erasure of every copy.
Practice gameplay runs on your device. Purchase checks can still reach RevenueCat if you open purchase or premium-collection features during practice.
Optional social records have bounded collections and expiry rules. Live reactions, captions, sketches and temporary call state are not a permanent club archive. Club plans, published stories, credits and account preferences can outlast a room. Withdraw controls remove the relevant contribution from current views; they cannot recall independently saved exports. Exact log, account, moderation and provider retention procedures remain part of the pending legal and operational review.
6. Your choices and privacy requests
Use browser controls to manage camera/microphone permissions and local storage. Clearing storage removes saved preferences and may remove access to a guest seat. Signed-in ownership can be recovered using your account handle and password or private recovery code. Browser-only guest seats have no account recovery. Muting playback stops what you hear; it does not stop other participants from receiving media you are still sending.
Depending on your location and applicable law, you may have rights to access, correct or delete personal information, and to object to or limit certain processing. Contact the published River support address to make a request. We may need enough information to verify your request and locate the relevant records without disclosing another participant’s information.
During the private test, reach the team through your test invitation. Do not send passwords, seat credentials or payment numbers. We will explain any applicable legal retention or verification limits. Exercising an applicable privacy right will not itself result in a penalty.
7. Children
The intended River beta is for adults age 18 and older and is not directed to children. If you believe a child has provided personal information, contact the River team so the information and access can be reviewed. An age statement alone does not replace the safeguards required before a paid launch.
8. Security and changes
River uses access-controlled room state, hashed server credentials and encrypted WebRTC media transport. Published deployments require HTTPS. No system is perfectly secure; protect your invitation links and device, and report suspected unauthorized access.
River’s application logging is designed to avoid passwords, raw payment information, full customer payloads and live media. Hosting configuration and access to operational records must be reviewed for the public deployment.
We will update this policy when data practices change and provide additional notice or request consent where required. The date above identifies this draft version. The Terms of service describe gameplay and purchase rules.