Privacy Policy

Effective 21 September 2026. This explains what rito collects, why, who else sees it, and how to get rid of it. rito is operated by Rob Teeuwen.

The short version

• We collect what you give us to run an account, plus basic usage analytics.
• Your reviews, ratings, photos and username are visible to other people on rito. That is the point of the app.
• We do not sell your data and we do not run ads.
• We email you sign in links, plus news and nudges about rito. Everything in that second group has an unsubscribe link, and switching it off changes nothing else about your account.
• Your location never leaves your phone. We do not receive it or store it.
• You can delete your account from inside the app. Your profile and sign in information are removed immediately. Reviews, check ins, comments and photos you posted may stay without your name on them, and some analytics records stay until you ask us to delete them, as described below.

What we collect

Account information

When you sign up we store your email address, and your phone number if you sign up with one. If you sign in with Google we receive your email address and basic profile information from Google; we do not get your Google password. You choose a username and an avatar emoji, and both are public.

What you post

Your reviews, ratings, comments, reactions, check ins, favourites, go to shops and photos, along with when you posted them. All of this is visible to other signed in rito users. Photos you attach to a check in are stored in a bucket with a public URL, so treat an uploaded photo as public: do not photograph anything you would not put on a public page, including other people without asking and anything with an address or a document in the frame.

Reports and blocks

When you report a check in, comment or profile, we store the report, the reason you picked, who you are, whose post it was, and a copy of what the post said at that moment, so we can still judge it if it is edited or deleted. The report is emailed to us so someone looks at it. The person you reported is never shown the report or told who made it.

When you block someone we store that you blocked them and when. Only you can see your blocks. The person you blocked is not told. If you unblock them, we keep a record of when the block started and ended, so we can see the history if either of you is reported later. Nobody but us can see that record.

Invites and referrals

rito is invite only, so we record which code let you in and who it belonged to, to stop codes being reused and to give people credit for bringing friends.

Location

If you allow it, the app reads your device location while you are using it, to sort shops by how close they are and to centre the map. That reading is used on your phone and is never sent to us, stored, or given to anyone else. We never track location in the background, and you can refuse or withdraw the permission in iOS Settings with the rest of the app still working.

Shop pins on the map are not derived from your location. When somebody adds a shop, the address they type is sent to OpenStreetMap’s Nominatim service to look up coordinates for the listing.

Photo library

The app asks for photo access only at the moment you attach a picture to a check in, and only reads the image you pick. We do not scan or index your library.

Usage analytics

We use PostHog to see which screens get used and where people get stuck. It records events like screens viewed, taps on major actions, the app version, the device type and operating system, and a coarse location derived from your IP address at country and city level. When you sign in we also attach your rito user id and your email address to those events, so that activity can be traced to one person. We do not use any of it for advertising, we do not build advertising profiles, and we do not share it with data brokers.

Email we send you

Two kinds, and they are not the same thing. Service email is the mail rito has to send to work at all: your sign in link, notices about your account, and what came of a report you made. While you have an account you cannot switch that off, because it is how the account reaches you.

Everything else is mail to tell you things we think might interest you. Some of it is the same for everyone and some of it is put together from your activity on rito. Anything it tells you about another member is something they had already posted to everyone signed in.

Every one of those carries an unsubscribe link that works in one click without signing in, and using it stops all of them while leaving your service email alone. You can also ask at hello@getrito.app and we will take you off the list. We never hand your address to anyone else so they can email you.

Technical logs

Our hosting and database providers keep ordinary server logs, including IP addresses, for security and debugging. These roll off on the providers’ own schedules.

Why we are allowed to hold it

We process account and content data to provide the service you asked for (performance of a contract), analytics and security data because we have a legitimate interest in rito working and not being abused, and anything you have opted into, such as location and photo access, on the basis of your consent. Where we rely on consent you can withdraw it at any time in iOS Settings. We send the news and nudges described above on the basis of our legitimate interest in rito being used, or on your consent where the law where you live asks for it, and either way the unsubscribe link withdraws it.

Who else sees it

We do not sell personal information and we do not share it for cross context behavioural advertising. We do use these service providers, who process data on our instructions:

• Supabase: database, authentication and photo storage.
• Vercel: hosting for the website and API.
• PostHog: product analytics (United States region).
• Resend: email delivery, both the service email and everything else described above.
• Google: only if you choose Google sign in.
• Apple: app distribution and crash reporting, under Apple’s own privacy policy.
• OpenStreetMap (Nominatim): turns a typed shop address into map coordinates. It receives the address that was typed, not your account details or your location.

We will also disclose information if the law genuinely requires it, or to protect someone’s safety or our rights. If rito is ever involved in a sale, merger or similar transaction, personal information may transfer as part of it, and we will give any notice the law requires.

These providers may process your data in the United States. If you use rito from outside the US, your data may be transferred to and processed in the US, under the safeguards in each provider’s terms.

How long we keep it

Account and content data stays while your account is open. When you delete your account we immediately remove your email address, phone number, username, avatar, the free text on your profile, your notifications and your invite code, and the sign in itself. Everything else you posted stays on rito, irreversibly detached from you: your check ins, reviews, comments, your go to shop, and any photos still attached to your check ins when you delete. Nothing left on them says who posted them, and they keep counting towards each shop’s rating. Shops and burritos you added stay too. Reports and blocks you made, or that were about you, also stay attached to the anonymous account, because they are the record of how we handled abuse. A report about a check in or comment keeps its copy of that post, which stays anyway. A report about your profile has your username and profile text removed from its copy when you delete. A report that was already emailed to us before you deleted stays in our inbox until we delete it; ask us and we will. Our providers keep their own backups and server logs on their own schedules, which we do not control.

You have two ways to make sure something does not stay:

• Before you delete your account, remove the photo from its check in and save. The photo file is deleted as soon as the save goes through, so it is not there to stay behind.
• Before or after you delete, email hello@getrito.app and tell us which check ins, comments or photos you want gone, with the shop and roughly when you posted them. Once the account is gone we cannot look them up by your name, so that detail is how we find them. We remove them within 30 days.

Deleting your account does not automatically reach the events already recorded in PostHog, which include your rito user id and email address. Ask us at hello@getrito.app and we will delete those too.

Your rights

Deleting your account. Open the app, go to Profile, then Delete account. You can also write to hello@getrito.app and we will do it. It cannot be undone. What stays afterwards, and how to have it removed, is under How long we keep it above.

Turning off news and nudges. Use the unsubscribe link at the foot of any of them, or write to hello@getrito.app. It takes effect straight away and your sign in links keep working.

Depending on where you live you also have the right to ask for a copy of your data, to correct it, to restrict or object to how we use it, and to complain to a data protection authority. California residents additionally have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for asking. We do not sell or share personal information as those terms are defined under California law. To use any of these rights, email hello@getrito.app. We answer within 30 days and we will not charge you for it.

Security

Data is encrypted in transit and at rest by our providers. Database access is restricted per user by row level security, and photo uploads go through a single checked path. You sign in with a one time code sent to your email, or with Google, so there is no rito password to be stolen or reused. No system is perfect, so tell us at hello@getrito.app if something looks wrong with your account.

Children

rito is not for children under 13. We do not knowingly collect data from them. If you believe a child has an account, email us and we will remove it.

Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect. The date at the top of the page is always current.

Contact

Rob Teeuwen, hello@getrito.app. See also the Terms of Service.