What Rivet handles
Rivet stores projects, plans, measurements, takeoffs, pricing, customer details, and estimate notes locally on the device where you create them. If you enable Rivet Cloud, the app encrypts a portable workspace before upload. The hosted service stores encrypted bytes plus the minimum metadata needed to connect devices, enforce licensed seats, detect revisions, and operate the service.
Information you provide
- Local profile information such as your display name and email.
- For hosted accounts, the trusted ChatGPT user identifier, verified sign-in email, optional display name, Rivet email-confirmation status, and delivery timestamps for confirmation and welcome messages. Single-use confirmation secrets are stored only as cryptographic hashes.
- Purchase-request details submitted on Rivet's website, plus Stripe customer, Checkout, payment, subscription status, billing interval, and renewal references when you use Stripe. Card and bank credentials are collected and processed by Stripe, not Rivet.
- Google Play subscription status, product, purchase token, order reference, region, and expiry when you subscribe or restore a purchase. Rivet stores the purchase token only as a cryptographic hash after verification.
- Optional support or data-deletion request details.
- Construction project information and plan files you choose to sync.
Service metadata
Cloud features use a random installation identifier, device name, platform, licence identifier, encrypted-workspace size, revision number, checksums, and last-seen time. Rivet does not request location, contacts, camera, microphone, advertising identifiers, or access to unrelated files.
How information is used
Information is used only to provide estimating, licensing, encrypted sync, customer support, security, fraud prevention, account messages, payment and subscription administration. Rivet's transactional email provider processes the recipient address and message content only to deliver requested account emails. Stripe processes website Checkout, billing methods, receipts, and subscription management under its own privacy terms. Google processes Play purchases under its own privacy terms; Rivet verifies purchases through the Google Play Developer API before granting access. Rivet does not sell personal information and does not include third-party advertising or behavioural analytics.
Security and retention
Network traffic uses HTTPS. Cloud project content uses AES-256-GCM authenticated encryption on the device. Pairing codes expire after ten minutes and device tokens are stored on the server only as cryptographic hashes. Rivet Cloud keeps the latest five committed encrypted revisions. Temporary upload sessions expire after two hours. Purchase and deletion records may be retained when reasonably necessary for support, security, accounting, or legal obligations.
Deletion
The owner device can permanently delete an encrypted cloud workspace from Settings → Rivet Cloud. You can also submit a request from the public data-deletion page. Local-only profiles are offline accounts and can be removed by resetting local app data or uninstalling the app after exporting anything you wish to keep.
Children
Rivet is a professional construction productivity tool and is not directed to children under 13.
Contact
Questions about privacy can be sent to Jamie9694@gmail.com.