RIVERLIGHT
Privacy policy for Riverlight
Updated: 24 October 2026
This policy applies to the Riverlight iOS app. Read the website privacy policy.
This policy explains how personal data is processed when you use the Riverlight iOS app, including local poker play, in-app purchases, optional rewarded ads, reminders, optional iCloud backups and contact features. It applies to the app. Any website publishing this text must additionally explain its own processing.
Controller and contact
The controller for processing through Riverlight is:
Erik Dahl Ruiz
Georg-Deuschle Strasse 41
73730 Esslingen
Germany
Email: contact@riverlightpoker.com
You can use this email address to ask privacy questions and exercise your data protection rights.
How the app works
Riverlight is a poker game against computer-controlled opponents. It offers no real-money gambling or cash withdrawal of virtual balances. No online player account is required. The app does not operate a public player leaderboard or synchronise progress with its own Riverlight game server.
Your profile and progress are processed on your device. Apple purchases, Google advertising, advertising consent, optional iCloud backups and external links can involve internet connections. Offline gameplay therefore does not mean that every feature operates without sending data.
Local profile and progress
The app stores a randomly generated player identifier, your chosen display name, avatar and optional country flag. It also stores your language and settings, chip/token, ticket and time-bank balances, purchases and rewards, hand histories, statistics, achievements, tournament registrations and results. You do not need to use your real name. A country flag is selected by you, not determined using GPS.
These data allow you to continue playing, view results and manage virtual balances correctly. The legal basis is Article 6(1)(b) GDPR. Storage on your device that is strictly necessary for the requested service is based on section 25(2), no. 2 TDDDG. You are not legally required to create a profile using your real name.
Optional iCloud backup
If you enable iCloud backup in your profile, Riverlight sends a copy of your save to the private CloudKit database in your iCloud account with Apple. The backup contains the data described under Local profile and progress, purchase associations and outstanding rewarded-ad delivery records. A backup timestamp, display name and local player identifier are also stored to identify the save. Your device must be signed in to iCloud. No separate Riverlight online account is created, and we do not receive your Apple password or access to other iCloud content.
This optional feature restores progress after reinstalling or on another device. Processing for the backup service you request is based on Article 6(1)(b) GDPR; necessary local storage is based on section 25(2), no. 2 TDDDG. Apple processes iCloud data under its own privacy information. The international transfer principles described below also apply where relevant.
The app keeps one current backup and displays its last successful backup time. It does not merge games played simultaneously on several devices. Before applying a save, it checks whether recorded spending, purchase credits or progress would be discarded; such an older or conflicting save is rejected. A backup can fail without a connection or sufficient iCloud space, while local progress remains available. Play on one device at a time and sync before switching devices. Offline saves are not a server-managed game account.
To protect against restoring older saves, Riverlight stores a random device identifier, the local player identifier, an increasing progress number and a hash of a progress marker locally in the iOS Keychain. Backups contain the associated progress numbers. This local marker contains neither a complete save nor an Apple password and is not used for advertising. It may remain after an ordinary reinstall on the same device and block an outdated backup. Turning off or deleting the iCloud save does not reset this local protection marker. This processing supports the integrity of the requested save and purchase features and is based on Article 6(1)(b) GDPR; necessary local storage is based on section 25(2), no. 2 TDDDG.
You can turn off automatic backup in your profile. Turning it off or deleting the app does not remove an existing iCloud backup. Delete iCloud save removes the backed-up progress, purchase associations and outstanding reward proofs and turns off automatic backups. Local progress remains. Device backups and other copies managed by Apple can be managed in Apple settings. Apple’s own retention and deletion periods are described in its privacy information.
In-app purchases through Apple
Purchases of virtual content are paid through Apple’s in-app purchase system. Apple processes the account, payment and transaction information needed for payment under its own privacy information. Riverlight does not receive your Apple account password or complete card or bank details.
The app processes the product ID, transaction ID, purchase time and status, and a random association identifier for your local profile. This association identifier is sent to Apple during purchase. Purchase records and profile associations are stored locally to deliver content correctly and resume outstanding purchases after interruptions. Verification uses StoreKit, without a separate Riverlight receipt-verification server.
The legal basis is Article 6(1)(b) GDPR. Where transaction records are required to prevent abuse or resolve disputed deliveries, Article 6(1)(f) GDPR applies; the legitimate interest is reliable purchase processing protected against duplicate credits. Legally required accounting records are processed under Article 6(1)(c) GDPR.
For EEA users, the relevant Apple entity is generally Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Details, including Apple’s storage practices:
Optional rewarded video ads with Google AdMob
Riverlight uses the Google Mobile Ads SDK and Google User Messaging Platform for rewarded video ads and privacy choices. For EEA users, the provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC, technical service providers and the advertising partners identified in the consent dialog may also receive data. Google generally acts as an independent data controller for its publisher advertising services.
Depending on use, settings and consent, the advertising SDK may process your IP address and approximate location inferred from it, app and device identifiers, device and performance information, crash and diagnostic data, and ads shown or interactions such as video views. Purposes include serving and, where applicable, personalising ads, audience and effectiveness measurement, security and abuse prevention. The app does not request your precise GPS location for these features.
Checking consent status may connect to Google at app startup. A video ad is only loaded when you request it. The app stores earned reward evidence with the local player identifier and time to credit each reward once. Your Riverlight display name and avatar are not sent by the app as advertising parameters.
Advertising consent and your choices
Where advertising or measurement processing requires consent, the legal basis is Article 6(1)(a) GDPR. Storage of or access to information on your device for these purposes also requires section 25(1) TDDDG where applicable. Google’s dialog explains the available purposes, providers and choices. Required consent is obtained before the relevant processing; simply opening the app does not replace consent.
Connection data and your choices are processed to provide and operate the consent dialog. Processing necessary to meet legal privacy obligations is based on Article 6(1)(c) GDPR in conjunction with consent and evidence requirements. Strictly necessary device storage is based on section 25(2), no. 2 TDDDG.
You may withdraw consent at any time for the future without affecting the lawfulness of prior processing. Where Google provides privacy options for your region, their button is available in your profile and Legal. Labels depend on the app language. The app currently does not request iOS tracking authorisation through App Tracking Transparency. A Google dialog choice is not an ATT authorisation.
You may play Riverlight without watching ads. Without appropriate consent, or if no ad is available, an advertising reward may be unavailable. Non-personalised advertising can still involve personal data processing.
Further information about Google’s data use, retention and data controls:
https://policies.google.com/technologies/partner-sites?hl=en
Reminders and notifications
If you allow notifications, Riverlight schedules reminders locally through iOS. It processes your settings, dates, tournament registrations and the time when free tokens become available. Tournament reminders cover only tournaments you registered for. No Riverlight push server or transmission of push-device identifiers to such a server is used.
Activation is optional and based on Article 6(1)(a) GDPR. You may withdraw permission in iOS Settings under Notifications for Riverlight. Local settings needed to implement your choices are retained for as long as required for the chosen feature.
Email contact
If you write to contact@riverlightpoker.com, your email address, any name provided, and message content and attachments are processed to address your enquiry. The Contact button opens your email application; it does not send a message by itself. Please include only information needed for your enquiry.
The legal basis is Article 6(1)(b) GDPR for contractual or pre-purchase enquiries. General enquiries are based on Article 6(1)(f) GDPR; the legitimate interest is responding to incoming requests. An email service provider technically processes messages to operate the mailbox. Statutory retention obligations are based on Article 6(1)(c) GDPR.
Instagram link and optional reward
In the shop you may open @riverlightpoker using an external link. No Instagram feed or Instagram login SDK is embedded for this feature. Instagram is opened in your browser or Instagram app only when you open the link. Meta may then process your IP address, device information and, if signed in, Instagram account information. Instagram’s privacy policy applies there:
https://privacycenter.instagram.com/policy/
For the optional one-time reward, Riverlight stores locally that you successfully opened the link and records the resulting ticket credit. It does not request your Instagram username, password or follower list, and does not verify whether you follow the profile through an Instagram interface. Processing the reward you request is based on Article 6(1)(b) GDPR; necessary local storage is based on section 25(2), no. 2 TDDDG. Participation is optional.
Recipients and processing outside the EEA
Recipients depend on features used: Apple for purchases, App Store services and enabled iCloud backup; Google and partners named in the advertising dialog for ads and consent management; and email providers for contact enquiries. If you voluntarily open Instagram or other external pages, their providers receive the data generated by that visit. Other recipients may receive data where disclosure is legally required.
Google and Apple may process data outside the EEA, particularly in the United States. Depending on the recipient and transfer, safeguards include adequacy decisions under Article 45 GDPR, such as the EU–US Data Privacy Framework for appropriately certified recipients, or appropriate safeguards under Article 46 GDPR, particularly standard contractual clauses. Google explains its transfer bases below; Apple’s information explains its processing and safeguards. Information or copies of applicable safeguards may also be requested using the contact address above.
Retention and deleting local data
Local saves, settings and purchase associations are retained to operate your saved profile. Once a rewarded-ad credit is acknowledged, the separate outstanding delivery proof is removed; the granted reward remains in your save. Purchase associations are retained to identify outstanding transactions and prevent duplicate credits.
Fully deleting the app through iOS can remove local app data. Offload App retains data. Device or cloud backups may contain additional copies and may require separate management. Restoring a backup may restore app data. Deleting the app does not remove data already held by Apple, Google or in the email mailbox.
Enabled iCloud backup is stored separately from the local app. It remains until deleted and is replaced by new successful backups. If desired, use Delete iCloud save before removing the app to remove that backup too. See the optional iCloud section for more information.
Contact enquiries are retained only as long as needed to handle them and related follow-up questions, unless statutory retention requirements or necessary evidence to establish, exercise or defend legal claims apply. Further processing is then restricted to those purposes. Google’s and Apple’s independent retention periods follow their respective privacy information and criteria.
Your data protection rights
Subject to statutory conditions, you may request access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction under Article 18 and portability under Article 20. You may withdraw consent at any time for the future.
For processing based on Article 6(1)(f) GDPR, you may object under Article 21 on grounds relating to your particular situation. You may object at any time to processing for direct marketing, including related profiling, without providing such grounds.
Contact contact@riverlightpoker.com to exercise your rights. Riverlight has no remote access to saves stored only on your device. We respond about data under our control and, where applicable, explain how you can manage local data yourself. You may also contact Google or Apple directly about their independent processing.
Under Article 77 GDPR you may complain to a supervisory authority, particularly in the EU Member State of your habitual residence, workplace or the alleged infringement. You do not need to contact us first. A list of German authorities is available at:
https://www.datenschutzkonferenz-online.de/datenschutzaufsichtsbehoerden.html
Automated decisions and changes
Riverlight does not make solely automated decisions about you with legal or similarly significant effects under Article 22 GDPR. Computer-controlled opponents and virtual game outcomes are part of gameplay. Advertising personalisation is explained in the advertising sections and Google’s dialog.
This policy will be updated if features or processing change. A new policy does not replace consent required for a new processing purpose.