Privacy | Riku

Effective 10 November 2026.

Who we are

Riku is run by Riku AI LLC, a Wyoming limited liability company ("Riku", "we", "us"). You can reach us about anything on this page at [email protected].

Riku has two kinds of people in it, and this page covers both:

Builders: people with a Riku account who make chat apps and share them.
Visitors: people who open a builder's app through a link, through their team, or through a chat widget on the builder's website.

For builders' account data, we decide how it's used. For visitors' data, the builder who made the app decides what the app is for and what it asks, and we handle it on their behalf to provide the service.

What we collect from builders

Your email address, so we can send you sign-in links. Riku has no passwords.
Your name and workspace details, if you add them, and who you've invited to your workspace.
What you put into your apps: the persona, instructions, pasted text, documents you upload and web pages you point an app at.
Model keys, if you add your own OpenAI, Anthropic, Google or OpenRouter key. We store them encrypted and use them only to run your apps.
Billing details. Payments go through Stripe. We see your plan, your invoices and the last four digits of your card, never the full card number.
Technical data, such as when you signed in, which device and browser you used, and error logs, so we can keep the service working and secure.

What we collect from visitors

The conversation: the messages you send to an app and the answers it gives.
Your email address or name, only if the app's owner asks for it before you start.
A random visitor ID, kept in a cookie, so the owner can tell a returning visitor from a new one.
When you opened the link, the country it came from, and the first questions you asked. For a chat widget we also note which website it was shown on.
Your IP address. Our network provider handles it to deliver the page, and we use it briefly to limit abuse. It isn't part of the conversation record the builder sees.

The builder who made the app can see the conversation and the details above for their own apps. That's the point of the product: they see who opened their link and what was asked. If you want something removed from someone's app, ask them first. You can also contact us.

Visitors must be old enough to use the service where they live: see "Children" below.

What we use it for

To run Riku: sign you in, answer chats, show builders their links, analytics and conversations, and send the emails you'd expect (sign-in links, invites, receipts and notices about your plan).
To bill paid plans.
To keep Riku safe, stop abuse, and fix problems.
To tell builders about important changes to Riku or to these pages.

We don't sell personal data and we don't show ads. We don't use apps' content or conversations to train AI models.

Who else handles it

We use a small number of companies to run Riku. Each one gets only what it needs for its job:

Cloudflare: hosting, our database, file storage and network security.
AI model providers: to answer a message, the app's instructions, the relevant context and the conversation are sent to the model the builder picked. The house model runs through OpenRouter, which passes the request on to the company that runs the model. If the builder added their own key, the request goes to that provider (OpenAI, Anthropic, Google or OpenRouter) under the builder's own account, and that provider's terms and privacy policy apply to it.
Postmark: sends our emails, such as sign-in links.
Stripe: handles payments and subscriptions.
Google Fonts: serves the typefaces on our website and app, so Google sees your IP address when a page loads.

We may also share data if the law requires it, to protect people or the service, or as part of a sale or reorganisation of the business. We'll update this list if it changes.

Cookies and similar storage

We use only what the product needs. No advertising cookies, no tracking cookies, and no third-party analytics.

Signing in. Your session is kept in your browser's local storage while you're signed in, along with small preferences such as your last workspace and sign-in email.
Visitors. A cookie holds a random visitor ID so apps can count unique visitors; it lasts up to about 13 months. A link protected by a password sets a cookie that remembers you've entered it, for 24 hours.

You can clear or block these in your browser. Some parts of Riku won't work without them.

How long we keep it

We keep your account and your apps while your account is open. Conversations stay until the builder deletes them or the app, or until the account closes. Billing records are kept for as long as tax and accounting law require.

You can ask us to delete your account and its data by writing to [email protected]. We'll do it within 30 days, apart from what we must keep by law. Copies in our backups are removed as the backups expire.

Security

We protect data with measures suited to a small service: encrypted connections, encrypted storage of model keys, access limited to the people who need it, and regular updates. No service is perfectly secure, and we can't promise that nothing will ever go wrong. We don't claim any security certification. If a breach affects your data, we'll tell you as the law requires.

Your choices and rights

You can see, change or delete your apps and their content in Riku at any time.
You can ask us for a copy of your personal data, to correct it, or to delete it. Write to [email protected]. We'll reply within 30 days. We may need to check it's you first.
Visitors can make the same requests, and we may pass them to the builder who runs the app, since they decide how the data is used.

Children

Riku isn't for children. You must be at least 18 to have an account. People under 13 may not use Riku or any app made with it, and in the European Economic Area and the United Kingdom the minimum is 16. We don't knowingly collect data from them. If you think a child has given us data, write to [email protected] and we'll delete it. Builders must not point an app at children below these ages.

Where your data is processed

We're in the United States, and our data is processed in the United States and in the other places where Cloudflare and our other providers operate. If you're outside the US, that means your data is sent to other countries, which may have different data protection laws from yours. Where the law requires it, we rely on safeguards such as standard contractual clauses. We don't claim membership of any data privacy framework.

If you're in the EEA, UK or Switzerland

Our legal bases for using personal data are:

To provide the service you asked for (a contract): running accounts and apps, billing, and sending the emails the service needs.
Our legitimate interests: keeping Riku secure, preventing abuse, fixing problems and understanding how the service is used. We balance these against your rights.
Consent, where we ask for it. You can withdraw it at any time.
Legal obligations, such as tax records.

You have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent. To use any of them, write to [email protected]. You can also complain to your local data protection authority. For visitor data, the builder who runs the app is usually the controller, and we act as their processor.

If you're in California

Under California law you can ask what personal information we have about you, ask us to delete or correct it, and ask us not to discriminate against you for asking. In the last 12 months we've collected the kinds of information listed above (identifiers such as email address, your messages, and technical data) for the purposes listed above. We don't sell personal information or share it for cross-context advertising. To make a request, write to [email protected]. You can ask an authorised agent to do so for you.

Changes

If we change this page in a way that matters, we'll update the date at the top and email builders before the change takes effect.

Contact

Questions or requests: [email protected].