rvlme

rvlme Privacy Policy

Effective Date: June 26, 2026 · Last Updated: July 8, 2026

Welcome to rvlme. rvlme is a social interaction app that lets users share photos through a quiz-based reveal mechanic. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the controls you have over your data.

By using rvlme, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our services.

If you have questions about this Policy, you can reach us at privacy@rvlme.com.

1. Who Can Use rvlme

rvlme is available to users aged 18 and over only. We collect your date of birth at registration and use it to verify that you meet the minimum age requirement. Account creation is restricted to users aged 18 and over and is enforced at the server level. Users who do not meet this requirement are not permitted to create an account.

If we discover that a user is under the age of 18, we will suspend their account immediately, delete all associated content within 14 days, and retain minimal account identifiers for 90 days solely to prevent re-registration, after which all identifiers will be permanently purged.

We monitor applicable age verification regulations across jurisdictions and will update our practices as required by law.

2. Information We Collect

2.1 Information You Provide

When you create an account, we collect:

  • Your full name
  • Your username
  • Your date of birth (used solely for age verification)
  • Your phone number (stored in hashed form)
  • Profile information you choose to add

2.2 Reveal Content

A Reveal is a photo and quiz combination created by a Sender and sent to a Receiver. When you create a Reveal, we collect:

  • The photo you capture (live camera capture only — gallery uploads are not permitted)
  • The quiz question and answer you create
  • The upload timestamp (the time the Reveal was sent — not the time the photo was taken)

We do not collect any camera metadata, device timestamps, GPS coordinates, or EXIF data from your photos.

2.3 How Your Photos Are Stored

rvlme uses a privacy-by-design approach to photo storage. Photos are never stored as complete images on our servers. Upon upload, photos are immediately fragmented and stored as partial data strings. Each fragment is only accessible via a time-limited signed URL, assigned only when the Receiver correctly answers the corresponding quiz question. Photo fragments on the Receiver's side are permanently deleted 24 hours after the Reveal is sent. The Sender's Reveal remains accessible on their profile until they manually delete it. Complete photo assembly occurs only on the Receiver's device.

2.4 Messages

We collect the content of messages exchanged between users after a Reveal has been unlocked. Text messages sent through rvlme are not encrypted. We recommend users do not share sensitive personal information through messages.

2.5 Non-User Invite Link Data

When a non-registered user receives an invite link and opens it, we collect:

  • A name, if the user chooses to enter one (free text field, entirely optional)
  • An anonymous user ID generated at the time of link opening

If a non-user enters their name and begins interacting with a Reveal, their name and anonymous ID are retained indefinitely. If a non-user does not enter a name, no data is retained. If a non-user opens the link but does not interact, no data is retained.

2.6 Technical and Usage Data

When you use rvlme, we automatically collect:

  • Device information (device type, operating system, app version)
  • Identifier for Vendor (IDFV) — Apple's per-app device identifier
  • IP address
  • App usage events (actions taken within the app)
  • Notification delivery and interaction data
  • In-app purchase and subscription data
  • Crash and performance data

3. How We Use Your Information

We use the information we collect to:

  • Create and manage your account
  • Verify that you meet the minimum age requirement
  • Deliver Reveals from Senders to intended Receivers
  • Enable messaging between users after a Reveal has been unlocked
  • Send push notifications and SMS verification codes
  • Process in-app purchases and manage subscriptions
  • Analyze usage patterns and improve the app
  • Attribute app installs and measure marketing effectiveness
  • Enforce our Terms of Service and Community Guidelines
  • Respond to reports and conduct safety investigations
  • Comply with legal obligations

4. What We Do Not Do With Your Content

rvlme will never:

  • Use your Reveals for marketing, promotion, or advertising purposes
  • Use your Reveals to train machine learning models or improve algorithms
  • Proactively review or monitor your Reveals — moderation is triggered only by user reports
  • Sell your personal data to third parties

5. Reveal Ownership

You retain ownership of the Reveals you create. Before a Reveal is unlocked, ownership sits with the Sender. After a Reveal has been successfully unlocked, both the Sender and Receiver hold joint ownership of that Reveal.

You grant rvlme a limited license solely to host, store, transmit, and display your Reveals to your intended Receiver. rvlme will not use your Reveals for any other purpose.

The Sender's right to delete their content and account overrides joint ownership. If a Sender deletes their account, all associated Reveals are permanently deleted from both sides.

6. Screenshot Protection

rvlme protects all Reveal content at every stage of the interaction. Screenshots are blocked and will only capture a black screen — this applies during the quiz phase, at the moment of Revealing, and on all subsequent viewings. Senders are notified of every screenshot attempt regardless of the stage at which it occurs.

The camera is used solely for photo capture. We do not use the camera feed for face detection, liveness checks, or any other purpose.

7. How We Share Your Information

7.1 With Other Users

When you send a Reveal, its contents are shared with the intended Receiver only. Messages are shared between the Sender and Receiver of that conversation only. No Reveal or message content is shared publicly or with any other user.

7.2 With Service Providers

We work with third-party service providers who process data on our behalf to deliver our services. These providers are contractually obligated to use your data only as directed by us.

Our current service providers are:

  • Supabase — database and backend infrastructure (stores all user data)
  • PostHog — product analytics (usage events, device data)
  • Adjust — mobile attribution (install data, device identifiers)
  • RevenueCat — in-app purchase management (transaction data, subscription status)
  • OneSignal — push notification delivery (device tokens)
  • Firebase Cloud Messaging (FCM) — message delivery (device tokens)
  • Twilio — SMS verification (hashed phone numbers only)
  • Apple App Store / Google Play Store — app distribution and payment processing (transaction data)

7.3 For Legal and Safety Reasons

We may share your information with law enforcement, courts, or other authorities when:

  • Required by a valid legal request, court order, or applicable law
  • Necessary to protect the safety of our users or others
  • Required to report child sexual abuse material (CSAM) to the National Center for Missing and Exploited Children (NCMEC) or relevant authorities
  • Necessary to investigate and enforce potential violations of our Terms of Service

7.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to a successor entity. We will notify you of any such transfer and ensure your data continues to be protected under equivalent terms.

8. Data Retention

We retain your information only as long as necessary to provide our services or as required by law.

Specific retention periods:

  • Account data — retained while your account is active; deleted upon account deletion
  • Reveals (Sender side) — retained on the Sender's profile indefinitely until the Sender manually deletes them
  • Reveals (Receiver side) — photo fragments permanently deleted 24 hours after the Reveal is sent; the Receiver can no longer access the Reveal after this period
  • Reveals deleted by Sender — immediately removed from both Sender and Receiver sides upon deletion
  • Messages — retained after your account is deleted but your identity is anonymized; messages remain visible to the other party without attribution to you
  • Non-user data (name entered) — retained indefinitely alongside an anonymous user ID
  • Non-user data (no name entered) — nothing retained
  • Underage account identifiers — retained for 90 days to prevent re-registration, then permanently purged
  • Permanently banned accounts — hashed phone number and IDFV (device identifier) retained indefinitely to prevent re-registration
  • Reported content — preserved until investigation is complete, then subject to standard retention rules
  • Transaction data — retained as required by applicable tax and financial laws

9. Blocked Users

Reveals and messages sent to a user who has blocked you will not be delivered. Any Reveals or messages sent during a blocked period are permanently discarded and cannot be recovered, even if the block is later removed.

10. Content Moderation

rvlme does not proactively review or monitor Reveals or messages. When a report is received, rvlme will review the specific reported content. For serious or repeated violations, rvlme reserves the right to review account-level activity and behavioral data. Reported content is preserved and not deleted until any investigation is complete.

rvlme will cooperate fully with law enforcement for violations requiring legal escalation, including mandatory reporting of CSAM to the NCMEC.

11. Your Rights and Controls

You have the following rights over your data:

  • Access — you may request a copy of the personal data we hold about you
  • Correction — you may request that we correct inaccurate information
  • Deletion — you may delete your account at any time from within the app; account deletion triggers deletion of all associated Reveals and content
  • Portability — you may request a copy of your data in a portable format
  • Withdrawal of consent — where processing is based on consent, you may withdraw it at any time
  • Objection — you may object to certain processing activities

To exercise any of these rights, contact us at privacy@rvlme.com. We will respond within 45 days.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to know what personal information we collect, use, disclose, and sell
  • Right to delete your personal information
  • Right to correct inaccurate personal information
  • Right to opt out of the sale or sharing of your personal information
  • Right to limit the use of sensitive personal information
  • Right to non-discrimination for exercising your privacy rights

rvlme does not sell your personal information. To exercise your California privacy rights, contact us at privacy@rvlme.com.

13. International Users and GDPR

rvlme is currently available in the United States only. We are committed to GDPR compliance from launch in preparation for future international expansion. When we expand to the European Union or United Kingdom, the following will apply:

  • You will have the right to lodge a complaint with your local supervisory authority
  • We will identify the legal basis for each processing activity
  • We will implement appropriate safeguards for international data transfers
  • Additional rights under the GDPR will be made available to you

14. Data Security

We implement reasonable technical and organizational measures to protect your information. Photos shared through Reveals are protected by our fragmented storage architecture — photos are never stored whole on our servers. Photo fragments on the Receiver's side are permanently deleted 24 hours after the Reveal is sent. However, no method of transmission or storage is completely secure and we cannot guarantee absolute security of your data.

Text messages sent through rvlme are not encrypted. We recommend users do not share sensitive personal information through messages.

15. Children's Privacy

rvlme is not directed to anyone under the age of 18. We do not knowingly collect personal information from users under 18. If we become aware that a user is under 18, we will immediately suspend their account and delete their data in accordance with Section 1 of this Policy.

16. Governing Law

This Privacy Policy is governed by the laws of the State of California, without regard to conflict of law principles. Any disputes arising from this Policy will be resolved in accordance with the dispute resolution provisions in our Terms of Service.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by email at least 30 days before the changes take effect. Continued use of rvlme after changes take effect constitutes your acceptance of the updated Policy.

18. Contact Us

For any questions, requests, or concerns about this Privacy Policy or your data, please contact us:

We will respond to all privacy-related requests within 45 days of receipt.