Privacy Policy

What Rikai collects

• Your name, email address, profile image, and Google account identifier when you sign in with Google.
• Your subscription status, Paddle customer identifier, and payment history. Rikai does not receive or store complete card details.
• Your study sessions, answers, progress, notes, bookmarks, invitations, and account settings.
• Technical information needed to operate and secure the service, such as request logs, device information, and error data.

Google user data

Rikai uses Google only for authentication. Rikai receives basic profile information and your email address so it can create and secure your account. Rikai does not request access to Gmail, Google Drive, Google Calendar, contacts, or other Google services, and it does not receive Google access or refresh tokens.

How information is used

Rikai uses this information to authenticate you, deliver question-bank sessions, preserve your progress, administer subscriptions, prevent abuse, provide support, and improve the reliability of the service. Rikai does not sell personal information or use Google user data for advertising.

Reasons for processing

Account, study and billing information let Rikai provide the service you request. Security and limited diagnostics help prevent abuse and keep the service working. Payment records support legal and accounting obligations. Where applicable law requires a legal basis, these purposes rely on performing the service contract, legitimate interests in security and reliability, and legal obligations.

Service providers

Rikai relies on WorkOS for authentication, Paddle for billing as merchant of record, Convex for application data, Vercel for hosting, Cloudflare R2 for licensed content delivery, Resend for transactional email, and Sentry for error monitoring. Error reports sent to Sentry contain the error type, the part of Rikai where the error occurred, a numeric error reference, and the release version. They do not include question text, error messages, request details, or cookies. These providers process information only as needed to provide their services to Rikai and are governed by their own security and privacy commitments.

These providers may process data in the United States and other countries outside your country of residence. Contact help@getrikai.app for details about the providers and any transfer safeguards applicable to your data.

Cookies

Rikai uses authentication cookies to hold your encrypted session and short lived verification values for sign-in. Browser storage also keeps your sidebar, tour and exam preferences and a local cache of your study progress. Signing out clears the study cache.

Rikai records daily totals for sign-ups, checkouts, first completed blocks, and cancellations. These totals contain no account identifiers, question content, or advertising identifiers. Separate hashed markers prevent repeated events from being counted twice. Rikai uses no analytics or advertising cookies. Paddle may set cookies when you use its checkout or customer portal.

The Cookie Policy explains browser storage and how to clear it.

Retention and security

Rikai keeps account, subscription, and study data while your account is active and as reasonably necessary for security, legal, accounting, and service-continuity purposes. Rikai uses access controls, encrypted connections, scoped credentials, and server-side authorization to protect information, but no system can guarantee absolute security.

Your choices

You can cancel a subscription through the Paddle customer portal. You can delete your account and all of its study data from the account page, or request access to or deletion of it by writing to help@getrikai.app. Cancel any renewing subscription before deleting the account. We may need to verify that the account belongs to you before handling an email request.

Deletion removes your account, answers, notes, bookmarks, sessions, progress and Rikai sign-in. A deletion confirmation may temporarily retain your email address for delivery retries. The address is removed when the message is delivered or its retry window expires. Billing dates, amounts and provider identifiers remain for payment reconciliation and legal and accounting obligations. Records of account actions remain with your email address replaced by a pseudonym.

A hashed eligibility marker remains to prevent repeated use of a first customer promotion. The marker stores a keyed hash of your email rather than the email itself, and contains no study data.

Pseudonymous deletion records also remain so retries do not repeat completed work. Identity details needed for a deletion confirmation are removed after delivery or expiry of its retry window.

Depending on the law that applies to you, you may also request correction, a portable copy, restrictions on processing or object to processing. Send requests to help@getrikai.app. You may complain to your local data protection authority.

Age eligibility

Rikai is intended for people aged 18 and older. Do not create an account if you are younger than 18. Rikai does not ask for your birth date. If you believe a child has provided personal information, contact help@getrikai.app so we can investigate and remove it.

Changes and contact

Rikai may update this policy as the service changes. Material updates will be posted here with a new effective date. Privacy questions can be sent to help@getrikai.app.