Riffkit

Privacy Policy

Last updated: November 7, 2026

We at Bit Computing Pte. Ltd. (“Riffkit”, “we”, “our”, or “us”) respect your privacy and are committed to keeping your information secure. This Privacy Policy describes how we collect, use, and protect personal information when you use Riffkit (the “Services”), including our website, our web, iOS, and Android apps, agent interfaces, and public video pages. We handle personal data in line with Singapore’s Personal Data Protection Act (PDPA) and, where applicable, the GDPR and CCPA.

1. Personal Information We Collect

Information you provide:

  • Account information: your email address (provided by Google if you sign in with Google, or by Apple if you sign in with Apple), your team membership and role, your subscription and transaction history, and payment details (handled by Stripe, by Apple for a purchase in our iOS app, or by Google Play for a purchase in our Android app; see section 8). If you sign in with Apple in our iOS app, Apple gives us an identifier for your Apple account and an email address, which may be a private relay address that Apple forwards to your own; we keep them with your account, and whether the address is a private relay one, so that you can sign in with Apple again. We also exchange that sign-in for a token from Apple, which we keep encrypted and use only to tell Apple to end Riffkit’s access to your Apple account when your Riffkit account is deleted.
  • Content: the source videos and links, character avatars, personas and voice samples, product information and images, and written briefs you provide to the Services, and the videos, scripts, captions, and other output generated from them.
  • Reports: if you report a video, a template, or a character, the reason you pick, any note you write, and that the report came from your account.
  • Communications: your name, contact details, and the contents of any messages you send us, including copyright or other complaints.

Information we receive automatically:

  • Log data: your IP address, browser type and settings, request identifiers, and the date, time, and nature of your requests.
  • Usage data: the features you use, the tasks and generations you run, the engines and settings you choose, and similar activity. During your first 14 days we also record the steps you take in the product, on our website or in our iOS or Android app (each record notes which one), such as which screen you open, whether a submission went through, or whether you previewed, downloaded, or shared a video, to improve onboarding; this record never includes the content of anything you type, upload, or link to, nor file names, names, or email addresses, only coarse facts such as a length or file-size range. These step records are deleted after 90 days.
  • Device data: basic information about the device, operating system, and browser you use, and, in our apps, the app's version.
  • How you found us: on your first visit we store, in a cookie, the page you landed on, the referring site, and any campaign tags in the link (such as a referral or share code). When you sign up, that record is saved to your account so we know which channel brought you here. When you sign in with Apple in our iOS app, the app also sends us a random identifier that it keeps on your iPhone and that stays there if you delete and reinstall the app; if that sign-in creates your account, we save the identifier and the fact that you signed up in our iOS app as that record, and we use the identifier only so that one-time sign-up credits are given once per iPhone.
  • Referral and share activity: your personal referral code, the number of clicks on your links and shared pages, which accounts signed up through them, and the status and amount of any referral reward (see section 5).
  • Notification subscription: if you choose to get a browser notification when your video is ready, your browser gives us encryption keys and an address on the push service it uses (run by Google, Apple, Mozilla or Microsoft), which we store with your account and the language the app is in. We use them only to send that notification. We delete them when you sign out of Riffkit in that browser, when you sign out of your other devices, when the push service tells us the address no longer works, or after 60 days in which that browser has not opened Riffkit. You can also turn notifications off at any time in your browser's settings. In our iOS and Android apps, if you choose to get a notification when your video is ready, the app sends us the device token that Apple or Google issued to the app on that phone, whether the phone is an iPhone or an Android phone, the language the app is in, the app's version and, on an iPhone, whether the app is a development build; we store them with your account and the app sign-in they came from. We use them only to send that notification, which tells you that your video, or a section of it, is ready and links to it in the app; it does not include the template's name, anything you wrote, or a picture from the video. We delete them when you sign out of Riffkit in the app on that phone, when Apple or Google tells us the token no longer works, or after 60 days in which the app on that phone has not sent us the token again. When that app sign-in ends in another way, such as when you sign out of your other devices, we stop sending to that phone at once and delete the token at our next regular cleanup. You can also turn notifications off at any time in your phone's settings.
  • Cookies and similar technologies: described in section 2.

2. Cookies & Similar Technologies

We set the following first-party cookies:

  • Sign-in session (vee_session): keeps you signed in. Essential. It lasts for an idle period (by default 12 hours) that is renewed while you use the app, so it ends when you sign out or stop using Riffkit for that long.
  • Sign-in security (vee_google_oauth_state, vee_google_oauth_verifier, vee_google_oauth_next, vee_device_csrf): short-lived cookies (about 10 minutes) that protect Google sign-in and agent device sign-in against forgery. Essential.
  • Assistant approval (vee_oauth_csrf): set when you open the page where you approve an AI assistant’s connection (section 6), to protect the approve form against forgery. It lasts at most 10 minutes and is removed as soon as you approve or deny. It is sent only to that page and cannot be read by scripts. Essential.
  • App sign-in (vee_app_signin_csrf): set when you sign in to the Riffkit mobile app through our sign-in page, to protect that page against forgery. It lasts at most 15 minutes and is removed once you continue to the app. It is sent only to that page and cannot be read by scripts. Essential.
  • First-visit attribution (rk_attr): set on your first visit to our website, app, blog, or a shared video page and kept for 30 days. It records when you arrived, the landing page, the referring site, and any campaign, affiliate, skill, or share tags in the link, or that you first arrived through our iOS or Android app. It is never overwritten by later visits. We use it only to learn which channel brought you to Riffkit and to attribute sign-ups; we do not use it for advertising.
  • Referral (rk_ref): set when you open a Riffkit referral link or a shared video page and kept for 60 days. It holds the referral code only, so that a sign-up can be credited to the person who referred you. It is never overwritten by a later link.
  • Region (rk_region): set only if we cannot tell which country you are visiting from and you choose a region to see prices. It holds that choice only and is kept for 180 days.
  • App sign-in (rk_app_signin): set when our iOS or Android app opens our sign-in page, and kept for 30 minutes or until that sign-in finishes. It holds which app opened it (iOS or Android), when, and a random value that identifies that sign-in, so that an account created during that sign-in is recorded as created in that app.

Third parties:

  • Cloudflare: we use Cloudflare Web Analytics, a privacy-friendly, cookieless service, to understand aggregate traffic, and Cloudflare Turnstile, a bot-protection check on our sign-in page that normally runs invisibly and may occasionally show a verification prompt. Cloudflare also delivers and protects our site and may set its own operational cookies for that purpose. Turnstile is subject to the Cloudflare Turnstile Privacy Supplement.
  • Embedded players: inside the app, a TikTok source may be played in TikTok’s official embedded player, which TikTok serves under its own privacy policy and which may set TikTok cookies in your browser or, in our iOS and Android apps, in the web view the app shows it in. Other stills and previews are served by Riffkit and set no third-party cookies.

We also use browser storage (not cookies) on your own device for things such as remembering your language, theme, and the settings you last used, an unsent form draft and an unfinished checkout for up to 24 hours, what you were doing when you were asked to sign in (for up to 30 minutes), whether this browser has signed in to Riffkit before, whether you have seen a welcome message or a hint, whether you answered our offer of browser notifications, and which version of a page test this browser was given (sent with your step records, section 1, when you are signed in). Except where noted, this data stays in your browser. We self-host our fonts and do not run advertising trackers. You can block or delete cookies in your browser; blocking the essential cookies will stop you from signing in.

In our iOS and Android apps, you stay signed in with a sign-in token instead of a cookie. The app keeps it only in your phone’s secure storage (the iOS Keychain or the Android Keystore) and sends it only to Riffkit; we store only a hash of it, with the IP address and the software it signed in from, and it counts among your signed-in devices in Settings. It ends when you sign out in the app, when you use “Sign out other devices” on another of your devices, or after 90 days in which the app has not used it.

3. How We Use Your Information

  • provide, administer, maintain, and analyze the Services (analyzing source videos and generating your videos);
  • process payments, manage your subscription, and credit referral rewards;
  • secure your account, enforce usage limits, and prevent fraud and abuse, including by comparing sign-ups by IP address, email domain, and normalized email address, and by comparing payment-method fingerprints across accounts to detect duplicate or self-referred accounts;
  • communicate with you, including transactional messages such as sign-in codes, account and billing notices, and responses to your requests;
  • send you occasional updates about Riffkit; you can ask us to stop at any time by emailing [email protected];
  • understand which channels bring users to Riffkit and attribute sign-ups to referrals, shares, affiliates, and campaigns;
  • maintain, improve, and develop the Services, including using aggregated or de-identified data; and
  • comply with legal obligations, respond to rights complaints, and protect our rights, users, and the public.

We do not sell your personal data and we do not send spam.

4. AI Processing & Content Review

To generate your videos, we send the inputs you provide to AI sub-processors, which return the output to us. This includes source videos and clips of them, source music tracks, avatar images, voice samples, product images, and your written briefs. Those vendors run their own automated content review on inputs and outputs (for example, review of avatar images and of source clips, and detection of disallowed audio or visuals) and may reject or alter a generation; we receive only the result of that review. Some vendors keep the assets we submit on their systems under their own retention rules, and in some cases we have no way to delete them there. We do not sell your personal data, and we do not use your Content to train AI models or to build products for other customers.

Your agreement in our apps. Before our iOS or Android app first sends something you add to these AI sub-processors, it names them and asks you to agree. We record when you agreed, which version of that list you agreed to, and in which app; when the list changes, the app asks again. You can withdraw your agreement at any time in Settings → AI data processing, and we record when you did. Until you agree again, we do not carry out a request from either app that would send something new to them; withdrawing does not affect what you do on our website or what has already been sent.

Face and voice data. Avatar images, persona photos, and voice samples you upload are used only to generate the videos you request. We do not use them to identify anyone, do not build face or voice templates for identification, and do not sell them. They are sent to the AI vendors named in section 7 for generation and content review, and they are deleted from our storage when you delete the character or close your account (copies we keep for recovery are removed automatically after a short period); some vendors keep submitted assets under their own rules. If you upload another person’s face or voice, you must have their consent as described in our Terms of Service.

5. Public Content, Sharing & Referrals

Shared video pages. If you create a share link for a video, the page at that link is public: anyone with the link can open it, watch and save the video, and see that it was made with Riffkit. It does not show your name or email. It is marked not to be indexed by search engines, but we cannot control who forwards the link. We record how many times each shared page is opened and its button clicked, and which sign-ups came from it; these counts are visible to you and your team. When you stop sharing or delete the video, the link stops working, and we keep the counts for the link.

Referral program. If someone signs up through your referral link or shared page, we record the referral and, after their first payment, the reward status and amount. You can see counts of clicks, sign-ups, paid referrals, and credits earned, and the amount and due date of pending rewards, but never the identity of the people who signed up. The person you referred is not told who referred them. To check for abuse, we compare the payment-method fingerprint that Stripe gives us for a referred account’s first payment with those of the referrer and of other referred accounts; we never see or store card numbers.

Templates. The template library in the app contains public short-form videos selected and published by Riffkit. Your own analyzed sources are visible only to you and your team.

6. Connected AI Assistants

You can connect Riffkit to an AI assistant, such as Claude or ChatGPT, so that it can use Riffkit for you.

Your approval. An assistant gets access only after you approve it on a Riffkit page while signed in to your account. That page names the assistant that is asking and lists what it will be able to do. The assistant then acts in your account through that access, which is separate from your sign-in: the assistant never receives your sign-in session or sign-in codes.

What the access covers. A connected assistant can make videos for you, in one go or a section at a time, and continue a video made a section at a time; both use your credits. It can see your templates, characters, products, reference images, finished videos and their captions, your tasks, and your credit balance with the credit grants behind it. It can add a product, turn a video link into a template, edit the captions of a finished video, and stop or retry a task. It can also get a link to one of your finished videos, to give to you in the conversation. That link opens the video in a browser without signing in, for anyone who has it, and works for 6 hours from when it is made. It can also give you a link to a Riffkit page where you add one file from your phone or computer: a video to make a video from, or an image (a picture of a product, or a reference image for your videos). Where the assistant shows Riffkit’s upload box in the conversation, the box sends the file to that same page. The page asks for no sign-in, so anyone who has the link can add that one video or image to your account while the link works, for up to 90 minutes, and can see or change nothing else. A video added this way that is not used to make a video is deleted within 25 hours of being added. An image added this way is kept like one you add in the app. It cannot sign in as you; change your plan or subscription, or reach your billing pages or payment details; create, edit, or delete characters; delete videos, templates, or products; create or stop a video’s public share page (section 5); or manage your team. It works only in your own account (or your team’s, if you are on a team) and cannot reach any other.

What we receive and what we return. We receive the requests the assistant sends on your behalf: which Riffkit action it calls and the values it passes, such as a video link, a product name and description, or the written brief for a video. The assistant decides what to pass, so a value can include something from your conversation or from what the assistant remembers about you; we do not receive the rest of your conversation with the assistant. We handle what arrives this way like anything you provide in the app. An assistant may also attach details of its own to a request, such as your language, your approximate location or an identifier it uses for you. Riffkit uses your language, where the assistant gives it, to answer you and to show its upload box in that language. A video or an image you add through an upload link comes from your browser directly to us, not through the assistant: the assistant is told whether it arrived and details about it, such as an identifier, a video’s length, or the name and description we record for an image, not the file itself. A file you attach to the conversation itself does not reach us. We return the result of each request, for example a list of your templates or videos, the progress of a task, your credit balance, or the link to a finished video described above. The assistant’s provider then handles what we returned, that link included, under its own terms and privacy policy, which we do not control. We also return the upload link described above, which the assistant’s provider handles in the same way.

How long it lasts and how to end it. A connection works for 90 days from the day you approve it, whether or not it is used; after that the assistant has to ask for your approval again. To end it sooner, disconnect Riffkit in the assistant: when the assistant tells us you did, we end that connection on our side too. Or use “Sign out other devices” in your Riffkit settings, which ends every assistant connection on your account and signs out your other browsers. Either way, the upload links on your account that nothing has been added to yet stop working too. A connection also stops working if your account is deactivated, and we may end one ourselves for security reasons.

What we record. For each connection we keep which assistant it is (including the name its software gives itself), when you approved it, when it was last used, and when it ends or was ended. We store its access credentials only in hashed form. For each request an assistant makes, our connector service logs one line: the time, a request identifier, a shortened hash of the access credential, the name and protocol version of the assistant’s software, the action called, the outcome, and how long it took. That line never contains the credential, the values the assistant sent, or the answer. The request itself is then handled and logged like any other request to your account (see “Log data” in section 1). If the assistant sends you to the approval page before you have signed in and your browser has no first-visit cookie yet, that cookie (section 2) records which assistant brought you.

7. How We Disclose Information

We may disclose personal information in the following circumstances:

  • Vendors and service providers who help us operate the Services, under contract, including Stripe (payments and payment-method fingerprints), Apple (purchases in our iOS app, and Sign in with Apple), Google Play (purchases in our Android app), OpenRouter and the model providers reached through it, including Google Gemini (AI text, vision, image, and speech-to-text processing), Seedance (by ByteDance) and MiniMax (AI video generation and content review), Amazon SES (email), Google (optional sign-in), Cloudflare (site delivery, cookieless analytics, and Turnstile bot protection), TikTok (its official embedded player and its public endpoints), video-fetch services (third-party services that receive a public video link you submit so that we can retrieve the video and its public metadata), and cloud hosting and storage providers.
  • Push services: if you turn on notifications, each notification goes through the push service your browser uses (Google, Apple, Mozilla or Microsoft), which carries it to your browser; its contents are encrypted so that only your browser can read them. In our iOS and Android apps, we send each notification, with that phone's device token, to Apple Push Notification service (for an iPhone) or Google's Firebase Cloud Messaging (for an Android phone), which delivers it to your phone. Unlike browser notifications, these are not end-to-end encrypted, so Apple or Google can read what the notification says and the link in it.
  • AI assistants you connect: when you connect an assistant, we return the results of the requests it makes for you to that assistant, and so to its provider, as described in section 6.
  • Rights holders and complainants: if we receive a complaint that content you provided or shared infringes someone’s rights, we may forward your counter-notice to the complainant and, where the law allows and we consider it appropriate to resolve the complaint, share your contact details with them.
  • Your team: if you are on a team, its owner can see your usage, the videos and templates in the team, and the team’s shared links.
  • Business transfers: in connection with a merger, acquisition, financing, or sale of assets.
  • Legal requirements: to comply with law, respond to lawful requests, protect our rights or users, prevent fraud, or address security or safety issues.
  • Affiliates: entities under common control with Bit Computing Pte. Ltd., consistent with this Policy.

8. Payments

Payments on our website are processed by Stripe. We do not store your full card details; they are provided directly to Stripe, whose handling of your data is governed by its own privacy policy and the PCI-DSS standard. We retain your subscription status and transaction history, and, for referral fraud checks, a payment-method fingerprint that Stripe derives from a card (an identifier that cannot be turned back into a card number). A plan bought in our Android app is processed by Google Play under Google’s own terms: Google handles your payment details, and sends us the purchase’s details, such as its purchase token, order ID, country or region, and subscription state, which we keep with your subscription history. A plan bought in our iOS app is processed by Apple under Apple’s own terms: Apple handles your payment details, and sends us the purchase’s details, such as its transaction IDs, the product and the period it pays for, the App Store country or region, whether it will renew, and whether it was refunded or made as a test purchase, which we keep with your subscription history. In both apps, so that a purchase is credited to the right Riffkit account, the app gives Apple or Google an identifier we derive from your account, which they return to us with the purchase.

9. Your Rights

Subject to applicable law (including the PDPA, GDPR, and CCPA), you may request to access, correct, update, delete, or transfer your personal information, and you may withdraw consent or object to or restrict certain processing. We do not sell or “share” personal information as defined by the CCPA. You can delete individual videos, templates, characters, voice samples, and products in the app yourself. To close your account, use Settings → Delete account in our iOS or Android app; on the web, or without the app, email us at [email protected] from the address you sign in with (see how to delete your account). When you ask in the app, we delete your account within 30 days of your request. For any other request, contact us at [email protected]. We may need to verify your identity before acting, and you may use an authorized agent where the law allows. If you are in the EEA or UK, you may also complain to your local data-protection authority.

10. Data Retention & Security

We keep your account and Content while your account is active, and for as long as needed to provide the Services or for legitimate purposes such as resolving disputes, security, and legal compliance. Source videos you submit, avatars, and generated videos stay in our storage until you delete them or your account is closed; there is no automatic time-based deletion of them. When you delete them, copies we keep for recovery are removed automatically after a short period. When your account is deleted, we delete your Content (if you are a member of a team, the videos and other content in the team stay with the team), end your sign-ins in every browser and app, your connections to AI assistants, and your upload links, delete your notification addresses, your AI agreement record, and your step records, and tell Apple to end Sign in with Apple’s access. When an account is closed or a member is removed, we keep a minimal record (email address, role, team, and dates) for audit and abuse prevention, together with our log of sign-ins and other account actions, any reports you made, and your request to delete the account, and we keep a normalized form of the email address so that one-time sign-up credits cannot be claimed again. Share-link statistics are kept after a link is revoked. Billing records are kept as long as tax and accounting law requires. Assets submitted to AI vendors for generation or review may remain on their systems under their rules. After the applicable period we delete or de-identify your personal data; de-identified or aggregated data may be kept indefinitely. We use commercially reasonable technical and organizational measures to protect your information, though no method of transmission or storage is completely secure.

11. International Transfers & Legal Bases

We are based in Singapore. Your data is processed on our hosting servers and by our sub-processors, which may be located in the United States, China (where our video-generation vendors operate), and other countries. Your data may therefore be transferred to and processed outside the country where you live. Where required, including for transfers out of Singapore under the PDPA, we rely on appropriate safeguards such as contractual commitments to protect it. For users in the EEA, UK, or Switzerland, our legal bases for processing are: performance of our contract with you; our legitimate interests in operating, securing, improving, and promoting the Services and in preventing fraud; your consent, where we ask for it; and compliance with our legal obligations.

12. Children

The Services are not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us personal data, contact us and we will delete it. The Services must not be used to depict anyone under 18.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here with a new “Last updated” date, and provide additional notice if required by law. Your continued use of the Services after an update constitutes acceptance.

14. Data Controller & Contact

Bit Computing Pte. Ltd. (data controller)
64 Cecil Street, #06-02, IOB Building, Singapore 049711
[email protected]