Privacy policy

Effective August 2, 2026 · Applies to the Rovyn app and the hosted Rovyn service (rovyn.app)

The short version. Rovyn stores the playlists your assistant sends you, how far you got through them, and the feedback you chose to give. Your assistant gets summarized listening receipts and your feedback in your own words — never your raw playback history, and never anything from any other assistant you've connected. There are no analytics, no trackers, no ads, and no data sales. Deleting your account deletes your data — actually deletes it.

What Rovyn stores

• Your editions (playlists). The recommendations your assistant created, each episode's one-line rationale, and the goal ("brief") the assistant stated when it made the playlist. Briefs marked as temporary interests are purged automatically when the playlist is finished.
• Playback events and progress. The app records playback events (started, paused, completed, skipped) and your resume position. These raw events are server-internal: no assistant and no third party can read them. They exist only to build the summarized receipts below, and are deleted with your account.
• Listening receipts. A per-episode summary: outcome, rough progress, time spent, and any feedback you gave. Receipts carry no timestamps-of-day and no device identity.
• Your feedback, verbatim. Notes you write are stored exactly as typed. Rovyn never summarizes, classifies, sentiment-scores, or auto-tags them. What you can read back in the app is precisely what your assistant can see.
• Your feeds. RSS feeds you added and podcast catalog metadata (shows and episodes — this is public data, not yours).
• If you sign in: one email address. Accounts are optional — anonymous use is first-class, with no sign-in wall. If you do sign in (Apple or Google, via Firebase Auth), Rovyn stores an opaque account identifier and the email address your provider supplied. The email exists for one purpose: manual account recovery when you write to support. It appears nowhere in the app, is never used for outbound mail, never shared, and is deleted with your account. Rovyn does not store your name or photo, even though sign-in providers offer them.

What your assistant sees

Each assistant you connect (Claude, ChatGPT, and so on) is a separate connection with its own permissions, which you can revoke independently at any time.

• Assistants receive summarized receipts, never raw playback history. There is no interface through which an assistant can read raw events — the limitation is structural, not a setting.
• Your written feedback goes, word for word, to assistants you granted permission to read receipts — and to no one else.
• A connection cannot see that other assistants exist, or what permissions they have.
• Rovyn never receives your assistant's memory or your conversation history. The only thing that crosses the boundary is the narrow brief the assistant states when it builds a playlist.

What Google and Apple see

Signing in contacts Google's Firebase servers, and your identity provider (Apple or Google) learns that your Apple/Google identity signed in to Rovyn — that is the whole disclosure. Rovyn sends the identity providers nothing else: no goals, no briefs, no listening behavior, no feedback, no library contents. Firebase Analytics is deliberately not integrated. Firebase itself holds your account record (identifier, linked provider, email) because it must, to authenticate you.

What podcast publishers see

Rovyn streams audio directly from publishers' servers, like any podcast app. Publishers see ordinary CDN logs — IP address, user agent, byte ranges. Rovyn sends them nothing else: no goals, no briefs, no feedback, no identity.

What Rovyn will not do

• No sale of your data, and no use of your consumption data for model training — ever, without separate explicit consent (and there is currently no consent surface, therefore no such use).
• No server-side inference: no recommendation engine, no taste profiling, no embeddings of your behavior. There is no inferred profile anywhere in the system to leak, inspect, or delete.
• No analytics or telemetry, and no third-party trackers in the app or the server. This website sets no cookies.
• No ads, no monetization of attention.

Deletion deletes

Deleting your account removes every row of your data — editions, briefs, playback events, progress, receipts, feedback, connections, and the identity record with its email — in one transaction. Every assistant token dies with it. There is no soft-delete, no tombstone, and no "anonymized" aggregate kept behind. Only shared public catalog data (shows and episodes) survives, because it was never yours. The app then deletes the Firebase user, which removes the account on Google's side.

Self-hosting

Rovyn implements Cueback, an open protocol, and the backend is a single service designed to be run by anyone. A self-hosted Rovyn has the identical privacy properties by construction — nothing above depends on us behaving well.

Changes and contact

If this policy changes, the date at the top changes, and material changes will be called out plainly on this page. Questions: support@rovyn.app.