Privacy Policy

Rithere (“Rithere,” “we,” “our,” or “us”) makes a desktop application that lets you use AI inside the applications you already work in, without switching windows. Rithere is operated by Arshit Vaghasiya, a sole proprietor based in Toronto, Ontario, Canada.

This Privacy Policy describes how we collect, use, disclose, and otherwise process personal data when you visit our website at rithere.com, download or use the Rithere desktop application, create or use a Rithere account, receive emails from us, or otherwise interact with us (collectively, our “Services”). “Personal data” means information that identifies, relates to, or could reasonably be linked to you. Rithere is the controller of the personal data described in this Privacy Policy.

This Privacy Policy does not apply to third-party websites or services that you access through the Services, such as a search engine you send a query to or a website linked in an AI response. Those third parties' own privacy policies govern their practices. If you live in Canada, the European Economic Area, the United Kingdom, Switzerland, the United States, or India, please also see our Regional Supplemental Disclosures.

1. Personal Data We Collect

We collect the following categories of personal data:

Personal data you provide to us

• Account Data: Rithere accounts use Google Sign-In. When you create an account, Google shares your name, email address, profile picture URL, and a unique Google account identifier with us, and we assign you a Rithere user ID. We record when your account was created and when you last signed in. If your Google account does not include a name, we use your email address as your display name. We do not receive your Google password.
• Inputs: The text you submit to the Services to generate a response, including text you select in another application, text and instructions you type into a Rithere bar, and messages you send in AI Chat (“Inputs”). The responses generated from your Inputs are “Outputs.” We process Inputs and Outputs only to provide the Services and do not store them on our servers, as described in How we process Inputs and Outputs below.
• Prompts and Settings: The prompts and asks you create (their names, instruction text, keyboard shortcuts, and options), your hotkeys, the features you enable, your display preferences, whether Rithere launches when Windows starts, and where AI Chat sends your messages. We store the current copy of your settings and, each time they change, a full copy together with a record of what changed (“Settings History”), so that your configuration can be synced across your devices and restored.
• App Lists: If you choose applications in which Rithere should not operate, or the only applications in which it should, we store each application's program name, the title of its window at the time you added it, and its file location on your device. Window titles can include the name of a document, webpage, or conversation, and file locations can include your Windows user name. We also retain a list of the program names you have excluded, including applications you later remove from your list.
• Feedback: If you submit feedback through the app, we collect your message, the category you select, your user ID, and your name or email address.
• Communication Information: If you contact us by email or social media, we collect your name, contact details, the contents of your message, and any other information you choose to provide. The app's “email support” link may pre-fill your app version and Windows platform in the message, which you can remove before sending.

Personal data we receive automatically from your use of the Services

• Usage Information: When you use the app, we record the action you take (for example, running a prompt, opening the prompt menu, asking a question, or sending a chat message to a search engine), the name of the prompt, ask, or search engine involved, the keyboard shortcut used, your user ID and display name, and the date and time. When you use “Name with AI,” we record the title the AI suggests. We also record the date and time of each sign-in and sign-out. Usage Information does not include your Inputs, your Outputs, or your search queries.
• Usage Counts: To enforce usage limits, we count the number of AI requests your account makes per minute and per day. We store only the counts and the time periods they apply to.
• Log and Technical Information: When your device connects to the Services, our service providers receive your IP address and technical information such as your browser or app type and the date, time, and outcome of the request. Our server's request logs record the time, outcome, duration, and IP address of each request, but never its content. Our authentication provider records the IP address and device or browser type associated with each signed-in session.
• Device Information: The app generates a random installation identifier on your device and sends it with each update check to download.rithere.com, so that updates can be released gradually. This identifier is not linked to your account. The app checks for updates when it starts, when you open its windows (no more than once every 10 minutes), and every 6 hours.
• Website Information: When you visit rithere.com, our hosting provider processes your IP address, browser information, and the pages and files you request. If a page fails to load, your browser may send our hosting provider a brief error report. With your consent, we also collect analytics data, as described in Section 5.
• Email Interaction Information: When we send you our welcome email, we record when it was sent, whether and when it was opened, and which of its links you clicked, as described in Section 5.

Personal data we receive from third parties

• Google: When you sign in with Google, we receive the Account Data described above. Your profile picture is displayed in the app's Settings window and is loaded directly from Google's servers, which means Google receives your IP address when it loads.

How we process Inputs and Outputs

When you use an AI feature, the app sends your request over an encrypted HTTPS connection to our server, which verifies that you are signed in and within your usage limits, and then forwards only the content of the request to our AI provider, Google, through the Gemini API. Depending on the feature, a request may include your selected text, your instruction, earlier messages in the same conversation (up to the last 50 messages in AI Chat), the instruction of a prompt you are naming with AI, or a stored Input you choose to run again from History. The Output is returned to your device the same way.

We do not store Inputs or Outputs on our servers. Our server holds them in memory only for as long as it takes to generate a response, typically a few seconds, and does not write them to a database, cache, or log. If a request is refused because it is too large or exceeds a usage limit, our logs record your user ID, but not the content of the request.

We use Google's paid Gemini API. Under Google's Gemini API Additional Terms of Service, Google does not use Inputs or Outputs to improve its products. Google retains them for up to 55 days to detect and prevent abuse and violations of its policies, and authorized Google personnel may review content that is flagged. We do not send Google your IP address, name, email address, or user ID with your requests.

We do not use your Inputs or Outputs to train AI models. Please do not submit passwords, payment card numbers, health records, or other highly sensitive information. The Services are not designed to process regulated data such as protected health information.

If you configure AI Chat to send what you type to a search engine, the app opens that search engine's website in your default browser with your query (up to 500 characters). The query goes directly to the search engine, not to us or our AI provider, and is subject to the search engine's privacy policy. We record only which search engine was used.

2. How Rithere Works on Your Device

Rithere operates inside other applications, which requires access to parts of your device that most applications do not use. This section explains that processing. Except as described in Section 1, the information described in this section stays on your device and is not sent to us.

• Reading selected text. When you press a Rithere shortcut or use the Action Dot, the app reads your selected text using Windows UI Automation or, where that is not available, by copying it on your behalf (simulating Ctrl+C). It inserts Outputs using simulated keystrokes.
• Clipboard. Before copying your selection, the app saves the current contents of your clipboard in memory and restores them afterward. The app marks its temporary clipboard entries so that Windows Clipboard History and cloud clipboard ignore them. Text you copy with Rithere's copy buttons, text restored by undo, and an Output left on the clipboard when pasting fails are ordinary clipboard entries, which Windows Clipboard History may retain if you have enabled it.
• Active application. To apply your App Lists, the app checks the program name of the application in the foreground.
• Keyboard and mouse input. The Action Dot uses a system-wide keyboard and mouse hook to detect when you select text. It checks only for selection-related input, such as the arrow keys, Shift, Ctrl+A, and mouse movement, and does not record, store, or transmit your keystrokes.
• Screen and microphone. The app does not capture screenshots or record your screen, and the current version does not access your microphone.
• Startup and updates. By default, the app launches when you sign in to Windows; you can turn this off in Settings. The app downloads and installs updates automatically.

The app stores the following data on your device, in %APPDATA%\rithere unless otherwise noted:

Uninstalling Rithere deletes the app's data folder. Signing out or uninstalling does not delete your account or the personal data associated with it. To delete your account, see Section 7.

3. How We Use Personal Data

We use personal data for the following purposes:

• To provide, maintain, and operate the Services, including authenticating you, generating Outputs, and syncing your settings across your devices;
• To deliver software updates;
• To enforce usage limits, and to detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service;
• To analyze how the Services are used and to improve them, for example by understanding which features and prompts are used and which applications users exclude;
• To communicate with you, including by sending our welcome email, responding to your requests, and notifying you of changes to the Services or our policies;
• To understand how visitors use our website, if you consent to analytics cookies; and
• To comply with legal obligations, enforce our terms, and protect the rights, privacy, safety, or property of our users, Rithere, or others.

We may aggregate or de-identify personal data so that it can no longer be used to identify you, and use that information for the purposes above. We do not use personal data for targeted advertising, and we do not sell personal data. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. The only automated decision the Services make is pausing AI requests when you reach a usage limit, which resets automatically.

4. How We Disclose Personal Data

We disclose personal data only in the following circumstances:

• Service providers. We use service providers to operate the Services. They process personal data on our behalf, only as needed to provide their services to us:
  • Supabase provides authentication, database hosting, and server functions, including the server that relays AI requests and our email tracking. Our database is hosted in the United States (Amazon Web Services, us-east-1 region).
  • Google provides sign-in (Google Sign-In), AI processing (Gemini API), profile picture hosting, our support inbox (Gmail), and website analytics (Google Analytics, only with your consent).
  • Cloudflare hosts rithere.com, our sign-in page at auth.rithere.com, our download and update server at download.rithere.com, and our internal administration dashboard, and provides our domain name services.
  • Resend delivers our emails. It receives your email address, name, user ID (as a technical reference), and the content of the email.
• Business transfers. If we are involved in a merger, acquisition, reorganization (including the incorporation of Rithere as a company), sale of assets, or similar transaction, personal data may be transferred to the successor as part of that transaction. We will notify you before your personal data becomes subject to a different privacy policy.
• Legal requirements. We may disclose personal data to government authorities or other third parties if required by law, or if we believe in good faith that disclosure is necessary to comply with a legal obligation; to protect the rights, property, or safety of our users, Rithere, or others; or to detect, prevent, or address fraud, security, or technical issues.
• With your consent or at your direction, such as when you open a link or send a query to a search engine from the app.

Access by Rithere personnel

Our database applies row-level security, so each account's data can be read only through that account and other users cannot access it. Rithere's operator, currently Arshit Vaghasiya, can access account data, including Account Data, Prompts and Settings, Settings History, App Lists, Usage Information, Feedback, and Email Interaction Information, through an internal administration dashboard protected by a password and two-factor authentication, and through our database provider's console. We access this data only for the purposes described in Section 3, such as responding to a support request, investigating abuse, or understanding how features are used, and may export it for those purposes. Any future personnel will be bound by confidentiality obligations and given access only as needed for their role. Because we do not store Inputs or Outputs, they are not available to us.

5. Cookies and Similar Technologies

This section describes the cookies and similar technologies used on rithere.com and in our emails. The Rithere app does not use cookies to track you and does not use Google Analytics.

Cookie consent

On your first visit to rithere.com, a banner asks whether you allow analytics cookies.

• If you select Accept all, we load Google Analytics, which sets the _ga and _ga_Y4ZLHJ008Z cookies. These cookies expire two years after your last visit. Google Analytics receives information about your visit, including the pages you view, the referring page, your browser and device type, and your IP address, which it uses to derive an approximate location and does not store. We retain Google Analytics data for no more than 14 months, review it only in aggregate, and do not use it for advertising.
• If you select Reject, Google Analytics is not loaded and no analytics cookies are set.

We store your choice in your browser's local storage under the key rithere-cookie-consent; it is never sent to us. You can change your choice at any time using Cookie settings at the bottom of every page. Choosing Reject deletes the Google Analytics cookies and stops any further collection. Because Google Analytics loads only after you opt in, no browser signal such as Do Not Track or Global Privacy Control is needed to keep it disabled.

Other technologies on our website

Our hosting provider, Cloudflare, adds a script that protects email addresses on our pages from automated harvesting, and may instruct your browser to report pages that fail to load (Network Error Logging). Neither sets cookies. If Cloudflare detects unusual traffic, it may set a strictly necessary security cookie, such as __cf_bm, which is not used for tracking. We do not set any other cookies.

Emails

When you create an account, we send you a one-time welcome email about getting started. This is a service message about your account, not a marketing email. To understand whether it is useful, the email contains:

• A tracking pixel, a small invisible image that records the date and time it is loaded. If your email client blocks images, no open is recorded. Some email clients, such as Apple Mail, load images automatically, so an open may be recorded even if you have not read the email.
• Tracked links, which pass through our server before taking you to the destination page, so that we can record which link you clicked and when.

These records are associated with your user ID. We do not store your IP address or device information with them, although our server's request logs retain the IP address of each request for one day. We use these records only to improve our emails, never for advertising, and delete them when your account is deleted. The email itself discloses this tracking. To prevent it, turn off automatic image loading in your email client and visit rithere.com directly rather than through the email's links. To delete existing records, contact us at contact.rithere@gmail.com.

We do not send marketing emails. If we do so in the future, we will obtain your consent where required by law, and every marketing email will include a way to unsubscribe.

6. Data Retention

We retain personal data only for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy, or as required or permitted by law. Because your account data is what allows your setup to follow you between devices, we retain it for as long as your account exists. The table below describes how long we retain each category of personal data.

When you request deletion of your account, we will delete your account and associated personal data within 30 days of confirming your request. Residual copies may remain in our service providers' routine backups, if any, until they are overwritten in the normal course, and copies retained by Google under the Gemini API terms are deleted on Google's 55-day schedule. We may retain limited personal data for longer where required by law, or where necessary to resolve disputes, prevent abuse, or enforce our agreements, and only for as long as that need exists. We may retain aggregated or de-identified information that can no longer identify you.

We do not currently delete inactive accounts automatically. If we begin to do so, we will notify you by email before your account is deleted. For data stored on your device, see Section 2.

7. Your Rights and Choices

Depending on where you live, and subject to applicable law, you may have the rights listed below. We extend these rights to all users, regardless of location:

• Access: to know whether we process your personal data and to obtain a copy of it.
• Correction: to update or correct inaccurate or incomplete personal data.
• Deletion: to request that we delete your account and personal data.
• Portability: to receive your Prompts and Settings in a structured, machine-readable format (JSON).
• Objection and restriction: to object to, or ask us to restrict, processing based on our legitimate interests, such as product analytics.
• Withdrawal of consent: to withdraw your consent to website analytics at any time, using Cookie settings at the bottom of every page. Withdrawing consent does not affect processing that took place before you withdrew it.

How to exercise your rights

To make a request, email contact.rithere@gmail.com from the email address associated with your Rithere account, with “Privacy request” in the subject line. We may need to verify your identity before fulfilling your request. We will respond within 30 days or, where permitted by law, notify you within that period that we need more time and why. We do not charge a fee unless a request is manifestly unfounded or excessive. Where permitted by law, you may designate an authorized agent to make a request on your behalf, and we may require proof of the agent's authority.

Deleting your account

The app does not currently offer an in-app option to delete your account. To delete your account, email us from the email address associated with it. After confirming your request, we will delete your account and associated personal data within 30 days, as described in Section 6. To remove the data stored on your device, uninstall Rithere.

Other choices

You can clear your local history in Settings → History, sign out, exclude applications in which Rithere should not operate, turn off the Action Dot, stop Rithere from launching when Windows starts, or uninstall Rithere at any time. You can block images in your email client to prevent email open tracking.

We will not discriminate against you for exercising your rights. If you are not satisfied with our response, you may lodge a complaint with your local data protection authority, as described in Section 14.

8. International Data Transfers

Rithere is operated from Canada, and our database and server functions are hosted in the United States. Our service providers may process personal data in the United States and in other countries where they or their subprocessors operate. These countries may have data protection laws that differ from those of your country, and personal data processed there may be accessible to the courts, law enforcement, and national security authorities of those countries.

Where required by applicable law, such as for transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards provided in our service providers' data processing terms, such as the European Commission's Standard Contractual Clauses, or on a provider's certification under the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework.

9. Security

We implement technical and organizational measures designed to protect personal data against loss, misuse, and unauthorized access, disclosure, alteration, and destruction. These include:

• encryption in transit using HTTPS for communications between the app, our website, our servers, and our service providers;
• row-level security in our database, which restricts each account's data to that account;
• keeping the credentials for our AI provider and administrative systems on our servers, never in the app;
• encrypting sign-in tokens on your device using Windows' built-in data protection;
• password and two-factor authentication on our administration dashboard; and
• data minimization, including not storing Inputs or Outputs.

No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. You can help protect your account by securing your Google account, for example with 2-Step Verification, and the devices on which you use Rithere.

If a breach of security safeguards involving your personal data creates a real risk of significant harm to you, we will notify you and the relevant authorities, including the Office of the Privacy Commissioner of Canada, as required by applicable law.

10. Children

The Services are not directed to children under 13, and we do not knowingly collect personal data from children under 13. Users between 13 and the age of majority in their jurisdiction (18 in most places), or below a higher age of digital consent that applies where they live (such as 16 in some European Union member states, or 18 in India), may use the Services only with the consent and supervision of a parent or legal guardian. If you believe a child has provided us with personal data without the required consent, please contact us and we will delete it.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. If we make material changes, such as collecting new categories of personal data or using personal data for new purposes, we will provide at least 14 days' notice before the changes take effect by posting a notice on our website and in the app, or by email. Where required by law, we will obtain your consent. Previous versions of this Privacy Policy are available on request.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise your rights, please contact our Privacy Officer, who also serves as our Grievance Officer:

Arshit Vaghasiya, Privacy Officer
Rithere
Toronto, Ontario, Canada
contact.rithere@gmail.com

A mailing address is available on request.

13. Legal Bases for Processing

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases to process your personal data:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and you may object to the processing as described in Section 7. Providing Account Data is necessary to use the Services; without it, we cannot provide the Services to you.

14. Regional Supplemental Disclosures

Residents of Canada

We handle personal data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Our Privacy Officer, identified in Section 12, is accountable for our compliance. If you are not satisfied with our response to a privacy concern, you may file a complaint with the Office of the Privacy Commissioner of Canada. For residents of Quebec, our Privacy Officer is the person in charge of the protection of personal information, and you may also contact the Commission d’accès à l’information du Québec.

Residents of the European Economic Area, the United Kingdom, and Switzerland

Rithere is the controller of your personal data. Under the EU General Data Protection Regulation, the UK General Data Protection Regulation, and the Swiss Federal Act on Data Protection, you have the rights described in Section 7, as well as the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you. You may lodge a complaint with the supervisory authority in the country where you live or work, or where you believe an infringement occurred.

Residents of the United States

If you live in California, Colorado, Connecticut, Virginia, or another state with a comprehensive consumer privacy law, the following disclosures apply to you. In the past 12 months, we have collected the following categories of personal information:

• Identifiers, such as your name, email address, user ID, IP address, and installation identifier;
• Internet or other electronic network activity information, such as Usage Information, Log and Technical Information, and, with your consent, website analytics data; and
• Content you provide, such as Prompts and Settings, App Lists, Feedback, and Communication Information.

We collect this information from you, from your device, and from Google Sign-In, for the purposes described in Section 3, and we disclose it for business purposes only to the service providers described in Section 4. We have not sold personal information or shared it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit its use. You have the right to know, access, correct, and delete your personal information, and not to receive discriminatory treatment for exercising these rights. If we decline your request, you may appeal by replying to our decision, and we will respond to your appeal within the period required by law.

Residents of India

Under the Digital Personal Data Protection Act, 2023, you have the right to obtain a summary of the personal data we process and our processing activities, to have your personal data corrected, completed, updated, or erased, to grievance redressal, and to nominate another individual to exercise your rights in the event of your death or incapacity. Our Grievance Officer is identified in Section 12, and we will respond within the period required by law. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

Residents of other jurisdictions

If you live elsewhere, including in Brazil (under the Lei Geral de Proteção de Dados) or Australia (under the Privacy Act 1988), you have the rights provided by your local law. We will honor those rights; please contact us to exercise them.