Privacy Policy
What we collect when you use riffly.com, how we use it, and the choices you have. Last updated September 13, 2026.
Information we collect
Account information. When you create an account, we collect a username, email address, and password. We never store your password itself — only a one-way cryptographic hash of it, which can’t be reversed back into your password. If you sign in with Google instead, Google shares your name, email address, and account ID with us; we don’t receive your Google password.
Order and shipping information. When you check out, Stripe (our payment processor) collects your card details, billing address, and shipping address directly — Riffly’s servers never see or store your card number. We store which items you ordered and your email address, so we can fulfil and reference the order.
Cart contents. Items you add to your cart are stored in your browser (localStorage), not on our servers, until you check out.
Technical information. We log IP addresses for security purposes — specifically, to detect and slow down repeated failed sign-in attempts. Standard web server logs, like most sites keep, may also record IP address, browser type, and pages visited.
reCAPTCHA. Creating an account requires passing a Google reCAPTCHA check to keep out bots. This sends some information, including your IP address and interactions with the page, to Google. See Google’s Privacy Policy for how they handle it.
How we use this information
- To create and secure your account, and keep you signed in
- To process and fulfil orders
- To detect and prevent fraud, abuse, and automated (bot) signups
- To respond to you if you contact us
We do not sell your information, and we do not use it for advertising or share it with data brokers.
Who we share it with
Only the services that make Riffly work:
- Stripe — to process payments. See Stripe’s Privacy Policy.
- Google — if you sign in with Google, or to run the reCAPTCHA check on signup. See Google’s Privacy Policy.
We don’t share your information with anyone else, except where required by law.
Cookies and local storage
Riffly uses one essential cookie (a session cookie) to keep you signed in — it’s required for the site to work and isn’t used for advertising or tracking across other sites. Your cart is kept in your browser’s local storage, not a cookie.
Your choices
- Access or delete your data: email hello@riffly.com and we’ll help.
- Google-linked accounts: you can disconnect Google’s access to your Riffly account at any time from your Google Account settings.
Children’s privacy
Riffly is not directed at children under 13, and we don’t knowingly collect information from them.
Changes to this policy
If this policy changes in a meaningful way, we’ll update the date above and, where appropriate, let you know.
Contact
Questions? Email hello@riffly.com.