Privacy Policy
Last updated October 13, 2026
What we store
River stores the account information you sign up with (email address, or your Google account details if you sign in with Google) and the data you enter into your CRM — contacts, companies, notes, tags, logged conversations, and follow-up tasks. Some of this data is about other people (alumni, recruiters, and other contacts you're networking with), not just you.
Email integrations
If you connect Gmail, River can read messages from that account, limited to the read permissions you grant during that connection and the sync or search actions you take in the app. River does not send email through the connected-account APIs; drafting outreach opens your email client so you can review and send the message yourself. You can disconnect an inbox at any time from Settings. We do not read your inbox in the background beyond what's needed to fulfil a sync or search you request.
Google user data
River's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Gmail and Google Calendar is used only to show your messages and events in River and to update your contacts and follow-ups. It is never sold, never used for advertising, and never used to train AI or machine learning models. No person reads it unless you ask us to (for example, for support), it is needed for security or to comply with the law, or it has been aggregated and anonymized for running River.
How your data is protected
Your CRM data is stored per-account with row-level access controls, so only your signed-in account can read or write your contacts, notes, and tasks. Credentials for connected inboxes are stored encrypted and are not directly readable through the application's normal data access paths.
Data sharing
We do not sell your data or the data of the contacts you track. We do not share your CRM contents with third parties except the service providers necessary to run River, and only to the extent needed to provide the product:
- Supabase — our database and sign-in provider.
- Vercel — hosts the app.
- Sentry — receives error reports so we can fix bugs, without personal information.
- OpenAI — receives company names only, to guess where a firm is headquartered.
- Google — only if you connect Gmail or Google Calendar, and only with read-only access.
Your choices
You can edit or delete any contact, conversation, or task at any time from within the app, export all of your data from Settings → Data, and disconnect any connected inbox. To delete your account, go to Settings → Account and use Delete account; your contacts, companies, history, applications, tasks, templates, and connected inboxes are permanently removed right away.
Contact
Questions about this policy or your data? Contact: rivierm@mcmaster.ca