r1o Privacy Policy

Effective Date: June 22, 2026 Last Updated: June 22, 2026

Fibonacci Consulting & Advisory Group LLC d/b/a r1o ("r1o," "we," "us") operates the r1o private AI platform, including the iOS app, desktop application, web dashboard, and embedding API (collectively, the "Services").

1. Our Core Principle

Your data stays on your devices. r1o is designed for private AI — your prompts, conversations, and model interactions are processed on your hardware, not our servers. We do not train models on your data.

2. Data We Collect

2.1 Account Information

When you create an account: email address, name, and authentication credentials (via Apple Sign-In, Google, or email). Stored in Supabase (our auth provider).

2.2 Usage Telemetry (Opt-In for Beta)

During the beta period, with your consent, we collect anonymous performance telemetry:

• Token throughput (tokens/second)
• Model load times
• Memory pressure events
• Crash reports and error logs
• Session duration and feature usage

This telemetry does NOT include: your prompts, conversations, model outputs, documents, or any content you process through the Services.

2.3 Embedding API Usage

When you use the metered embedding API:

• Number of embedding requests and credit consumption
• Embedding type (flat/enriched/serpentine) and dimensions
• Timestamp and response latency

We do NOT store the text you submit for embedding or the resulting vectors beyond the time needed to process the request.

2.4 Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers. We receive: subscription tier, billing period, and payment status.

3. How We Use Your Data

• Account management: Authentication, subscription management, support
• Service improvement: Aggregate usage statistics to improve performance and reliability
• Security: Fraud detection, abuse prevention, forensic monitoring per our Terms of Service
• Communication: Service updates, security notices, billing

4. Data We Do NOT Collect

• Your prompts or conversations with AI models
• Your documents or files processed locally
• Model weights or configurations on your devices
• Network traffic content between your devices
• Keystroke or screen content data

5. Telemetry Opt-Out

After the beta period, you may opt out of performance telemetry at any time via:

• iOS: Settings → Privacy → Telemetry → Off
• Desktop: Preferences → Privacy → Telemetry → Off
• API: Include "telemetry": false in request headers

Opting out does not affect service functionality.

6. Data Sharing

We do not sell your data. We share data only:

• With service providers: Supabase (auth), Stripe (billing), Vercel (hosting) — under data processing agreements
• For legal compliance: When required by law, court order, or to protect our rights
• With your consent: When you explicitly authorize sharing

7. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Telemetry: Aggregated data retained for 12 months. Raw telemetry deleted after 90 days.
• Embedding API logs: Request metadata retained for 30 days. Submitted text and vectors are not retained after processing.

8. Security

We protect your data with:

• AES-256-GCM encryption for sensitive data at rest
• TLS 1.3 for data in transit
• Supabase Row Level Security for database access
• No plaintext storage of credentials or API keys

9. Your Rights

You have the right to:

• Access your data
• Delete your account and associated data
• Export your data in a portable format
• Opt out of telemetry collection

Contact privacy@r1o.ai to exercise these rights.

10. California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

Categories of personal information collected: Identifiers (email, name); commercial information (subscription tier, usage); internet activity (telemetry, API request metadata).

Categories sold or shared: None. We do not sell or share personal information.

Right to know: You may request the categories and specific pieces of personal information we collected about you in the past 12 months.

Right to delete: You may request deletion of your personal information, subject to legal exceptions.

Right to opt out of sale: Not applicable — we do not sell personal information.

Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

Verifiable consumer requests: Submit requests to privacy@r1o.ai. We will verify your identity and respond within 45 days (extendable by 45 days with notice).

Authorized agents: You may designate an agent with written authorization.

11. European Residents (GDPR)

If you are in the European Economic Area, UK, or Switzerland:

Lawful basis for processing:

• Account data: Performance of contract (Art. 6(1)(b))
• Telemetry: Legitimate interest (Art. 6(1)(f)) or consent (Art. 6(1)(a)) where required
• Embedding API logs: Performance of contract
• Security monitoring: Legitimate interest

Your rights: Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restrict processing (Art. 18), data portability (Art. 20), object to processing (Art. 21), withdraw consent (Art. 7(3)).

Data Protection Officer: Contact privacy@r1o.ai.

Supervisory authority: You have the right to lodge a complaint with your local data protection authority.

International transfers: Data may be processed in the United States. We rely on Standard Contractual Clauses (SCCs) for transfers outside the EEA.

Data retention: See Section 7 above for retention periods per data category.

12. Children

The Services are not directed to children under 13. We do not knowingly collect data from children.

11. Changes

We will notify you of material changes to this policy via email or in-app notification.

12. Contact

Privacy inquiries: privacy@r1o.ai General: legal@r1o.ai