Privacy policy

Effective August 2, 2026 · Applies to the Rovyn app and the hosted Rovyn service (rovyn.app)

The short version. Rovyn stores the playlists your assistant sends you, how far you got through them, and the feedback you chose to give. Your assistant gets summarized listening receipts and your feedback in your own words — never your raw playback history, and never the other assistants you've connected or what you granted them. There are no analytics, no trackers, no ads, and no data sales. Deleting your account deletes your data — actually deletes it.

What Rovyn stores

• Your editions (playlists). The recommendations your assistant created, each episode's one-line rationale, and the goal ("brief") the assistant stated when it made the playlist. Briefs marked as temporary interests are purged automatically when the playlist is finished.
• Playback events and progress. The app records playback events (started, paused, completed, skipped) and your resume position. These raw events are server-internal: no assistant and no third party can read them. They exist only to build the summarized receipts below, and are deleted with your account.
• Listening receipts. A per-episode summary: outcome, rough progress, time spent, and any feedback you gave. Receipts carry no timestamps-of-day and no device identity.
• Your feedback, verbatim. Notes you write are stored exactly as typed. Rovyn never summarizes, classifies, sentiment-scores, or auto-tags them. What you can read back in the app is precisely what Rovyn hands an assistant you authorized.
• Your feeds. RSS feeds you added and podcast catalog metadata (shows and episodes — this is public data, not yours).
• One email address. Rovyn is signed in by design — you use it with your Apple or Google account, or, when you connect an assistant from a browser, with an email address and a password (all three via Firebase Auth). Rovyn stores an opaque account identifier, which method you used, and the email address. The email exists for one purpose: manual account recovery when you write to support. It appears nowhere in the app, is never used for outbound mail, never shared, and is deleted with your account. Rovyn does not store your name or photo, even though sign-in providers offer them.

What Rovyn sends your assistant

Each assistant you connect (Claude, ChatGPT, and so on) is a separate connection with its own permissions, which you can revoke independently at any time.

• Assistants receive summarized receipts, never raw playback history. There is no interface through which an assistant can read raw events — the limitation is structural, not a setting.
• Your written feedback goes, word for word, to assistants you granted permission to read receipts — and to no one else.
• A connection cannot see that other assistants exist, or what permissions they have.
• Rovyn does not ask for your assistant's memory or your conversation history, and has nowhere to put them. The one thing that crosses the boundary inbound is the brief the assistant states when it builds a playlist — a goal, the time you have, a level, and preferences. That schema has no history field, and anything else attached to it is stripped when it arrives rather than stored. What your assistant chooses to write into those fields is its own doing; the brief is shown to you on the playlist it produced.

How signing in works, and what it discloses

Every sign-in method contacts Google's Firebase servers. If you sign in with Apple or Google, that provider additionally learns that your identity signed in to Rovyn — that is the whole disclosure. Rovyn sends the identity providers nothing else: no goals, no briefs, no listening behavior, no feedback, no library contents. Firebase Analytics is deliberately not integrated. Firebase itself holds your account record (identifier, sign-in method, email) because it must, to authenticate you.

If you use the email-and-password option on the page that appears when you connect an assistant, your password goes from your browser straight to Firebase. The Rovyn server never receives it, never stores it, and cannot read it; what reaches Rovyn is the same verified token the other two methods produce.

What podcast publishers see

Rovyn streams audio directly from publishers' servers, like any podcast app. Publishers see ordinary CDN logs — IP address, user agent, byte ranges. Rovyn sends them nothing else: no goals, no briefs, no feedback, no identity.

What Rovyn will not do

• No sale of your data, and no use of your consumption data for model training — ever, without separate explicit consent (and there is currently no consent surface, therefore no such use).
• No server-side inference: no recommendation engine, no taste profiling, no embeddings of your behavior. There is no inferred profile anywhere in the system to leak, inspect, or delete.
• No analytics or telemetry, and no third-party trackers in the app or the server. This website sets no cookies.
• No ads, no monetization of attention.

Deletion deletes

Deleting your account removes every row of your data — editions, briefs, playback events, progress, receipts, feedback, connections, and the identity record with its email — in one transaction. Every assistant token dies with it. There is no soft-delete, no tombstone, and no "anonymized" aggregate kept behind. Only shared public catalog data (shows and episodes) survives, because it was never yours. The app then deletes the Firebase user, which removes the account on Google's side.

Self-hosting

Rovyn implements Cueback, an open protocol, and the backend is a single service designed to be run by anyone. A self-hosted Rovyn has the identical privacy properties by construction — nothing above depends on us behaving well.

Changes and contact

If this policy changes, the date at the top changes, and material changes will be called out plainly on this page. Questions: support@polimati.com.