Privacy Policy
Last updated: November 15, 2026
About this policy
River Witness is an offline-first educational iPhone app for people aged 16 and older. This policy describes version 1.0.0, including photographs, voice recordings, written observations, learning progress and the optional online legal pages. The service name and operator label used here is River Witness.
Information on your device
Your chapter answers, approximate place descriptions, conditions, reflections, in-progress records, confirmed photograph copies, audio recordings and progress are stored in the app’s private storage on your device. We do not operate a user account system or upload this journal to an app server. Your original words and user-selected media remain your own. The app does not request precise GPS location.
Camera, photo selection and microphone
Camera access is requested only when you choose to photograph a riverbank. The microphone is requested only when you choose to record a field statement. You can decline and use written observations instead. Import uses the system photo picker, which lets you choose individual images without granting general library access. Imported and captured images are re-encoded as JPEG copies. We do not infer water chemistry, safety, concentration or responsibility from images or voices. No speech transcription service is used in this version.
Network access and website hosting
Core learning, in-progress records and playback work offline. Opening Privacy, Terms or Support first requests a public HTML page hosted by Cloudflare; a bundled copy is available if loading fails. The hosting provider necessarily receives network information such as IP address, requested URL, request time and browser headers to deliver and protect the page, under its own policies. Your journal is not attached to these requests. See https://www.cloudflare.com/privacypolicy/ for the hosting provider’s practices. We do not add advertising, analytics SDKs, tracking cookies, accounts or cross-app tracking.
Exports, sharing and device backups
Export is always initiated by you. The export contains English field names and may include private photographs, voices, notes and approximate places. The iOS share sheet transfers data only to destinations you choose. Those destinations and your device or cloud backup provider apply their own policies. Local app data may be included in iOS device backups depending on your settings; we do not control or receive those backups. Exported copies and backups are not removed by deleting a journal record.
Retention, deletion and control
Records remain until you delete them or remove the app, subject to device backup behavior. Delete a record in Evidence to remove its linked media and text; Settings → Delete my data removes the local journal, media and progress. Settings → Export my data lets you obtain a readable JSON and media folder. You can revoke camera and microphone access in iOS Settings at any time. Remote retention of journal data is not applicable because no journal server exists. Cloudflare controls retention of its infrastructure records under its own policy.
Security and your rights
The app uses its private sandbox, atomic file writes and iOS data protection for stored content. No storage or transfer method is guaranteed absolutely secure. Avoid capturing private faces, addresses or exact private locations. Depending on where you live, you may have rights of access, correction, deletion, portability or complaint to a privacy authority. For device-only data, use the export, editing and deletion controls; we cannot remotely retrieve a journal we do not possess.
Age, changes and contact
This product is intended for ages 16 and over and does not target children under 16. If you believe a child has provided information through support, contact us. We update this page when our practices change, with a new effective date. Contact: riverwitness@support.com. This is a provisional support address; delivery is not yet verified. Do not send sensitive evidence until a working support channel is confirmed.