Privacy Policy
Effective date: October 1, 2026
Last updated: October 1, 2026
Company: Flamebrain Technologies
Product: QuietRiver
1. Who We Are
QuietRiver is operated by Flamebrain Technologies ("we", "us", "our"). We provide a personal time, focus, and attention tracking application.
For privacy inquiries, contact us at: privacy@quietriver.app
2. What QuietRiver Tracks - And What It Does Not
QuietRiver is a personal time management and self-tracking tool.
QuietRiver only collects data that you choose to enter into the app, including:
- Timers you start and stop
- Tasks and focus blocks you create
- Notes you choose to enter
- Focus scores
- Accomplishments you log
- Feelings entries you record
QuietRiver does not and will never:
- Monitor websites you visit
- Record keystrokes or clipboard content
- Take screenshots or screen recordings
- Track the applications you use
- Access your files, messages, or communications
- Monitor your location
- Collect biometric data
You choose what to track. We reveal patterns. We don’t spy.
3. Data We Collect and Why
3.1 Account Data
When you create an account, we collect your email address and any display name you choose to provide. We use this to identify your account, send you transactional messages (such as password resets and billing notifications), and provide support.
3.2 App Data (What You Enter)
We store the focus, task, and timer data you enter into QuietRiver. This data is used to provide the core features of the app, including your dashboard, history views, and any summary or insight features.
3.3 Subscription and Billing Data
If you subscribe to a paid plan, we store your subscription status, plan details, and a reference to your account in Stripe (our payment processor). We do not store your payment card details. All payment information is handled directly by Stripe.
3.4 Technical and Usage Data
We may collect standard technical information such as your IP address, browser type, and device type. This is used for security, bug tracking, and product improvement. We may also collect pseudonymized product analytics events (such as which features are used), identified by an internal user ID, to help us improve the app. These events do not include your IP address.
4. How We Use Your Data
We use your personal data to:
- Provide and operate the QuietRiver service
- Maintain and secure your account
- Process subscription payments and billing
- Send transactional emails (account confirmation, password reset, billing receipts)
- Provide customer support
- Fix bugs and improve the product
- Generate summaries or insights within your account only
- Comply with legal obligations
We do not:
- Sell your personal data to third parties
- Use your task data, or personal reflections for advertising
- Use your data to profile you for marketing purposes
- Share your personal data with third parties, or other users
5. Legal Basis for Processing
| Processing activity | Lawful basis |
|---|---|
| Providing the app and storing your data | Performance of contract |
| Processing payments | Performance of contract |
| Sending transactional emails | Performance of contract / Legitimate interests |
| Security and fraud prevention | Legitimate interests |
| Analytics and product improvement | Legitimate interests (using pseudonymized/aggregated data where possible) |
| Compliance with legal obligations | Legal obligation |
6. Third Parties Who Receive Your Data
We use the following third-party service providers to operate QuietRiver. Each processes personal data on our behalf, only as needed to perform its role.
| Provider | Role | Data shared | Location | Privacy policy |
|---|---|---|---|---|
| Supabase | Database hosting and authentication | Account data and all app data (tasks, timers, focus blocks, feelings, diary entries) | Canada (ca-central-1) | supabase.com/privacy |
| Vercel | Application hosting and CDN | Request logs, IP addresses, browser metadata | Canada (Montréal) for application servers; global edge network for content delivery | vercel.com/legal/privacy-policy |
| Stripe | Payment processing and subscription management | Email address, subscription details, billing history | US (global) | stripe.com/privacy |
| Brevo | Transactional email delivery (account confirmation, password reset, billing) | Email address, name | EU (France) | brevo.com/legal/privacypolicy |
| PostHog | Product analytics | Pseudonymous usage events, internal user ID, account ID; no IP addresses and no session recordings | EU | posthog.com/privacy |
We will update this list when we add or remove a service provider.
We do not sell, rent, or share your personal data with any other third party.
7. Data Retention
We retain your personal data for as long as your account is active. When you delete your account:
- Your app data (tasks, timers, diary entries, focus data) is deleted from our active database within 30 days of a verified deletion request.
- Your email address may be retained in backup systems for a short period before being purged.
- Billing records (held by Stripe) are retained for as long as required by law (typically 7 years).
- Support correspondence may be retained for up to 2 years after last contact.
See our Data Retention & Deletion Policy for full details.
8. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access - request a copy of the personal data we hold about you
- Correction - request correction of inaccurate data
- Deletion - request deletion of your data ("right to be forgotten")
- Portability - request your data in a portable format
- Restriction - request we restrict processing of your data
- Objection - object to processing based on legitimate interests
- Withdraw consent - where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us at: privacy@quietriver.app
You can delete your account at any time by submitting a support request within the application.
If you are in Canada, our privacy practices are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). To submit a complaint, contact the Office of the Privacy Commissioner of Canada: priv.gc.ca
If you are in the UK, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk
If you are in the EU, you have the right to lodge a complaint with your local supervisory authority.
9. Cookies and Tracking Technologies
QuietRiver uses cookies and similar technologies to operate the app and maintain your logged-in session. See our Cookie Policy for details.
10. Data Security
We take the security of your data seriously. Measures include:
- All data in transit is encrypted using TLS/HTTPS
- Database access is protected by row-level security so each user can only access their own data
- Authentication is managed by Supabase Auth
- Payment details are never stored by QuietRiver - all payment processing is handled by Stripe
See our Security Overview for more detail.
11. International Data Transfers
Flamebrain Technologies is based in Manitoba, Canada. To operate QuietRiver, we transfer personal data to third-party service providers whose infrastructure is located outside Canada (including the US and EU). We ensure that all such transfers are made with appropriate contractual safeguards in place. For users in the UK or EEA, where required we rely on Standard Contractual Clauses or UK International Data Transfer Agreements.
12. Children
QuietRiver is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by a notice in the app. The “Last updated” date at the top of this page reflects when this policy was last revised.
14. Contact Us
For any privacy-related questions or to exercise your rights:
Email: privacy@quietriver.app