Privacy policy

In short

• Your memories stay on your phone. Ritorno has no account and no server, and the app doesn’t send what you log to us or to anyone else.
• No tracking. There are no analytics, ads or crash-reporting tools, in the app or on this website, and no cookies.
• We only see what you send us yourself, such as an email.

Who is responsible

Ritorno is made and run by Gabriele Ardizzone in Switzerland, who is responsible for the processing described here. That’s the “controller” under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). For any question about your data, write to hello@ritorno.life. The full contact details are in the legal notice.

The Ritorno app

What stays on your phone

Everything you enter in Ritorno is stored only in the app’s private storage on your phone. That includes:

• your moments and how much they resonated, with their categories, tags, cost and planning;
• chapters, such as trips;
• revisits and monthly reflections;
• your settings.

The app’s calculations, such as the Memory Mosaic and the monthly calibration, also run only on your phone. Some of what you log may be personal, which is why none of it passes through us. We have no copy of it and no way to see it.

The app itself doesn’t connect to the internet. It only opens this website in your browser when you tap Privacy policy or Support in Settings. It doesn’t ask for access to your contacts, location, photos, camera or microphone.

Exports

When you export your data (Settings › Export my data), Ritorno makes a file with everything you’ve logged, apart from moments you’ve deleted, and opens your phone’s share sheet. You decide where the file goes, for example a folder on your phone, a cloud drive or an email to yourself. From then on, whoever stores or receives the file handles it under their own terms, so keep it somewhere safe.

To bring an export back, for example on a new phone, choose it in Settings › Restore from backup. Ritorno reads the file on your phone, adds what isn’t there yet, keeps what is, and never brings back moments you’ve deleted.

Your phone’s backups

If your phone backs up its apps, for example with iCloud Backup or Google’s backup, Ritorno’s data can be included. Those backups belong to your Apple or Google account and are handled under their privacy policies. We have no access to them.

Deleting your data

Your data is only on your phone, so you’re in control of it. When you delete a moment, it waits in Settings › Recently deleted for 30 days, and you can restore it from there. After that, Ritorno erases it for good the next time you open the app, and overwrites it in its database so nothing can bring it back. Delete now erases it straight away. All that stays behind is a technical note with an internal id and when it was deleted, and nothing about what it was. Exports leave deleted moments out. Backups of your phone made before a moment was erased can still contain it until they’re replaced.

Before an update changes how your data is stored, and before you restore a backup, Ritorno keeps a safety copy of it on your phone, outside your phone’s backups, for up to 30 days. A moment erased during that time stays in the copy until the copy is deleted, but Ritorno never brings it back from there. If an update fails, you can share the copy, as you would an export.

Removing Ritorno from your phone deletes everything the app stored there. Exports and backups you’ve made aren’t affected; delete them where you keep them.

Ritorno Plus

If you buy Ritorno Plus, Apple or Google handles the payment under its own privacy policy. The app only remembers, on your phone, that Plus is unlocked. From the stores we receive sales and tax reports, for example how many purchases were made in which country. We need these for accounting, and they say nothing about how you use Ritorno.

The app stores

You get Ritorno from the App Store or Google Play. Apple and Google process data about your download and your purchases under their own privacy policies (Apple, Google). They give us statistics, such as the number of downloads, that don’t identify you. If you’ve agreed on your phone to share diagnostics with app developers, they also give us crash reports. These hold technical details, such as the device model, the system version and the place in the app’s code where it crashed.

This website

This website sets no cookies, uses no analytics and loads nothing from other websites. Its fonts and images come from ritorno.life itself.

It’s hosted by Cloudflare, Inc. in the USA. To deliver the pages and protect them from attacks, Cloudflare processes technical data about each visit: your IP address, the page you request, the time, and your browser. Cloudflare does this on our behalf under a data processing agreement. We don’t keep or receive visitor logs. The legal basis is our legitimate interest in a website that works and is secure (Art. 6(1)(f) GDPR).

When you write to us

If you email us, we receive your email address, your message and anything you attach. We use them only to answer you and to follow up on your request. The legal basis is our legitimate interest in answering you, or, if your message is about a purchase, what’s needed to handle it (Art. 6(1)(f) and (b) GDPR).

Our mailbox is hosted by Apple (iCloud Mail). The service is provided by Apple Distribution International Ltd. in Ireland, and Apple may store messages with Apple Inc. in the USA.

Who receives data

• Cloudflare hosts this website.
• Apple hosts our mailbox.
• Apple and Google run the app stores, and each is responsible for its own processing.

We don’t sell data, and we don’t share it with anyone for advertising.

Data outside Switzerland

Cloudflare and Apple may process data in the USA and in other countries:

• Cloudflare is certified under the Swiss-U.S. and EU-U.S. Data Privacy Frameworks, which Switzerland and the EU recognise as giving adequate protection. Its data processing agreement also includes the European Commission’s standard contractual clauses.
• Apple relies on standard contractual clauses for transfers from Switzerland and the EU.

How long we keep data

• Emails: until your request is settled and we no longer need them to follow up, and no longer than two years after our last exchange. The exception is when the law requires us to keep them longer, for example as accounting records for a purchase.
• Store sales and tax reports: as long as accounting law requires, which in Switzerland is ten years.
• This website: we keep no visitor data. Cloudflare keeps technical data only as long as it needs to deliver and protect the site.

Security

Ritorno stores your data in the app’s private storage, which other apps can’t read, and your phone’s own encryption protects it when you use a passcode. Because Ritorno has no server, there’s no database of users that could leak. This website is served only over HTTPS.

Your rights

You can ask us:

• whether we process data about you, and for a copy of it;
• to correct it or delete it;
• to restrict or stop processing it;
• to receive it in a portable format.

Write to hello@ritorno.life, and we’ll answer within 30 days. We may ask you to confirm who you are.

For the data in the app, you don’t need us: it’s all on your phone, you can export it any time, and removing the app deletes it.

If you think we’re handling your data unlawfully, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU, to your country’s data protection authority.

Children

Ritorno collects no data from anyone, children included.

Changes to this policy

When something changes, we update this page and the date at the top. If a change affects what the app does with your data, the app will tell you before it takes effect.