Rivus — Privacy Policy Effective Date: June 3, 2026 Last Updated: June 3, 2026 Leo Rivus LLC ("Rivus," "we," "our," or "us"), a Texas limited liability company, operates the Rivus mobile application (the "App"), a fly-fishing conditions and advisory tool for iOS. This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the choices and rights you have. By downloading, installing, or using Rivus, you acknowledge that you have read and understood this Privacy Policy. Please read it alongside our Terms of Service at rivusapp.com/terms. The short version: Your precise GPS location is used on your device and never leaves it. We don't sell your data, show you ads, or track you across other apps or websites. We don't collect your payment card — Apple handles that. Eddy, our in-app advisor, uses a third-party AI service, and we ask your permission before any data is sent for AI processing. You can delete your account and personal data from inside the App at any time. 1. Information We Collect 1.1 Information you provide directly • Account information. When you create an account, your email address and a password. You may instead use Sign in with Apple, in which case Apple may share either your real email or a private-relay address (@privaterelay.appleid.com); Rivus receives and stores only whichever Apple provides. • Profile and preferences. Rivers you save, your home water, notification preferences, your angler/experience settings, and the personalization that improves Eddy. • Trip logs. River, date, conditions, catch details, notes, and any photographs you add to a log entry. Trip-log entries (including their photos and notes) are stored on your device, not on our servers. (See Section 5 for the separate, optional, anonymous community sharing of trip outcomes.) • Condition observations. Water clarity, temperature, and notes you voluntarily submit. • Photographs for identification (Rivus Pro). Photos you submit to Eddy to identify an insect, fly, or stretch of water. See Section 3. • Feedback and communications. Eddy feedback (e.g., thumbs up/down and any text you add), corrections you submit, and messages you send to support. • Subscription status. Your subscription tier, product, and status, synced from the Apple App Store through RevenueCat. We never collect or store your payment card information — Apple processes all payments. 1.2 Information collected automatically • Location data. With your permission, your device's GPS provides coordinates that the App uses to find the nearest river and gauge. Your precise GPS coordinates are processed only on your device and are never transmitted to us or to any third party — we store only the river and gauge identifier you end up viewing. We do not track your location in the background. When you view a map, Mapbox receives the coarse coordinates of the map area ("viewport") in order to render map tiles; this is an approximate area, not your precise position (see Section 4). • Device identifier for abuse prevention. A random identifier generated on your device (not linked to your account) is used to enforce usage limits and prevent abuse of the Eddy service. • Diagnostic and crash data. When the App encounters an error or crash, our diagnostics provider, Sentry, collects technical information — device type, operating system and App version, error logs, and performance traces — to help us find and fix problems. These reports do not include your account identity or screenshots of your screen. • Usage and search data. When the "Help Eddy learn" setting is on (it's on by default; you can switch it off in Settings at any time), we log product-interaction events and your in-app searches and Eddy questions to improve coverage and recommendations. If you switch it off, this logging stops. 1.3 The Eddy advisor and AI See Section 3 for exactly what is and isn't sent for AI processing, and when. 1.4 Information from public third-party sources To power the App we pull publicly available data that is not about you: river flow and water-temperature data from the U.S. Geological Survey (USGS); weather observations and forecasts from the National Weather Service (NWS); aquatic-insect occurrence data from the Global Biodiversity Information Facility (GBIF); and stocking reports, regulations references, and water classifications from state fish & wildlife agencies. 1.5 What we do not collect We do not collect your name (beyond what you choose to put in an email or message), phone number, physical address, payment card, contacts, browsing history outside the App, health or fitness data, or any advertising identifier. We do not use an advertising SDK, the iOS Advertising Identifier (IDFA), or App Tracking Transparency, because we do not track you (as Apple defines that term) and do not show third-party ads. 2. How We Use Your Information We use your information to: • operate and provide the App (conditions, hatch predictions, fly recommendations, the Eddy advisor, trip logs, access info); • personalize your experience and improve Eddy's relevance to you; • improve our predictions and recommendations using aggregated and de-identified patterns; • process and verify your subscription through Apple and RevenueCat; • send you service-related messages (account, security, subscription, and important updates); • diagnose, debug, and fix technical problems and prevent abuse of the service; • enforce our Terms and protect the rights, property, and safety of Rivus, our users, and the public; and • comply with our legal obligations. We do not sell your personal information, we do not "share" it for cross-context behavioral advertising, and we do not use it for targeted advertising. We do not use your personal information to make legal, financial, or other decisions that produce legal or similarly significant effects about you. 3. The Eddy Advisor and Third-Party AI Processing Eddy is an artificial-intelligence advisor built into the App. It is an AI system, not a human, and its guidance can be inaccurate, incomplete, or out of date — always verify regulations and conditions yourself (see the Terms of Service). Eddy is powered by a third-party AI service, currently Anthropic's Claude API. Free vs. Pro: Eddy's live, AI-generated answers are part of Rivus Pro. On the free tier, Eddy answers from data already on your device, and your questions are not sent to the AI provider. (Whether your questions are logged to our servers to improve the App is governed by the "Help Eddy learn" setting in Section 1.2.) 3.1 What is transmitted for AI processing. When you use Eddy's AI features, we send to the AI provider: your message text; the river, stretch, and gauge you've selected (not your precise GPS coordinates); current conditions (such as streamflow and water temperature) and weather; and your Eddy personalization preferences. For Rivus Pro, this may also include cached fishing-report context for that river and any photograph you submit for identification (insect, fly, or water). Photographs submitted for identification are sent to the AI provider for analysis and are not stored by Rivus. 3.2 How the provider handles it. We access the AI service under a commercial API agreement. Under Anthropic's Commercial Terms, customer inputs and outputs are not used to train its models, and are retained only for a limited period (Anthropic describes a default of up to 30 days) for safety and abuse-monitoring purposes. The provider's own practices are described at anthropic.com/legal/privacy. If we change AI providers, or those terms change materially, we will update this Policy. 3.3 Your consent. Before Eddy sends any data off your device for AI processing, the App asks for your consent (a one-time prompt that links to this Policy). You can change that choice at any time in Settings → Eddy Privacy. If you decline, Eddy's AI features are turned off and no data is sent for AI processing. 3.4 What we retain. We keep your Eddy personalization in your profile to improve your experience. We do not permanently store full conversation transcripts on our servers. Limited metadata and, where you've consented, your question text may be retained to improve the App (Section 1.2). 4. How We Share Information We do not sell your personal information. We share it only with service providers ("processors") that process it on our behalf under contractual confidentiality and data-protection obligations, and only as needed to run the App: • Supabase — Database hosting and authentication. Receives: account, profile, subscription, and consented usage data. • Anthropic — AI processing for Eddy (incl. Pro photo identification). Receives: the data described in Section 3.1 — never your precise GPS. • RevenueCat — Subscription management. Receives: your account identifier and subscription status. • Apple — App Store distribution and payment processing. Receives: purchase and subscription data; we never see your card. • Sentry — Crash, error, and performance diagnostics. Receives: the diagnostic data described in Section 1.2. • Mapbox — Map-tile rendering. Receives: coarse map-viewport coordinates (not your precise GPS). Each provider maintains its own privacy policy (Supabase, Anthropic, RevenueCat, Apple, Sentry, and Mapbox). We may also disclose information: as required by law or valid legal process, or to protect the rights, property, or safety of Rivus, our users, or the public; in connection with a business transfer (merger, acquisition, financing, or sale of assets), in which case we will require the recipient to honor this Policy or notify you of any material change; or with your consent. 5. Community and Learning Data Some features let you contribute to anonymous, de-identified data that improves predictions for everyone. You control these with in-app toggles: • "Share my trips anonymously" (on by default; switch off in Settings). When on, a successful logged trip contributes anonymized facts — flies, techniques, and conditions — to a community corpus. Your name, email, account identifier, notes, and exact location are never included. • "Help Eddy learn" (on by default; switch off in Settings). When on, de-identified usage signals and aggregate learning data help improve Eddy and our coverage. This learning data is anonymized at the source — it is not linked to your account when collected. Because it cannot be tied back to you, it sits outside the account-deletion process in Section 7 and may be retained on a de-identified basis (Section 6). These contributions are never shared with other users in a form that identifies you. 6. Data Retention • Account and profile data — kept while your account is active. • Trip logs — stored on your device; removed when you delete them or clear the App's data. • Diagnostic data (Sentry) — kept for a limited period and then deleted in the ordinary course. • AI processing data (Anthropic) — retained by the provider only as described in Section 3.2. • Anonymized community/learning data — may be retained indefinitely because it cannot identify you. If you delete your account, we delete your associated personal data (account, profile, subscription records, and your linked Eddy feedback and usage logs). Deletion is processed promptly and completes within thirty (30) days, except where law requires us to retain certain records (e.g., for tax, legal, or dispute-resolution purposes) or to prevent fraud or abuse. 7. Your Rights and Choices 7.1 Account and data • Delete your account in-app: Settings → Account → Delete Account. This deletes your account and associated personal data, and unlinks any retained learning-corpus contributions from you. You may also email us (Section 13). • View and update your account information in the App at any time, and delete individual trip-log entries. • Access / portability and Eddy reset: request a copy of the personal data we hold about you, or deletion/reset of your Eddy personalization, by emailing us (Section 13). 7.2 Location You may grant, deny, or revoke location permission at any time in your device's Settings. Some features (such as automatic nearest-water matching) won't work fully without it, but you can still search rivers manually. We never track your location in the background, and your precise coordinates never leave your device (Section 1.2). 7.3 Consent toggles You can turn the Eddy AI consent (Settings → Eddy Privacy), "Help Eddy learn," and "Share my trips anonymously" settings on or off at any time in the App. 7.4 Communications You can opt out of non-essential notifications in your settings. Service-related messages (security, subscription, and Terms updates) can't be turned off while your account is active. 8. State Privacy Rights (U.S.) We extend the core privacy rights below to all U.S. users, regardless of whether a particular state law currently applies to a business of our size. To exercise any right, email us (Section 13). We will verify your request (typically by confirming control of your account email) and respond within the time the applicable law requires — no later than 45 days, with one permitted extension. We will not discriminate against you for exercising your rights. You may ask us to: confirm whether we process your personal data and access it; obtain a portable copy of data you provided; correct inaccuracies; delete your personal data; and opt out of any sale of personal data, targeted advertising, or profiling that produces legal or similarly significant effects — none of which we do. 8.1 Texas residents (TDPSA). Under the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Ch. 541), you have the rights listed above. The TDPSA treats precise geolocation as sensitive data that requires opt-in consent — your decision to grant location permission in your device settings is that consent, and you may withdraw it anytime by revoking the permission (in which case nothing changes for us, because your precise location never leaves your device). We do not sell sensitive or biometric personal data, and we do not sell personal data or use it for targeted advertising, so no opt-out is required. If we deny a request, you may appeal by replying to our decision; if we deny the appeal, you may contact the Texas Attorney General at texasattorneygeneral.gov. 8.2 California residents (CCPA/CPRA). To the extent the California Consumer Privacy Act applies, you have the rights to know, access, correct, delete, and opt out of the sale or sharing of personal information, and the right not to be retaliated against for exercising them. We do not sell or share (for cross-context behavioral advertising) your personal information, and we do not use automated decision-making to make significant decisions about you. California's "Shine the Light" law (Civ. Code § 1798.83): we do not disclose personal information to third parties for their own direct-marketing purposes. 8.3 Other states. If you live in a state with a comprehensive consumer-privacy law — for example Colorado, Connecticut, Virginia, Oregon, Utah, Montana, Delaware, Florida, Texas, and others now in effect — you may have similar rights. We honor the core rights above for all U.S. users; contact us to exercise them. 9. Data Security We use reasonable administrative, technical, and physical safeguards, including encrypted transmission (HTTPS/TLS), database storage with row-level access controls, server-side enforcement of permissions, and keeping third-party API keys off your device. No system is perfectly secure, so we cannot guarantee absolute security — please use a strong, unique password and keep your device updated. Breach notification. If a security breach compromises your personal information, we will notify you and any required authorities without unreasonable delay and within the timeframes the law requires (for Texas residents, consistent with Tex. Bus. & Com. Code § 521.053). 10. International Users Rivus is operated from the United States and is intended for U.S. users. If you access the App from outside the United States, your information will be transferred to, stored, and processed in the United States and in the countries where our providers operate, which may have different data-protection laws than your own. By using the App, you consent to this transfer. Where Eddy is offered to users in jurisdictions that require it, we identify it clearly as an AI system at the point of interaction. 11. Children's Privacy Rivus is a general-audience app that is not directed to children. You must be at least 16 to use it (see the Terms). We do not knowingly collect personal information from anyone under 16, and we do not knowingly collect personal information from a child under 13 in violation of the Children's Online Privacy Protection Act (COPPA). If you believe a child has provided us personal information, contact us (Section 13) and we will delete it promptly. 12. Changes to This Policy We may update this Policy to reflect changes in our practices, the App, or the law. We will post the revised Policy with a new "Last Updated" date and, for material changes, notify you in-app or by email. Material changes take effect no earlier than 14 days after we post them, unless the law requires sooner. Continued use after a change's effective date means you accept the updated Policy. 13. Contact Us Leo Rivus LLC Privacy & data-rights requests: privacy@rivusapp.com General support: support@rivusapp.com Website: rivusapp.com