Privacy
Policy.

Risa Apps is an indie app studio that develops mobile applications including VeggieMate (a cooking and meal planning assistant), MoodMints (a wellbeing and mood journaling app), CoCria (a collaborative decision‑making and project app for couples, families, and small teams), Busted (a daily reverse‑trivia game), and Secret Santa Party (a gift‑exchange organizer for groups and families). This Privacy Policy explains how we collect, use, and protect your data across all Risa Apps products unless a product‑specific policy is provided.

2.0 — MoodMints additional data

MoodMints collects additional information to support mood tracking, journaling, and personalization features:

• Mood entries (your selected mood level for the day)
• Reflection text you voluntarily add
• Bonus prompts completed (IDs only, not prompt content)
• Theme selections
• Rewarded‑ad usage data (e.g., bonus prompt unlocked)

All MoodMints journaling data is stored in Firebase Firestore and associated with your user account. None of your reflection content is used for advertising or model training.

2.1 — Information you provide directly

• Name and email address when you sign in with Google, Apple, or email. If you use Sign in with Apple, Apple may provide a private relay email address instead of your real one.
• Content you create in the apps (for example, projects, decisions, tasks, notes, and images you upload in CoCria).
• Feedback or messages you send to us.

2.2 — Automatically collected data

Analytics & app usage (Firebase Analytics): screens viewed, app interactions and feature usage, session duration and frequency, device information (model, OS version, language).

Crash reporting (Firebase Crashlytics): crash logs, device state at the time of the crash, app version and operating system information.

Performance monitoring (Firebase Performance): app launch time, network request performance, responsiveness and rendering performance.

Advertising data (Google AdMob): if you allow tracking via Apple's App Tracking Transparency prompt, device identifiers (such as IDFA), approximate coarse location, and ad interaction and impression data. In MoodMints, rewarded ads may be shown to unlock bonus prompts — these are optional and do not access your mood journal entries. If you do not allow tracking, only non‑personalized ads are shown.

Subscription & purchase information (RevenueCat): subscription status, purchase history (non‑personal information), anonymous app user ID generated by RevenueCat. Payment information is handled exclusively by Apple and never processed by us.

App content & settings (stored locally on your device): saved recipes, pantry items, meal plans (VeggieMate); mood entries and daily reflections (MoodMints); app preferences and theme selections. If cloud sync is enabled, this information is stored in Firebase Firestore.

2.3 — CoCria additional data

CoCria requires an account and stores your data in the cloud so your projects are available across your devices and to the people you collaborate with. CoCria collects and stores:

• Account details — your display name and the email address associated with your sign‑in method (Apple, Google, or email).
• Project content — projects you create (names, deadlines, notes), the decisions and options you add, the tasks you create, and any cover or option images you upload.
• Collaboration data — project invite codes, who is a member of which project, and the assignment of decisions and tasks between members.
• Notification tokens — a device push token (Firebase Cloud Messaging) used to notify you and your collaborators about decisions and tasks. You can disable notifications in your device settings.
• Purchase entitlements — which one‑time plan you have purchased, if any (Personal, Pro, or Studio), managed through RevenueCat and the App Store / Google Play.

Collaboration means sharing. When you create a project and invite others, or join a project using an invite code, your display name and the content of that shared project (decisions, options, tasks, and images) become visible to the other members of that project. Only share projects with people you trust.

CoCria is free to download, with optional one‑time in‑app purchases — it has no subscriptions. CoCria does not show ads, does not use advertising identifiers (such as IDFA), and does not request App Tracking Transparency permission for advertising. CoCria also does not use your project content to train AI models.

2.4 — Secret Santa Party additional data

Secret Santa Party does not use accounts. The only authentication is Firebase Anonymous Authentication, which assigns your device a random identifier with no personal information attached.

Stored on your device only: the display name you enter, until you use it to join or create a group.

Sent to our cloud (Google Firebase/Firestore) when you create or join a group:

• Group name, event date, budget, and invite code
• Exclusion pairs (who can't be matched with whom)
• Participant names — your own, or a name entered on behalf of a family member (including a child) who doesn't have their own device
• Wishlist text
• Check‑in status and reveal status
• Your anonymous device identifier

A cloud function runs the gift‑matching draw and writes the result back to Firestore. This data does not leave Google's infrastructure. Secret Santa Party does not use analytics, crash reporting, advertising identifiers, or any advertising or tracking SDK.

If you enable notifications, we store a device push token so we can notify you about draw activity — for example, when everyone's revealed their assignment, or when your gift‑giver checks your wishlist. This token is tied to your device, not to any account — we don't have accounts. You can disable notifications at any time in iOS Settings.

2.5 — Busted additional data

Busted is a daily reverse‑trivia game. It does not require an account, a name, or any personal information to play.

Stored on your device only:

• Your current streak count and the date you last played
• Which round numbers you have already completed (to prevent replaying a round as your first attempt)

Sent to our cloud (Google Firebase) when you submit a round:

• Round number and your set‑by‑set outcomes (correct, incorrect, or skipped)
• Whether the submission is a redo (practice attempt) or a first attempt
• Your anonymous Firebase device identifier — no name, email, or personal information is attached

This data is used only to calculate aggregate statistics (how many players called each set correctly today). We do not link your game results to any personal identity.

Busted may show rewarded ads (powered by Google AdMob) as an optional way to unlock a practice replay. If you allow tracking via Apple's App Tracking Transparency prompt, AdMob may use your device identifier (IDFA) for ad personalisation. If you decline, only non‑personalized ads are shown. Busted also offers a one‑time purchase to remove ads and unlock unlimited replays.

If you enable daily reminders, a notification is scheduled locally on your device — no push token or server call is used for this.

• Provide and maintain app functionality.
• Enable secure login via Google.
• Sync your recipes, pantry, and meal plans across devices.
• Verify subscription status and entitlements.
• Show ads and manage ad preferences.
• Improve app performance, reliability, and features.
• Diagnose crashes and technical issues.
• Provide personalized MoodMints experiences such as mood history, streaks, and reflections.
• In CoCria: enable required sign‑in; store and sync your projects, decisions, and tasks; share your name and shared‑project content with the collaborators you invite or join; send decision and task notifications; and verify which one‑time plan you have purchased.

• We do not sell your data.
• We do not share personal data with advertisers.
• We do not collect or store your payment information.
• We do not track you across other companies' apps without permission.
• We do not use your reflections or mood entries to train AI models or for advertising targeting.

Risa Apps products may request permission to track activity across apps and websites for advertising purposes. If you allow tracking, AdMob may use your device ID (IDFA). If you decline, only non‑personalized ads will be shown. You can change this decision anytime in iOS Settings → Privacy → Tracking.

This applies only to our ad‑supported apps. CoCria contains no advertising and performs no cross‑app tracking, so it does not show the App Tracking Transparency prompt for advertising.

Local data remains on your device until you delete the app. Cloud data, if enabled, is stored securely in Google Firebase. Subscription and purchase data is managed by RevenueCat and Apple. MoodMints journaling data is encrypted in transit and securely stored in Firestore, associated only with your user ID. CoCria's account, project, and collaboration data is stored in Firebase Firestore, and images you upload are stored in Firebase Cloud Storage; all are encrypted in transit and associated with your account.

Account deletion

You can delete your account at any time using the in‑app option in VeggieMate or MoodMints. Deleting your account permanently removes cloud‑stored data including recipes, meal plans, mood entries, and reflections. Local data is removed when you uninstall the apps.

For CoCria, you can delete your account and associated data — including your projects, decisions, tasks, and uploaded images — from within the app (Preferences → Delete account) or by request. See Delete your CoCria account for full details. Please note that content you shared into a project you do not own (for example, decisions or tasks within a project created by someone else) may remain visible to that project's other members.

For Busted, you can delete your anonymous account and all associated game data from within the app (Settings → Delete account). This clears your streak, play history, and anonymous Firebase identifier. Because Busted does not collect any personal information, there is no named account to recover after deletion. See Delete your Busted account for full details, including how to request deletion if you no longer have the app installed.

For Secret Santa Party, the group organiser can delete a group at any time, which permanently deletes that group's participants and assignments from Firestore. A participant can leave a group, which removes it from their own device but does not delete their data from the shared group — there's currently no self‑serve way to delete your own data out of a group you don't own. For a deletion request outside of the organiser deleting the group, contact us below.

Data rights for EU/EEA users

Under GDPR and Digital Services Act guidelines, you have the right to:

• Access your data
• Correct your data
• Delete your data
• Export your data
• Withdraw consent for tracking
• Object to personalized advertising

You may contact us to exercise these rights.

Risa Apps products use the following services:

• Google Firebase (Analytics, Auth, Firestore, Crashlytics, Performance)
• Google AdMob / Google Mobile Ads SDK
• Google Sign‑In
• RevenueCat
• Apple (In‑App Purchases & App Store infrastructure)
• Firebase Firestore (cloud storage for MoodMints reflections and mood entries)
• Google AdMob Rewarded Ads (optional content unlocks in MoodMints)

Services used by CoCria

CoCria uses a more limited set of services and no advertising services:

• Google Firebase — Authentication, Firestore, Cloud Storage, Cloud Messaging, Analytics, Remote Config, and Cloud Functions
• Sign in with Apple
• Google Sign‑In
• RevenueCat (one‑time purchase entitlements)
• Apple / Google Play (in‑app purchases & store infrastructure)

Services used by Busted

Busted uses a limited set of services:

• Google Firebase — Anonymous Authentication, Firestore, Cloud Functions
• Google AdMob — optional rewarded ads for practice replays (subject to App Tracking Transparency consent)
• Apple / Google Play — one‑time in‑app purchase for ad removal
• Local notifications only (no push infrastructure for reminders)

Services used by Secret Santa Party

Secret Santa Party uses a more limited set of services and no advertising services:

• Google Firebase — Anonymous Authentication, Firestore, Cloud Functions, Cloud Messaging (push notifications)
• No analytics, crash reporting, or ad SDKs

Risa Apps products may use cookies or similar technologies on our website (hellorisa.app) to improve your browsing experience. Our mobile applications (VeggieMate and MoodMints) do not use traditional browser cookies, but certain third‑party services integrated into the apps may use similar identifiers for analytics, crash reporting, and advertising.

9.1 — Cookies on our website

Our website uses Google Analytics (provided through Google Firebase) to understand how many people visit, which pages they read, and how they found the site. This includes information such as the pages viewed, the referring website, device and browser type, and approximate location (such as country or city). Google Analytics sets first‑party analytics cookies (such as _ga) to do this.

• Advertising features and Google signals are turned off — website analytics are not used for ad personalisation.
• We do not run analytics on group invite or sign‑in pages, whose web addresses can contain invite codes.
• The website does not set advertising cookies or other tracking cookies.

9.2 — Identifiers in mobile apps

• Firebase Analytics – anonymous app usage identifiers
• Firebase Crashlytics – crash session identifiers
• Google AdMob – advertising identifiers (IDFA / Android Ad ID) when permission is granted
• RevenueCat – anonymous user identifier for subscription tracking

9.3 — Managing cookies & tracking

You may control or disable cookies and tracking identifiers using your browser's cookie settings, your device settings for tracking permissions (iOS: Privacy → Tracking), and your device settings for ad personalization. Disabling these may limit certain features but will not prevent you from using the core functionality of VeggieMate or MoodMints.

If you have questions about this Privacy Policy or your data rights, contact heloisa.balzaretti@gmail.com.