Privacy Policy.

1. Who we are & scope

rv.studio (the "Platform," "we," "us") is a blind remote-viewing and ARV practice, training, and research-instrumentation tool. This Policy covers personal data we process when you visit our site or use the Platform. For data-protection purposes we act as the controller of your account and usage data. Questions or requests: hello@rv.studio.

2. What we collect

• Account data — your email address, and any display name, handle, bio, location, or avatar you choose to add. Authentication is handled through our unified sign-in (including a magic-link email and, optionally, a connected provider); we store only what is needed to identify your account.
• Your practice data — the viewings, impressions, sketches, confidence ratings, predictions, calibration, paper-money (virtual) activity, badges, and group/Space membership you create by using the Platform.
• Communications — messages you post in forums, Spaces, or feature requests, and any email you send us.
• Technical & usage data — limited server logs (e.g., IP address, timestamp, request path, user agent) kept for security and reliability, and — only with your consent — cookieless, anonymized analytics about how the site is used.

3. Why we use it, and our legal bases (GDPR)

• To provide the Platform (run your account, sessions, scoring, Spaces) — legal basis: performance of a contract with you.
• Security, integrity, and abuse prevention (the blindness and anti-gaming controls, server logs, rate limits) — legal basis: our legitimate interests in a safe, fair, working service.
• Analytics to improve the product — legal basis: your consent (you can accept or reject this in the cookie banner or at any time via "Cookie preferences," and withdraw it later).
• Practice and product email (your weekly recap, getting-started nudges, product news, badge notes) — legal basis: our legitimate interests in helping you use the Platform, balanced by a one-click unsubscribe in every such email and per-category controls in Settings. See Section 5.
• Legal compliance — where we must keep or disclose data to meet a legal obligation.

4. Cookies & analytics

We use a small number of strictly necessary cookies to run the Platform — to keep you signed in, protect against cross-site request forgery, and remember your cookie choice. These do not require consent. We do not use advertising or cross-site tracking cookies.

With your consent we also collect cookieless, anonymized analytics (self-hosted Matomo) to understand and improve usage. It sets no analytics cookies and respects browser Do-Not-Track. You can accept or reject analytics in the banner shown on your first visit, or change your choice anytime via Cookie preferences. We honor the Global Privacy Control (GPC) signal as an opt-out automatically.

5. Email we send you

We send two kinds of email, and we treat them differently.

Service email is email you need in order to use your account — sign-in and magic links, approvals, security and account notices, and the activity notifications you have switched on. It is part of providing the Platform (performance of a contract), so it is not marketing and it is not covered by the unsubscribe below. If you would rather not receive it, you can close your account.

Practice and product email is everything else: your weekly practice recap, occasional product news, getting-started and win-back nudges if you sign up but do not get going, and badge or milestone notes. We send it on the basis of our legitimate interests in helping people use a tool they signed up for. The recap, product news, and getting-started nudges are on by default and you can turn them off at any time; badge and milestone email is off by default and sent only if you turn it on. We cap this email at a small number per week. We never sell your address, and we never carry anyone else's advertising.

How to stop it. Every practice and product email carries an unsubscribe link that works without signing in — one click and we stop. You can also manage each category separately, or pause all of it at once, under Settings → Preferences. Opting out takes effect immediately.

Our record of your opt-out. When you unsubscribe we record that decision against your email address in a suppression list, and we check that list before every send. We keep that record for as long as we operate the Platform: deleting it is precisely what would allow a later mistake to start mailing you again. It exists to honor your choice, not to profile you, and it holds nothing beyond the address, the scope, and when and why it was added. We add the same kind of record automatically if mail to your address hard-bounces. Your email preferences and any suppression record are included in your data export (see Section 11).

6. Who we share it with

We do not sell or share your personal data, and we do not use it for cross-context behavioral advertising. We use a small set of service providers ("processors") strictly to operate the Platform — cloud hosting, email delivery (both the service email above and the practice and product email in Section 5), and self-hosted analytics — under terms that limit them to processing on our instructions. We may disclose data if required by law, or to protect the rights, safety, and integrity of the Platform and its users.

7. International transfers

The Platform is operated from, and data is hosted in, infrastructure that may be located in the United States. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) where required.

8. How long we keep it

We keep your account and practice data for as long as your account is active, and for a limited period afterward as needed for security, dispute resolution, and legal compliance, after which it is deleted or anonymized. Server logs are kept for a short period. One record deliberately outlives the rest: if you unsubscribe from practice and product email, we keep the opt-out record described in Section 5 so that your choice keeps being honored. You can export or request deletion of your data at any time (see below).

9. Your rights under the GDPR (Europe/UK)

If the GDPR applies to you, you have the right to: access your data; rectify inaccurate data; request erasure ("right to be forgotten"); restrict or object to certain processing; data portability (receive your data in a portable format); and withdraw consent at any time (e.g., turning analytics off). You also have the right to lodge a complaint with your local data-protection authority.

10. Your rights under the CCPA/CPRA (California)

If you are a California resident, you have the right to: know what personal information we collect, use, and disclose; access and delete your personal information; correct inaccurate information; and opt out of the sale or sharing of your personal information. We do not sell or share personal information (as those terms are defined under the CCPA/CPRA), so there is nothing to opt out of in that respect — but you can still turn off analytics anytime, and we honor the Global Privacy Control. We do not use or disclose sensitive personal information for purposes that would require a "limit" right, and we will not discriminate against you for exercising any right. You may use an authorized agent to make a request. The categories of personal information we collect map to the list in Section 2; the business purposes to Section 3; sources are you and your use of the Platform.

11. How to exercise your rights

• Export your data — signed-in members can download a copy of their account and practice data from Settings → Privacy & data (data portability / right to access).
• Delete your account — request deletion from Settings → Privacy & data, or email us. We verify the request and delete or anonymize your personal data, keeping only what the law requires.
• Anything else (access, correction, objection, complaints, agent requests) — email hello@rv.studio and we'll respond within the timeframe the law requires (generally 30 days for GDPR, 45 days for CCPA). We may need to verify your identity first.

12. Children

rv.studio is not directed to children. You must be at least 16 (or the age of digital consent in your jurisdiction) to create an account. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.

13. Security

We use technical and organizational measures to protect your data, including encryption in transit, access controls, and — for private viewings — optional end-to-end encryption of your notes and sketches. No method is perfectly secure, but we work to protect your information and to keep the Platform's blindness and integrity controls intact.

14. Changes to this Policy

We may update this Policy as the Platform evolves or the law changes. We'll update the "Last updated" date above and, for material changes, provide a more prominent notice.

Terms of Service →  ·  Do Not Sell or Share My Personal Information →  ·  Privacy summary & non-affiliation →