Updated on
Website visits
The official website, rivloom.com, provides product information, guides, download status, and updates. It currently has no account registration, payment, or online feedback submission forms. See the download page for available installers.
The website is served through Cloudflare Pages and its global network. Cloudflare processes access requests to deliver content and protect the service; this may involve IP addresses, traffic routing, browser information, and operating system information. For processing and retention arrangements, see the Cloudflare Privacy Policy.
When an installer is available, it is delivered through downloads.rivloom.com. Cloudflare storage and network services process file download requests. Downloads do not require a website account and do not upload your desktop tasks or model credentials to the website.
The website uses Cloudflare Web Analytics (real user monitoring, or RUM) to understand visits and improve the page experience. Metrics include visits and page views, page addresses and referrers, country or region, browser, device type, operating system, and performance measures such as page loading, layout stability, and interaction responsiveness. Cloudflare receives and processes the data; we view the website statistics. See the Web Analytics dimensions.
Statistics are currently limited by Cloudflare's setting to exclude data from visitors in the European Union. According to Cloudflare's RUM data and privacy documentation, the analytics script does not read or write browser storage such as cookies or localStorage. The RUM service receives the source IP with an HTTP request and discards it at the nearest data center, without storing it in the core RUM database or logs. RUM data may be processed outside the visitor's country or region.
These RUM rules differ from those for CDN and security services, which may use necessary cookies depending on enabled features. See the Cloudflare cookie documentation.
This website analytics service does not read task content, work files, model credentials, or conversations from the Rivloom desktop client. Desktop data use is described below.
Desktop update checks and downloads
Starting with 0.1.5, the desktop app contacts downloads.rivloom.com after startup and every six hours to check for updates. You can also check manually and download installers. Cloudflare delivers these requests, which do not send task content, work files, or model credentials.
Desktop files and model requests
Working files remain on the executing device. AI requests may send prompts, relevant project content and tool results to the selected model service, which can use a public or reachable internal endpoint. Check the current task’s model selection, service operator and data policy.
PDF, DOCX and XLSX previews in 0.1.23 run locally without a public Office viewing service. Previewing does not automatically call a model. Quoting content into chat and sending it, or asking a task to read a file, may provide that content to the selected model and executing device. Public update checks operate separately from model connections.
Information exchanged by paired devices
After pairing, devices exchange information needed for collaboration over authenticated, encrypted connections. This includes device and project names, execution capabilities, and content and status related to your tasks. Local notes are not sent to the other device, and complete queues from other sources are not broadcast to every device.
Task text and tool output may still contain sensitive information. Field limits and content processing cannot guarantee detection of every secret or path. Do not include keys or production secrets in tasks.
Starting with 0.1.13, workflows that support on-demand results first exchange remote file lists, including source devices, names, paths and sizes. Files are transferred when explicitly fetched or needed by later steps. File contents may still reach the selected model through execution materials or model tools, and existing local copies are not automatically deleted. Older nodes keep their existing file return behavior.
Data scope for Skills and memories
Skills and Wiki memories in 0.1.15 are local by default. Only entries manually shared with a Brain appear in its shared catalog. The catalog includes names, descriptions, categories, sources and versions; content and supporting files are transferred as needed. Content used in a task may be sent to the selected model provider.
Revoking sharing blocks later reads but cannot retract copies already delivered. Deleting a Wiki entry removes its local content and edit history; removing a Skill registration leaves the original folder intact. Organization preserves original content and makes no extra model calls. Knowledge tools do not expose local instructions to remote tasks.
Local records and model credentials
Conversation content search in 0.1.14 uses conversation records already available to the current user. It does not scan additional project files or create a persistent full-text index. Searching does not call a model; later execution follows the usual model-request rules.
OAuth authorization is handled by the selected provider, and successful credentials are stored by the official engine on the execution device. API Keys are not shown in the model catalog or website. Custom Providers receive prompts, relevant content and tool results sent to their models; use an endpoint controlled by a provider you trust. Connecting does not automatically run a paid connection test.
Since 0.1.12, unsent drafts and uploaded attachments are stored locally for the current device and user. Permanently deleting a conversation removes its draft. Requirements, answers, result summaries and file records can support later execution and may be sent to the model selected for that round and the trusted device doing the work.
On-demand history reads in 0.1.19 provide conversation state and required original text to the worker. Remote reads must come from the currently trusted target node that accepted the execution, with execution identity and source-version checks. New reads are rejected after completion or revocation. Content already delivered cannot be recalled remotely.
Project memories in 0.1.20 are explicitly saved by the local owner, with the conversation entry, source version and confirmation information retained for potential use in later project execution. Conversation entries, project memories and sharing permissions are managed separately. Withdrawal does not remove content already delivered to a model or another device.
Context read records store the source, version, range, byte count and time without making another copy of the content. Permanent conversation deletion attempts to clean up clearly associated local engine history. Incomplete cleanup is recorded and retried, while project files and independent project memories remain unchanged.
Task records are stored in the device's data directory, and not all content is encrypted. Do not upload that directory publicly. Model credentials are managed by the execution device. Tasks from trusted devices may consume the same account quota; separate billing per member is not guaranteed.
The application does not automatically import your existing personal model credentials. When using an explicit import feature, select only account information you are authorized to use.
Conversation deletion and retention
Starting with 0.1.10, conversation names and pins are saved per local user and affect only display and order, leaving task instructions unchanged. These preferences survive a restore from the recycle bin and are removed when the conversation is permanently deleted.
Starting with 0.1.6, deleted conversations first enter the local recycle bin for three calendar months. You can restore them or permanently delete them sooner. Permanent deletion removes related local conversation records and app-managed attachment copies no longer used by other conversations. Minimal identifiers remain to prevent old requests from being replayed.
Deleting a conversation does not remove original project files, separately saved files, records on other devices or independent engine caches. Starting with 0.1.9, application upgrade backups are cleaned up automatically after a successful launch into the updated workspace. They are retained if the upgrade or startup fails, independently of the conversation recycle bin retention period.
Protect your information in feedback
Before submitting screenshots or error descriptions, remove keys, personal information, project paths and private task content. Do not send a complete runtime data directory. GitHub issues and pull requests are public; for issue reporting and private vulnerability reports, see Feedback & support.
If new data collection features are added, this notice will be updated to reflect them. For execution permissions and side effects, see Security boundaries.