Curious Creators Co.Last Updated: September 21, 2026
Welcome to Riff! Our Services let you create videos with artificial intelligence, which means you will often share photos, videos, voice recordings, and text prompts with us, sometimes including images of yourself and other people. We take the privacy and security of that information seriously, and we prepared this Privacy Policy to explain what we collect, how we use it, who we share it with, and the choices you have.
This Privacy Policy describes how Curious Creators Co. and our affiliates (collectively, "Riff", "we", or "us") collect and use personal information through our apps, websites, and services related to the Riff products and services (collectively, the "Services"). Capitalized terms not defined here (such as Inputs, Outputs, User Content, and Account) have the meanings given in our Terms of Service at https://riffvideo.ai/riff/terms-of-use.
By accessing or using the Services, you agree to this Privacy Policy and consent to the use of your personal information (including personal information about others that you provide to us) in the manner set out in this Privacy Policy. If you do not agree, please do not access or use the Services, and contact us to correct, amend, or delete any personal information we may have collected.
If you would like to contact us about our privacy practices, your rights with respect to the personal information we collect, or any questions about this Privacy Policy, please contact us at support@riffvideo.ai or by mail at: Curious Creators Co., 1534 Plaza Ln #200, Burlingame, CA 94010.
This Privacy Policy applies only to personal information collected through the Services. We process it according to the following legal bases, as applicable: where we have your consent; where it is necessary for the performance of our contract with you (meaning our Terms of Service); where we have a legitimate interest that is not overridden by your rights; and where we must comply with a legal obligation. This Privacy Policy does not apply to (a) anonymous or aggregated information that does not relate to an identified or identifiable person, or (b) third-party websites or online services linked from the Services ("Third Party Linked Sites"), including social platforms to which you may share Outputs. We are not responsible for the privacy practices of any Third Party Linked Site, and inclusion of a link does not imply endorsement.
Account Information. We may collect the following personal information that you provide to us directly or indirectly ("Account Information"):
User Content (Inputs and Outputs). When you use the AI Features, we collect the content you provide as Inputs, which may include photographs and videos of you and other people, voice recordings, text prompts and descriptions, and reference images; and the Outputs generated for you. This content may contain personal information about you and about other people who appear in it, including facial imagery and voice. Any User Content you provide must comply with our Terms of Service, including the Acceptable Use Policy and the requirement that you have consent from anyone whose likeness you use.
Device and Usage Information. We may automatically collect information about your device and your use of the Services ("Device Information"), such as device model, operating system version, app version, language, time zone, IP address and approximate location derived from it, mobile advertising identifiers (IDFA, where you have permitted tracking) and vendor identifiers (IDFV), crash logs and performance data, and usage events such as which features you use, which effects and prompts you select, how many generations you run, and how you interact with the app.
Information from third parties. We may receive information about you from third parties, such as attribution and analytics partners (to understand how you found the Services), the App Store and our subscription management provider, RevenueCat (purchase and subscription status), and people who invite you to use the Services. We use information from third parties only for the purpose for which it was provided.
We use Account Information and Device Information for the following purposes:
How we use User Content. Your Inputs and Outputs are used for a narrow set of purposes:
Some AI Features analyze the faces or voices in your Inputs so that the generated video can animate, restyle, or reproduce them. In doing so, our systems or those of our AI model providers may derive facial geometry, voiceprints, or similar characteristics ("Biometric Data") from your Inputs for the sole purpose of generating the Output you requested.
Purpose limitation. We use Biometric Data only to produce the Outputs you request and, where you opt in, to improve the AI Features. We do not use it to identify you across sessions, to build a facial-recognition database, or for advertising.
Retention. Biometric Data derived during generation is processed in real time and not stored after your Output is produced, and in any event is deleted no later than the earlier of the date the purpose for collection is satisfied or one (1) year after your last interaction with the Services, as required by applicable law. If you opt in to model training, Biometric Data contained in your training-consented content is retained for no longer than two (2) years.
No sale or profit. We do not sell, lease, trade, or otherwise profit from your Biometric Data.
Disclosure. We disclose Biometric Data only to the AI model providers and infrastructure vendors listed in Section 5 under contracts that restrict their use of it, when required by law, or with your consent.
Consent. Where required by law (for example, the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, or Washington's biometric privacy law), we will obtain your written or electronic consent in the app before collecting Biometric Data, and we will obtain your representation that you have consent from any other person whose face or voice you upload.
Other people. You may only upload the face or voice of another person if you have that person's consent (or a parent's or guardian's consent for a minor). If you believe someone has uploaded your likeness without consent, contact support@riffvideo.ai and we will investigate and remove it.
We disclose personal information only in the following cases:
We do not sell your personal information, and we do not share User Content or Biometric Data with advertising partners.
You may access, correct, or delete User Content you have saved to the Services at any time from within the app. You control your User Content.
You may access or correct Account Information by navigating to your Account settings in the app or by emailing support@riffvideo.ai. You may request deletion of your Account by emailing support@riffvideo.ai from the email address associated with your Account with "Delete My Account" in the subject line. Once we verify your request, personal information associated with your Account, including saved User Content, will be deleted as soon as reasonably practical and in any event within thirty (30) days, except that we may retain information in archived or backup copies as required by our records-retention obligations or applicable law, and may retain content flagged for Acceptable Use Policy violations as described in Section 3.
You can control the following in your device settings or the app: camera, microphone, and photo library permissions; push notifications; app tracking (IDFA) via Apple's App Tracking Transparency prompt; and, in the app, your AI-training opt-in and marketing email preferences. Opting out of marketing emails does not stop Service-related notices.
We and our partners use software development kits (SDKs), cookies, pixels, and similar technologies in the app and on our website to collect Device Information that tells us how the Services are used, whether they are working properly, and how users discovered them. For example, we learn how many users tried a particular effect, which links in an email were opened, or whether an install came from an advertisement.
Our product analytics providers, Firebase and Amplitude, help us understand how features are used and diagnose problems. Our subscription management provider, RevenueCat, receives purchase and subscription information from the App Store so we can manage your access to paid features.
Certain technologies we use are provided by advertising and attribution networks (such as Meta, Google, Apple Search Ads, TikTok, and AppsFlyer) to measure the efficacy of our own marketing. Through them we may share Device Information, including advertising identifiers where you have permitted tracking, but never User Content. Those networks may combine this information with other information they hold about you. To learn more about opting out of interest-based advertising, visit the Digital Advertising Alliance at https://optout.aboutads.info and the Network Advertising Initiative at https://optout.networkadvertising.org. On iOS you can prevent the sharing of your IDFA by declining the App Tracking Transparency prompt or by turning off "Allow Apps to Request to Track" in Settings → Privacy & Security → Tracking.
If you continue to use the Services without disabling these technologies where controls are available, you consent to our use of them and to the use of the personal information they collect in a manner consistent with this Privacy Policy. Disabling some technologies may make parts of the Services unavailable. Questions about our use of tracking technologies may be sent to support@riffvideo.ai.
The Services are not intended for, and we do not direct them to, anyone under the age of 13, and we do not knowingly collect personal information from anyone under 13. Users between 13 and 17 may use the Services only with the permission and supervision of a parent or guardian. Because the Services generate video from images of people, you must not upload images or recordings of anyone under 18 in a way that violates our Terms of Service. If you are a parent or guardian and believe your child under 13 has provided personal information to us, or that a minor's likeness has been used without consent, please contact support@riffvideo.ai and we will take appropriate action to delete that information.
We implement and maintain appropriate physical, managerial, and technical safeguards designed to protect the integrity and security of your personal information, including encryption in transit, access controls limiting employee access to User Content to what is necessary for support, moderation, and engineering, and contractual security obligations for our providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify you and any relevant regulator as required by law. Questions about security may be sent to support@riffvideo.ai.
We retain personal information for as long as needed to provide the Services and for the purposes described in this Privacy Policy, and afterward as required by law or for legitimate business purposes such as resolving disputes and enforcing our agreements. In summary: Account Information is kept for the life of your Account plus up to thirty (30) days; transiently processed Inputs are deleted from our systems within seven (7) days of generation, and from our AI model providers' systems as described in Section 3; saved User Content is kept until you delete it or your Account; Biometric Data is handled as described in Section 4; training-consented content is kept for up to two (2) years; flagged content is kept for ninety (90) days or longer if required for an investigation; and Device Information and analytics data are kept for up to twenty-six (26) months before being deleted or aggregated.
We process and store information on servers located in the United States, and our AI model providers and other service providers may process information in other countries. By using the Services you consent to the transfer of personal information to locations that may be outside your country of residence, including the United States, which may not provide the same level of data protection as your home jurisdiction. You acknowledge that, as a condition of providing any User Content, you can legally transfer it to the United States or another country.
For transfers out of the European Economic Area, United Kingdom, and Switzerland, we rely on adequacy decisions where available and otherwise on data processing agreements that include the EU Standard Contractual Clauses (and the UK Addendum). To learn more about these safeguards, contact support@riffvideo.ai.
If you are in the EEA, UK, or Switzerland, Curious Creators Co. is the controller of your personal information. Our legal bases are described in Section 1; in particular, we rely on your explicit consent to process Biometric Data and to use User Content for model training, on the performance of our contract with you to generate Outputs and administer your Account, on our legitimate interests to secure and improve the Services and measure our marketing, and on consent for non-essential tracking technologies.
You have the right to request access to, rectification or erasure of, or restriction of processing of your personal information; to object to processing based on legitimate interests; to data portability; and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You may exercise these rights by contacting support@riffvideo.ai; we will respond within one month, extendable where permitted. You also have the right to lodge a complaint with your local supervisory authority.
This Section supplements the rest of this Privacy Policy for residents of U.S. states with comprehensive consumer privacy laws, including California, Colorado, Connecticut, Virginia, Texas, and Oregon, and any other state whose law grants you similar rights. Where this Section conflicts with the rest of this Privacy Policy, this Section controls for residents of those states. Sections 2, 3, 5, and 10 describe the categories of personal data we process, our purposes, the categories of third parties we disclose it to, and how long we keep it.
The following applies under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
Notice at collection. In the preceding 12 months we have collected the following categories of personal information, for the purposes in Section 3, from the sources in Section 2, and disclosed them for business purposes to the recipients in Section 5:
Category (Cal. Civ. Code § 1798.140)Examples we collectDisclosed for a business purpose toIdentifiersName, email, username, IP address, device identifiers, IDFA/IDFVService providers; analytics and advertising partners; AI model providersCustomer recordsEmail, purchase historyService providersCommercial informationSubscription and Credit purchasesService providers; App StoreInternet or network activityApp usage, feature interactions, crash logsService providers; analytics partnersGeolocation (approximate)Country/region derived from IPService providers; analytics partnersAudio, electronic, or visual informationPhotos, videos, voice recordings, prompts, OutputsAI model providers; hosting and moderation providersBiometric information (sensitive)Facial geometry or voice characteristics derived during generationAI model providersInferencesPreferred styles and featuresService providers
We retain each category as described in Section 10. We do not sell personal information. We may "share" (as defined by the CCPA) Identifiers and Internet activity with advertising partners for cross-context behavioral advertising, which you can opt out of as described below. We do not knowingly sell or share personal information of consumers under 16.
Sensitive personal information. Biometric information is sensitive personal information. We use it only to perform the Services you request and for the other purposes permitted by Cal. Civ. Code § 1798.121(a), and we do not use it to infer characteristics about you; accordingly, a right to limit does not currently apply.
Your rights. You have the right to know what personal information we collect, use, disclose, and share; to delete personal information; to correct inaccurate personal information; to opt out of sharing for cross-context behavioral advertising; and not to be discriminated against for exercising these rights. To exercise these rights, email support@riffvideo.ai with "Privacy Request" in the subject line. We will verify your request by matching the information you provide to information in our records, such as your Account email, and may ask you to confirm through that email. You may designate an authorized agent by providing written permission signed by you. To opt out of sharing, decline the App Tracking Transparency prompt, turn off tracking in iOS Settings, or email us. We will respond to verifiable requests within 45 days, extendable once by a further 45 days with notice.
If you live in one of these states, or in another state whose comprehensive privacy law is in effect (including Utah, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island), you have the following rights, subject to the exceptions in your state's law:
Sensitive data. Under these laws, Biometric Data derived from your Inputs is sensitive data, as is any precise geolocation, health, or other sensitive information you choose to include in your Inputs or prompts. We process sensitive data only with your consent, which we request in the app before you first use an AI Feature that analyzes faces or voices, and which you may withdraw at any time in your Account settings or by contacting us. We do not sell sensitive data. Texas residents: we do not sell your sensitive personal data or your biometric data.
Children and teens. We do not knowingly process the personal data of anyone under 13. Where state law requires it, we do not process the personal data of consumers we know to be between 13 and 15 (or 13 and 17 in some states) for targeted advertising or sale without consent.
Exercising your rights. Submit requests by emailing support@riffvideo.ai with "Privacy Request" in the subject line. We will verify your request by matching the information you provide to our records, such as your Account email, and may ask you to confirm through that email; we may decline a request we cannot verify. Where your state permits, you may use an authorized agent to submit an opt-out request, and other requests with your signed permission. We will respond within 45 days, extendable once by a further 45 days with notice. You may exercise your rights free of charge up to twice in a 12-month period; we may charge a reasonable fee or decline manifestly unfounded or excessive requests. We will not discriminate against you for exercising your rights.
We may update this Privacy Policy from time to time. When we do, we will post the latest version on this page and update the "Last Updated" date at the top. Any material changes will be communicated to you by email at the address on file for your Account and/or by a prominent notice in the Services before they take effect, and where required by law we will ask for your consent.
Questions? Please email us at support@riffvideo.ai or write to Curious Creators Co., 1534 Plaza Ln #200, Burlingame, CA 94010.
© 2026 Curious Creators Co.