Privacy — Ritrovo
Last updated 14 October 2026
The principle
Ritrovo finds the date for a group: you propose times while seeing your calendars, guests answer with or without the app, and you confirm. No ads, no account, no tracking. Guests without the app vote in their browser, so unlike most Nidello apps, Ritrovo has a service of ours for polls shared by link. It keeps the poll, the names guests type and their votes, and erases them 30 days after the date. It is listed in full below. It keeps no request log and knows no one’s email. Your calendars never leave your device.
What the app keeps
Ritrovo records what you put into it:
- your polls: title, place, note, mood or dress code, times, settings and replies
- who brings what, the theme and the picture of an event
- your first name, as guests see it, and your settings
Where it lives
On your device and, if iCloud is on, in your own private iCloud database (CloudKit, run by Apple), which we cannot open. The keys that let you manage a poll shared by link stay in your device’s keychain. A poll you share with a Cerchia circle whose members all have Ritrovo goes through iCloud only, between you and them: our service sees nothing of it.
What it asks permission for
Every one of these is optional. Refuse any of them and the rest of the app keeps working.
- Calendars, full access
- Asked the first time you want to see your week, get suggestions or answer from your calendar, after an explanation. Ritrovo reads when you are busy in the calendars you choose, on the device only; only your answers are sent, never your calendar. Refused, Ritrovo still works: you place times by hand.
- Calendars, add only
- To add the confirmed date to your calendar, with the place and the note, when you ask.
- Notifications
- Reminders made on the device: a reply deadline, the day before a date, a series’ new poll. Nothing goes through a server.
- iCloud
- To sync your polls between your devices, and to share a poll with a circle, through your own iCloud account.
What leaves the device
The app has no analytics, no crash reporting, no advertising and no third-party kit of any kind. What it does send, it sends only to the services below, and only for what you asked it to do:
- Our voting service, ritrovo.nidello.ca
- A Cloudflare Worker and its database (D1), on Cloudflare’s free plan, with no request log and no telemetry. Cloudflare hosts it and processes the data on our behalf. It is used only for a poll you share by link, and keeps only what follows.
- The poll
- Its title, place, note, mood or dress code, length, time zone, times and settings, and the first name you show as organizer. Who brings what, the theme and the picture of the event never leave your device.
- Replies
- The name each guest types, their answer for each time and their comment. No account, no email, no phone number, no location, no calendar.
- Keys
- Only a fingerprint (SHA-256) of the keys that let the organizer manage the poll and a guest change their vote. The keys themselves stay in your keychain, or in the guest’s browser.
- Erasure
- A confirmed poll is erased 30 days after its date; any other poll 30 days after it last changed. The organizer can erase it at once, from the app.
- Reports
- Anyone can report a poll or a reply. The report is sent to us by email — the poll’s identifier, its title, the reported reply, the reason and the details typed — and nothing is kept by the service. The organizer can hide a reply.
- Abuse limits
- To slow down abuse, Cloudflare counts requests per address for a short moment, under a hashed key that we never store.
- Guests in a browser
- The voting page is a web app served by the same service: no cookies, no tracking, no identifier, no external script. It keeps the guest’s key in their browser so they can change their vote. Its links to add the date to Google Calendar or Outlook open those sites only when the guest taps them; their own policies apply.
Only what is listed above under our voting service reaches us. Our only processor is Cloudflare, which hosts the service. Your subscription is handled by Apple; we receive no payment details.
Your data is yours
Export a poll’s replies as CSV or PDF with Ritrovo Pro. Delete a poll in the app and it is erased from your devices, your iCloud and our service. Leaving a poll removes it from your list. If Pro ends, nothing is deleted: older polls are only hidden from the free history.
Children
Ritrovo is not directed at children. Our service knows no one’s age or email; it keeps only the names guests choose to type.
Changes to this page
If the app ever starts doing something this page does not describe, this page changes first. The date at the top says when it last did.
Your rights
Quebec’s Law 25, Canada’s PIPEDA and similar laws elsewhere give you the right to access, correct and delete the personal information a business holds about you. For Ritrovo, a guest can change or remove their vote from the voting page, the organizer can erase the poll at once, and everything is erased 30 days after the date anyway. Any question: [email protected].
Contact
Nidello — Canada — [email protected]