Privacy

Last updated 13 September 2026.

Rivero Ledger is a scorekeeper for home poker games. It records who played, what they bought in for, what they cashed out, and who therefore owes whom. That is all it is for, and this page is the whole of what it does with it.

Your account

You sign in with Apple or Google and pick a name for the table, a unique username, a color, and, if you like, a photo. Sign-in is handled by Apple or Google; the app never sees a password. What it keeps from sign-in is an identifier, and for email sign-ups the address, used only to sign you in and to send verification, never for marketing, and never shown to other players. Your email is not stored on your public profile.

What is stored

• Your profile: display name, username, color, and the photo if you added one (kept as a small image on your profile record).
• The names you type for the people at your table. Most people use first names or nicknames. A name can be linked to the account of the person it belongs to, so their results follow them.
• Buy-ins, rebuys, cash-outs and the settlement for each night; optionally the date, a name for the night, the venue and the stakes.
• Which trackers your account has joined, its role in each, and a small hosting summary (how many trackers you host, and your plan's size) that lets a host see whether you could take one over.
• Your display preferences: theme and accent color.
• If you allow notifications on your iPhone: a notification token for that phone, kept with your account so the app can tell you when someone joins, or starts a night in, a tracker you're in, and which of those two you want. Signing out takes the token off your account.

It is held in Google Firebase (Cloud Firestore) on the app's behalf. Google processes it as the hosting provider and does not get it for its own purposes. Notifications are delivered through Firebase Cloud Messaging and Apple's push notification service.

What is never collected

• No payment or card details in the app. No game money moves through this app. It works out who owes whom and then it is finished. People settle up between themselves. A hosting plan is a subscription bought through Apple; the app never sees your payment details.
• No location, no contacts, no microphone. The camera or photo library is used only if you choose a profile photo, and only for that photo.
• No advertising, no analytics, no tracking, and nothing is shared with or sold to anybody. There are no third-party trackers in the app at all.

Shared trackers

A shared tracker is reached with an eight-character code, and the link that carries that code is the only thing standing between it and the world. Anybody who has the link can open that tracker, including its nights, the names in them, and the member list, and can pass the link on. Treat it the way you would treat the address of the game itself. A code cannot be revoked; if one gets somewhere it should not, make a new tracker and stop using the old one.

Getting rid of it

• Settings has an export that hands a tracker to you as a CSV.
• A tracker's owner can delete the tracker; its nights, people and settings go with it.
• Settings → Profile → Delete my account removes your profile, your username, your photo, your private ledger and your notification tokens, and unlinks your name everywhere. Nights you played in shared trackers stay there, by name, for the people you played with; those are the table's records. If you signed in with Apple, the app also tells Apple to revoke its sign-in.

Children

The app keeps a record of a real-money home game between adults. It is not directed at children and should not be used by them.

Changes

If what the app stores ever changes, this page changes with it and the date at the top moves.