YOUR DATA, EXPLAINED

Privacy policy

Riff is an independent desktop music application developed by Mert Meral. This policy describes the application’s data practices and this website.

Effective date: October 11, 2026

Riff’s current application connects directly from your device to Google and YouTube. It does not send your music library or Google account credentials to a Riff-operated server.

Google account access is optional

You can search and play music without signing in. If you choose to connect Google, Riff requests openid and profile to identify your account and display your name and profile picture. It requests https://www.googleapis.com/auth/youtube.readonly to read your YouTube liked videos, subscribed channels, playlists, and playlist items, including private playlists you authorize it to access.

This connection does not request permission to upload, delete, or modify YouTube content. Sign-in takes place through Google in your browser; Riff does not receive your Google password.

How the application uses data

Riff displays your account information and YouTube library in the app. It uses liked videos and subscriptions to choose a music recommendation seed. The selected video or channel identifier may be sent to YouTube to retrieve related music or search results. It also sends searches and playback requests to YouTube to provide the features you use.

Riff does not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models. Riff’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and retention

Google refresh tokens and OAuth client configuration are stored in your operating system’s credential store. Access tokens and the fetched account library are held in application memory. Closing the app clears that in-memory library; signing in again or reopening a connected session fetches it again.

Local favorites, saved albums and artists, playlists, recent tracks, queue state, and playback preferences are saved on your device so they can be restored. Artwork, including account pictures, may be cached on disk. When audio caching is enabled, played audio may also be cached locally. Local files remain until you remove them or the app’s cache management evicts them.

Sharing and third-party services

Network requests go directly to Google, YouTube, and their content-delivery services for sign-in, account access, catalog results, artwork, recommendations, and playback. These services receive request information such as your IP address and the relevant search, video, or channel identifiers. Authorized account requests include your access token.

The application does not include Riff-operated analytics or advertising services. Google and YouTube handle their own data under the Google Privacy Policy.

Disconnecting and deleting data

Choose Disconnect in Riff’s account screen to remove the saved Google credentials from the system credential store and clear the displayed account library. To revoke the Google authorization itself, remove Riff from your Google account’s third-party connections.

Disconnecting does not delete tracks or playlists you saved locally, artwork caches, or audio caches. To remove those, close Riff and delete its application configuration and cache folders on your device. On macOS, these are normally ~/Library/Application Support/dev.riff.Riff and ~/Library/Caches/dev.riff.Riff. If you saved a separate OAuth credentials file, delete that file too. You can contact the developer for help locating the folders on your platform.

This website

This static website is hosted on GitHub Pages. It does not add analytics, advertising, tracking cookies, account forms, or embedded third-party media. GitHub may record visitors’ IP addresses and other request information for security and service operation; see the GitHub Privacy Statement. Following an external link takes you to a service with its own privacy practices.

Contact and changes

For privacy questions, local data deletion help, or other support, contact Mert Meral at mertmr@gmail.com. If you email the developer, your message and contact details are used to respond to your request. Please do not send passwords, access tokens, or refresh tokens.

If Riff’s data practices change, this policy will be updated with a new effective date.