How Rituals uses your data.

Your account and workspace

Rituals stores your account name, email, optional username, sign-in methods, and account-security records. Email/password accounts use a password hash. Sign in with Apple uses an Apple-provided identifier. Google sign-in uses your Google identifier, name, email, and basic profile information provided by Google. Rituals does not receive your Apple or Google password. Linking an additional sign-in method is an explicit account action; a matching email alone does not link accounts.

Your authenticated workspace contains the goals, tasks, documents, files, preferences, conversations, and progress you save. Change history and pending requests help preserve work after an interruption. Workspace records stay in their original storage. You can choose which of your workspaces appear together in one account planner; selecting them does not merge their records. The hosted website and backend run on Railway; public information pages do not display private workspace records.

Friends and your username

Your username is how friends find you. Rituals only finds an exact username; there is no partial or name search. “Who can find you” in Account has three choices. With “Exact username”, the default, anyone signed in who types your exact username can find you and send a request, friends of your friends may see you suggested, and your profile link, rit.al/<username> (it opens at rituals.app/<username>), shows your name, @username, profile photo, bio, and any short status to anyone, including people who are not signed in. People who are not signed in never see your friends or mutual friends. “Friends of friends” limits finding you and suggestions to people who share a friend with you, and “No one” turns both off; with either choice your link shows nothing to people who are not signed in. People you are already friends with, or have a request with, keep seeing you whichever you choose. Profile links are not offered to search engines.

When you change your username, your two most recent previous usernames are held for 30 days so no one else can take them. With “Exact username”, a held username’s link forwards to your new one during that time; with the other choices it does not.

People who can find you while signed in see your name, username, profile photo, bio, and mutual friends. A short status is shown to your friends and to anyone “Who can find you” lets find you, only while “Short status” is on, and only until it clears; Rituals has no last seen, presence, or location. A request note is seen only by the two of you and is deleted once the request is accepted or cancelled. Close friends, blocks, and requests set aside with “Not now” are never shown to the other person. A report is kept privately for the operator to review and also blocks that person. A block hides you from someone wherever they are signed in, but it cannot reach a visitor who is not signed in: while “Who can find you” is “Exact username”, your profile link still shows your name, @username, photo, bio, and status to anyone who is not signed in.

Friendships, requests, blocks, and reports are stored with your account. Deleting your account erases every friends record that names it.

Phone verification

The beta requires a mobile number from a supported country for a second sign-in step. The country menu in that step lists the countries Rituals can text right now; Rituals does not text numbers from other countries. Twilio, a US-based provider, receives the destination phone number and verification requests to deliver and check security codes, whichever country the number belongs to. Security messages are separate from marketing. Rituals records your consent, challenge status, and delivery/cost metadata. Standard message and data rates may apply.

Rituals encrypts the saved phone number and displays a masked version. Recovery codes and trusted-device proofs are stored as hashes on the server. If you choose to trust a device, its proof can avoid another SMS after primary sign-in for up to 30 days. You can revoke trusted devices in Account. See the security messaging terms.

Setup and device storage

Before sign-in, the goal you enter is kept locally for up to one hour so you can return from authentication. It is not included in URLs or sent to Assistant at that stage. After verified sign-in and your choice to continue, setup progress is saved to your workspace. A generated plan becomes saved work only when you accept it.

The browser stores scoped drafts and pending requests. Secure cookies maintain sign-in and optional device trust. On iPhone, credentials use Keychain and private files use iOS file protection with backup exclusion. Signing out clears active private presentation and follows the app's scoped cache cleanup. Clearing device storage does not delete server records or calendar events.

Google Calendar permissions

Calendar linking is optional and separate from Rituals sign-in and from linking a Google sign-in method. Signing in with Google does not grant calendar access. You can connect several accounts and choose which calendars contribute availability.

Account identity: openid and email

Identify the connected Google account. Rituals keeps its stable account identifier, display email, granted permissions, and encrypted access/refresh credentials.

Calendar list: calendar.calendarlist.readonly

List calendars so you can select availability sources.

Availability: calendar.events.freebusy

Read busy start/end times. These requests do not retrieve other events' titles, descriptions, attendees, or attachments.

App-created calendars: calendar.app.created

When you choose export, manage events in a separate Rituals calendar and read those managed events to reconcile changes.

Linking an account or selecting availability calendars does not export tasks. Google Calendar permissions do not grant access to Gmail messages or your Google password.

iCloud Calendar

Each optional iCloud connection uses the Apple Account identifier and app-specific password you provide. Credentials are encrypted on the server. Rituals never asks for your regular Apple Account password. Sign in with Apple does not itself grant calendar access.

Rituals lists calendars and reads selected event data to derive availability. You separately choose whether and where to export commitments. Synchronization records can retain identifiers and event fields needed to compare changes or recover uncertain delivery. Disconnecting removes active credentials and cached availability while preserving planner work, mappings, and existing external events. You can revoke an app-specific password separately in your Apple Account.

Exported commitments

A commitment has one selected export destination. Exported events can contain its title, scheduled date/time, duration, completion marker, and synchronization identifiers. Google exports can include a link back to the task; they do not include task document bodies, checklists, attachments, or conversations.

Previously approved synchronization can update managed events as tasks change. Conflicting changes require review. Disconnecting a calendar account does not delete external events. An unavailable or stale selected calendar is not treated as confirmed free time.

Assistant and research

When you request assistance, the selected AI provider receives your message and bounded planning context, such as relevant task/goal fields, stated preferences, conversation history, and busy time ranges. The combined Assistant uses context from the workspaces you select, subject to each source’s context permissions. Hidden workspace task details are excluded; fixed commitments and reservations can still contribute anonymous busy time to availability. Calendar availability selection is separate from task visibility. New setup starts with selected context, Journal access off, and reviewed changes. You can explicitly choose broader context in Assistant settings; existing choices remain editable.

OpenAI is the default provider; Anthropic can be selected where configured. Calendar credentials and phone verification codes are not sent as planning context. Public research uses a bounded brief intended to exclude private note text and personal identifiers. The app retains reviewed sources and assumptions so you can inspect the basis of a path.

Responses and generated files can be saved in your workspace. Provider API storage controls do not guarantee that providers retain no operational data. Rituals does not sell workspace data or use it for advertising.

Operational records and service providers

Setup measurements record bounded events such as the stage reached, time spent, and whether a first commitment or restart was acted on. These analytics do not include goal text, phone numbers, or calendar event titles. Spending records help enforce shared beta allowances and recover uncertain charges.

Railway hosts the app and data; Twilio handles security verification; the configured email delivery provider handles verification/recovery messages; Google and Apple handle their account/calendar requests; Photon (a place-search service run by komoot, using OpenStreetMap data) and, in the iOS app, Apple Maps handle optional location search; the selected AI provider handles requested assistance. These services operate their own infrastructure and data policies. Hosted connections use HTTPS. Workspace storage is server-managed, not end-to-end encrypted.

Location search is optional and starts only after you type in the Location search box; a location already saved on a task is not sent for search. In the web app your browser sends the text you type, together with your IP address and the Rituals site address, directly to Photon. The iOS app sends the text you type, together with your device’s IP address, directly to Apple Maps. Rituals does not receive that search text through these requests; the location you pick or type is saved with the task like any other field.

Disconnecting and deleting

Account settings let you revoke sessions, manage connections, and request account deletion. Deletion disables account access and runs provider/storage cleanup, with status available while work is pending. It does not mean every disconnected device copy or historical operator backup has been remotely erased.

Google Disconnect disables synchronization while retaining records needed for explicit reconnection and recovery. You can also remove authorization in Google Account connections. Removing provider access does not erase copies already saved in Rituals or delete your external calendars.

Workspace/history and backup retention depend on deployment operations; the beta does not promise a fixed automatic deletion period for every historical copy. Ask the operator about backup retention and removal. Security and spending records may retain the minimum metadata needed to prevent replay and reconcile existing charges.

Questions

For beta account or privacy questions, use the support contact shown on the app's provider consent screen. This page must be reviewed when integrations or data handling change; its date identifies this disclosure version.