Privacy Policy

Last updated: October 29, 2026

Want to cancel your membership? You can do it yourself, right now: manage or cancel your membership. It takes effect at the end of the period you have already paid for (or straight away if a payment has failed) and you will not be charged again. If you can't sign in, that page will email you a link so you can cancel without your password.

This Privacy Policy explains how Rova Inc. (“Rova,” “we,” “us”) collects, uses, and shares information when you use rovasocial.com and the Rova service (the “Service”). By using Rova, you agree to this Policy.

1. Information We Collect

• Account information. Username, full name, email address, and password (stored only as a secure hash).
• Profile & content. Your bio, avatar, cover image, posts, photos, videos, comments, messages, polls, reactions, and who you follow.
• Payment information. When you subscribe or buy Gold on the website, payments are handled by Stripe. We receive limited billing details (such as subscription status, the last four digits and card brand) but we do not store your full card number. Purchases made in the iPhone app are handled by Apple through the App Store, and we receive a transaction record from Apple rather than any card details.
• Gold, gifts and earnings. If you buy Gold, send gifts, or earn from gifts, we keep the ledger of those transactions (who sent what to whom, when, and the amounts). Creators who cash out do so through Stripe Connect, which collects the identity and bank details that payouts require; we store only Stripe's account reference and the country.
• Approximate location (optional). If you use the location beam, we store an approximate place, never your exact position. A typed place is stored as the city or state's general coordinates; a device location is rounded to roughly a 7-mile area before we save it; and if you haven't chosen anything, we may estimate a broad region from your device's timezone. When the beam is on, that approximate area is visible on your profile. You can turn the beam off, or delete the location entirely, anytime in Settings → Location.
• Usage & device data. Log data such as IP address, browser type, pages viewed, and timestamps, used to operate and secure the Service. If you use the app and turn on notifications, we store the push token your device gives us so we can deliver them.
• Cookies & similar tech. Essential cookies keep you logged in (including a 7-day "remember this device" cookie), protect against request forgery, and remember your theme, time zone, feed tab and whether you have confirmed you are 18 or older; your feed preferences are stored in your browser. We also use Google Analytics, which sets its own cookies, and a Reddit advertising pixel on the sign-up pages, see Analytics below.
• Visitors who are not signed in. To count views, keep live-viewer numbers honest and limit abuse, we derive an anonymous identifier from your IP address and browser (a one-way hash, never the raw values) and keep it with the view or visit it belongs to. It is not linked to an account and we do not use it to build a profile of you.

2. How We Use Information

• To provide, maintain, and improve the Service;
• To create and manage your account and show your content to the people who follow you;
• To process your membership, trials, and recurring payments;
• To send service-related communications (e.g., account, billing, security notices);
• To keep Rova safe, preventing fraud, abuse, spam, and bots. This includes automated screening: photos and videos you upload are checked by an automated nudity classifier so that sensitive content is placed behind the right filter, and payments are screened for fraud by our payment providers; and
• To comply with legal obligations.

3. How We Share Information

We do not sell your personal information. Rova does not show ads in your feed. Members who choose to use the optional offer wall see offers from third-party advertisers; that is described below. We share information only:

• With service providers who help us run Rova, under obligations to protect your data:
  • Stripe (payments, subscriptions, Gold purchases on the website, and creator payouts through Stripe Connect);
  • Apple (purchases made in the iPhone app, and, where you allow it, the age range your Apple ID declares);
  • Cloudflare (content delivery, live streaming and recordings, security, and aggregate performance analytics);
  • SendGrid (sending every email we send you, and telling us when an address bounces or a message is reported as spam);
  • Google Cloud Vision (the automated nudity screening of uploaded photos and video frames; Google receives the image, not your identity);
  • Expo (delivering push notifications to the app);
  • DeepAR (the face filter software inside the app's camera, which runs on your phone; DeepAR receives basic device and app information to check its licence, and never a picture or anything about your face, see Face filters below);
  • Google Analytics and Reddit (usage measurement and sign-up measurement, see Analytics below);
  • OGAds, only if you open the optional offer wall on the Gold page. The offer wall shows offers from third-party advertisers; when you open it, OGAds receives your IP address, browser details and an anonymous reference so it can credit the offer you complete. Nothing from the offer wall is shown to members who do not open it.
• With other users, to the extent your profile and content are visible on the Service as intended;
• For legal reasons, if required by law or to protect rights, safety, and the integrity of the Service; and
• In a business transfer, such as a merger or acquisition, subject to this Policy.

3a. Analytics

We use Google Analytics to understand how the Service is used (pages visited, approximate region, device type). Google Analytics sets cookies and receives usage signals, including your IP address, under Google's Privacy Policy. You can opt out with the Google Analytics opt-out browser add-on or by blocking analytics cookies in your browser; Rova works fully without them. Cloudflare provides aggregate, privacy-focused performance metrics for the site.

On the sign-up pages we also load a Reddit advertising pixel, which tells Reddit when a sign-up that started from a Reddit ad was completed. It sets a Reddit cookie and receives your IP address and browser details under Reddit's Privacy Policy. It is not loaded anywhere else on the site, and blocking third-party cookies in your browser stops it. Neither pixel receives your name, email address or the content you post.

3b. The Rova Map

The Rova Map shows where members are, using the approximate location described above. It is built so that nobody's stored location is ever sent to your browser or anyone else's.

• No exact locations. The map receives regions, countries and areas, plus the beams described below, and nothing finer. Most members are counted only in a broad US region worked out from their device's time zone, and are never placed more precisely. Members outside the US are counted in the country they connect from. A region or country with fewer than 5 members is not shown.
• Areas. Members who set a specific place (a city, or their device's location), or who are on a trip, are grouped into areas as you zoom in. An area appears only when it holds at least 5 members, and its number is rounded down, so you see "10+" rather than an exact count. Private accounts are not included in region or area counts.
• Who sees what. Visitors who are not signed in see only regions and countries on the map. Areas and individual beams are shown only to signed-in members.
• Your beam. You appear on the map as an individual beam only if you have set a specific place or started a trip, and My beam is on. Members counted by time zone are never placed on the map individually. Your beam sits at the centre of the nearest large city to the place you set (or of a wider area, such as your state, if no city is close), moved by a small fixed offset of about 1 to 3 miles so people in the same city do not sit on top of each other. Its position comes from that public city centre, never from your address or your own coordinates.
• Private and blocked accounts. A private account's beam is shown only to people it has approved as followers. If you have blocked someone, or they have blocked you, neither of you sees the other's beam or the other in the Beaming list.
• Activity rings. Rings show how busy a whole region, country or area has been in the last 24 hours, as a general level rather than a number. They never show what any one person did.
• Travel. Travel moves your beam to a place you are visiting for 1 to 14 days. When the trip ends, or when you end it early, your beam goes back home on its own.
• The Beaming list. Next to the map, a list can show members whose beam is on, with their name, photo and the general place or region shown for their beam, to anyone who opens the map. Private accounts appear there only to their approved followers. Distances in that list are worked out from points shifted 30 to 90 miles, so they are rough on purpose.
• Turning it off. You can turn My beam off at any time, on the map or in Settings → Location. That removes you from the region and area counts, the beams and the Beaming list. If you are outside the US, you are still included in your country's member count, which comes from the country you connect from rather than from your beam.

3c. Face Filters in the Rova Camera

Lenses and Green screen in the app's camera track where your face and body are in the picture, in real time, so the effect stays in place. This happens only on your phone. Rova and our filter provider, DeepAR, do not receive, store or share your face geometry or any face scan, and nothing about your face is kept. The app asks for your permission before you use face filters for the first time, and you can withdraw it in Settings. The details are in our Face Filters Privacy page.

4. Data Retention

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal information within a reasonable period, except where we must retain it for legal, security, or billing purposes.

Some specifics: your account, posts, comments, messages, likes and follows are deleted immediately when you delete your account. Our record of which emails we sent you keeps the address for 90 days and is then de-identified; when you delete your account the address is de-identified straight away. Bounce and complaint records for an address are kept for up to 180 days. Payment, dispute and payout records are kept for as long as tax and accounting rules require. Server logs, which include IP addresses, are kept for security and capacity planning and rolled off over time. Copies of your data may remain in our encrypted backups for up to 30 days after deletion before they are overwritten.

Lives and replays are the one exception to immediate deletion: when you delete a live, its replay, or your account, a private copy of the recording, its chat and related details is kept for up to 14 days so our safety team can review reports of abuse, and is then permanently deleted. Only Rova staff can access it. We keep it longer only when the law requires it.

5. Security

We use technical and organizational measures to protect your information, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is 100% secure, so we can’t guarantee absolute security.

6. Your Rights & Choices

• Profile & email. Edit your profile, email address, and password in Settings, and choose which notification emails you receive in Settings → Email notifications.
• Location. Turn the location beam off, or delete your stored location entirely, in Settings → Location.
• Face filters. Withdraw your permission for face filters in Settings → Face filters. The app will ask again before it uses them.
• Delete your account. You can delete your account from Settings (Danger zone), which removes your posts, comments, messages, likes, and profile, or reach us through our report an issue page and we'll do it for you.
• Everything else. Request access to, correction of, or deletion of your personal information through our report an issue page. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; we will honor applicable requests.

7. Minors

Rova is an 18+ service. It is not directed to anyone under 18, and we don’t knowingly collect personal information from them. Both the app and the website ask you to confirm you are 18 or older when you create an account, and accounts are limited to adults (see our Terms). That confirmation is your own declaration; where Apple shares the age range of your Apple ID with the app, we use it only to keep Gold, gifting and payouts away from accounts that may belong to minors. If you believe someone under 18 has provided us information, contact us and we’ll delete it.

8. International Users

Rova is operated from the United States. If you access it from elsewhere, you understand your information may be processed in the United States, where data-protection laws may differ from those in your country.

9. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we’ll provide notice in the app or by email. The “Last updated” date above reflects the latest version.

10. Contact

Questions about your privacy? Reach us through the report an issue page, or write to Rova Inc., PO Box 530264, Henderson, NV 89012, United States.