Privacy Policy

Last Updated: October 2026

        In short: File Forge, Project Scanner, QR Hub and Invoice Maker run in your web browser, and the files and details you put into them are not sent to us. Logo Maker and Video Studio also work on your device, with a few optional features that send the text you type to an outside service; Section 3 explains each one. Loading the website uses a few standard services (cookieless analytics, hosting and code libraries), also described in Section 3. We don't use advertising trackers and we set no cookies.
      

1. Introduction

Riyo Studio ("we", "us", or "our") operates the riyostudio.dev website and its associated suite of developer, business and everyday tools. This Privacy Policy explains how we handle information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Riyo Studio Pty Ltd (ABN 71 697 865 802) is based in Perth, Western Australia.

2. What We Don't Collect

Our tools run in your browser, so apart from the optional features in Section 3, we don't receive the data you work on in them. Specifically:

File Forge: JSON data, CSV data, JWT tokens, and images processed in the forge are handled strictly by your local browser memory.
Project Scanner: The folder or .zip you give it is read and checked entirely in your browser. None of it is uploaded, stored or sent to us or to anyone else.
Logo Maker: The logos, brand text, icons, and saved projects you create stay in your browser's local storage on your device.
QR Hub: The links, contact cards, Wi-Fi passwords and crypto addresses you turn into QR codes are processed on your device.
Invoice Maker: Client details, financial data, and business logos reside in your browser and are generated into a PDF on your device.

3. Analytics & Third-Party Services

To understand how the site is used and to keep it running, we rely on a small number of third-party services. These run at the website level, separately from the tools described above, and none of them receive the content you work on in the tools:

Analytics (Cloudflare Web Analytics): We use Cloudflare Web Analytics to understand overall site usage, such as page views and referring links. It is cookieless: it sets no cookies, does not fingerprint your device, and does not collect personally identifiable information or track you across other websites. We do not use Google Analytics.
No advertising trackers: We do not use the Meta (Facebook) pixel, Google Ads tags, or any other advertising or cross-site tracking pixel. When we run an advertisement, we measure it only through the ad platform's own reporting on clicks that land on the site — nothing is added to the pages you browse.
Fonts: All typefaces are self-hosted on this site. No font CDN is contacted, so no third party receives your IP address when fonts load.
Project planner: When you use "Plan your project" at /plan and send us your plan, we store what you enter (your name, email, optional phone number and business name, the kind of project, the features you chose, your description of the idea, where your business is based and who your customers are, the answers about your current situation, and the plan the planner prepared for you) in a database on our hosting provider, Cloudflare (D1). We also keep a salted, one-way hash of your IP address solely to limit spam submissions; the IP address itself is never stored. We then send ourselves an email notification with those details through Cloudflare's email service. We use this information only to reply to you about your project, and you can ask us to delete it at any time.
Planner AI assistant: While you plan, the description of your idea, your business name, where it is based, who your customers are, and the project type and industry you picked are sent to Cloudflare Workers AI (which does not use the text to train its models) to summarise what we understood, suggest features, screens and questions, and give a short overview of the market for your idea. This happens before you send anything to us, and that text is not stored as part of this step. If the assistant is unavailable, the planner still works without it.
Market research in the planner: To prepare the market and opportunity section of your plan, a short summary of your idea, the project type, industry and the region you gave are turned into a few general search queries. Those queries (not your name or contact details) are sent to a web search provider, and the public results are summarised by Cloudflare Workers AI. Nothing from this step is used to contact you or shared with anyone else.
Website check: If you give us the address of your current website in the planner or on the free website check page, our server requests that site’s public home page, robots.txt, sitemap, a few of its own links and a small number of well-known public addresses on the same site, the same way any visitor’s browser could. We also look up the domain’s public DNS records and public registry details (such as the registrar and renewal date), and ask Google PageSpeed Insights to test the public page as a mobile visitor. Nothing is changed on your site, and in the planner a short summary of the results is saved with your plan. For each check we keep a short record for 180 days of which website address was checked and its overall result (never who ran the check, or their IP address), and we email ourselves about checks that find a serious problem and a daily summary of checks. If you came to our site through a link in one of our ads or posts, that record, and any plan or report you ask us to send, also notes the short label on the link (such as “meta-au”), so we can tell which ads are useful. The label names the ad, never you.
Paid in-depth audit: When you purchase an in-depth audit, the payment is handled entirely by Stripe. Your card details go to Stripe, never to us, and Stripe sends the receipt and invoice to the email address you give at checkout. On our side we store the website address you asked us to audit (from the moment you start checkout, even if you do not complete payment), your language choice, a reference to the Stripe payment, the email address you gave Stripe at checkout (which Stripe passes back to us with the payment confirmation), the generated report (kept at a private link; if you use the included re-check, the new report replaces the old one at the same link), and a salted, one-way hash of your IP address to limit abuse; the IP address itself is never stored. To produce the report, our server reads the site’s public pages, a small number of well-known public addresses on it, the home pages of a few of its subdomains and, where the site uses one, the public address of its Firebase database. It also consults public sources about the domain: DNS records, registry (WHOIS/RDAP) details, certificate-transparency logs, Google Safe Browsing and Google PageSpeed Insights. Those services receive the website address being audited, not your personal details. Anyone you share the private report link with can view the report, and you can ask us to delete it at any time.
Riyo Site Monitor: When you subscribe, payment is handled entirely by Stripe, as with the audit. On our side we store the website address you asked us to monitor, your language and report frequency, the name and email address you gave Stripe at checkout, Stripe's references to your customer record and subscription (so you can manage billing and we know when the subscription ends), a private link to your settings, and the results of our checks: whether the site was answering, when it went down or came back, the open alerts, and each report (kept at a private link). Our server makes the same kind of public, read-only requests as the website check and the audit, about every 5 minutes for availability and once a day for the security check, and sends alerts and reports to your email address through Cloudflare's email service. When your subscription ends, monitoring stops; ask us at any time and we will delete your details and reports.
Your saved plan and email copy: When you send your plan, it is saved so you can open it again from a private link. The saved copy does not include your email address or phone number, and anyone you share the link with can view it. If email delivery is available, we send that link to the email address you entered, and an alert to us at admin@riyostudio.dev, through Cloudflare’s email service. Ask us at any time and we will delete your plan and its link.
Contact by email: You can also email admin@riyostudio.dev directly. When you email us, we receive only your message and email address, and use them solely to reply.
Hosting (Cloudflare): The site is hosted on Cloudflare Pages. Like any web host, Cloudflare automatically logs standard connection data such as IP addresses, request times, and user-agent strings for security and performance. On the website check and project planner pages, Cloudflare also tells our server which country your connection comes from; we use it only to show the audit price in your currency and do not store it. The exchange rate comes from a public currency-rate service, which receives no information about you.
Code libraries (CDNs): To run the tools, your browser loads open-source libraries from public CDNs (such as jsDelivr, cdnjs, unpkg, and esm.sh). Your browser contacts these CDNs directly, so they may see your IP address. The downloaded code then runs locally on your device.
Optional per-tool services: A few features reach out to external services only when you choose to use them: Logo Maker icon search (Iconify), File Forge's GPS-map preview (OpenStreetMap), and on-device AI models for OCR, audio transcription and background removal (downloaded from providers such as Hugging Face). These fetch a resource using your IP address; your files are still processed on your device. There are two exceptions. The first is the optional AI voiceover in Video Studio: when you use it, the script text you type is sent to ElevenLabs using an API key you provide, so for that feature the text leaves your device to be turned into audio. The second is the Logo Maker's AI idea helper: when you use the auto-generator, only the brand name and description you type are sent to our hosting provider's edge AI (Cloudflare Workers AI, which does not use the text to train its models) to suggest relevant icons and a tagline. Your images and logo files stay on your device, and the generator still works if you don't use the helper.

4. Cookies and Local Storage

We set no cookies. Our analytics provider, Cloudflare Web Analytics, is cookieless (Section 3), so simply visiting the site places nothing on your device that identifies you or tracks you across other websites. Where our tools remember your preferences, they use your browser's local storage, which stays on your device and is never sent to us.

We do use your browser's localStorage to save your own work and preferences, for example saved invoice and company details, Logo Maker projects, UI settings, and (only if you use AI voiceover) the ElevenLabs API key you enter. The project planner keeps your answers in sessionStorage while you fill it in, so a page refresh does not lose them; this clears when you close the tab. This data stays on your device and is never transmitted to us; you can clear it any time through your browser settings.

The one exception: if you arrive through a link in one of our ads or posts, the short label on that link (such as “meta-au”) is kept in sessionStorage for the rest of your visit and sent with a website check or plan you start, as described in Section 3. It names the ad, never you, and it clears when you close the tab.

5. Sharing Your Information

We do not sell, trade, or rent your personal information to third parties. We will only disclose information if required to do so by Australian law (e.g., via a court order).

6. Your Rights

Under the APPs, you have the right to request access to the personal information we hold about you and to ask that we correct it. We don't keep data from the tools, so in practice these rights apply to any project plan you send through the planner, any paid audit record and report, your Riyo Site Monitor details and reports, and any email you send us. Email admin@riyostudio.dev and we will provide, correct or delete it.

7. Contact Us

If you have any questions about this Privacy Policy, email us at admin@riyostudio.dev.