🔒 Security & Privacy • 🍷🤍rivo.lat

📡 1. Zero-Server Architecture

rivo.lat has no backend servers. Every file (HTML, CSS, JavaScript) is static and hosted on a CDN. There is no database, no API, no logging, no collection of any kind.

                    ❌ No server-side code

                    ❌ No database connections

                    ❌ No user accounts

                    ❌ No logging of IP addresses

✅ What you write never leaves your browser.

💾 2. Local Storage Only

Your notes and images are saved exclusively in your browser's localStorage and IndexedDB (for images). This means:

✔️ Data is stored on your device, not our servers
✔️ You can delete everything by clearing browser data
✔️ No one (including us) can access your notes remotely

🍪 3. No Cookies

VERIFIED 0 cookies are set by rivo.lat. We do not use session cookies, tracking cookies, or any persistent identifiers.

                    // Check for yourself in DevTools:
                    // Application → Cookies → https://www.rivo.lat → (empty)
                

👁️ 4. No Tracking & No Third Parties

Zero analytics, zero pixels, zero trackers. We do not use:

❌ Google Analytics / Umami / Plausible
❌ Facebook Pixel / Twitter conversion
❌ Hotjar / CrazyEgg / any heatmaps
❌ Any external tracking scripts

The only external resource is cdnjs.cloudflare.com for the PDF library (html2pdf.bundle.min.js). This library runs entirely in your browser and sends no data.

🔐 5. HTTPS Everywhere

Your connection to rivo.lat is fully encrypted using TLS 1.2/1.3. This prevents:

🛡️ Eavesdropping (man-in-the-middle attacks)
🛡️ Tampering with your notes during transmission
🛡️ ISP tracking of your page content

                    ✅ Valid SSL certificate (Let's Encrypt)

                    ✅ HSTS enabled (HTTP automatically upgrades to HTTPS)

                    ✅ Grade A+ on SSL Labs (if tested)

🛡️ 6. Security Headers (CSP & Friends)

We enforce strict browser security policies:

Content-Security-Policy – Only allows scripts from 'self' and cdnjs
X-Frame-Options: DENY – Prevents clickjacking attacks
X-Content-Type-Options: nosniff – Stops MIME type sniffing
Referrer-Policy: no-referrer – No referer header sent
Permissions-Policy – Blocks camera, mic, geolocation, etc.

🚫 7. What We Never Do

❌ Request donations or payment (no PayPal, no Patreon, no Buy Me a Coffee)
❌ Show any advertisements (zero ads, zero banners)
❌ Ask for personal information (name, email, phone)
❌ Store or log IP addresses
❌ Use fingerprinting techniques
❌ Embed social media widgets or share buttons

🔍 8. Transparency & Verification

You can independently verify everything claimed here:

🔧 Open Browser DevTools (F12) → Network tab → See all requests (only 5-6 total)
🔧 Application tab → Cookies & Storage → Verify no cookies stored
🔧 Sources tab → Examine all JavaScript code (fully open source)
🔧 Use online tools like SecurityHeaders.com to check our grade

📅 9. Last Security Review

Date: April 17, 2026

Status: ✅ All security claims verified and active.

Contact (security only): security@rivo.lat (if you discover a vulnerability, please report responsibly)