Private rooms.
Open protocol.

Scope and controller

This notice applies to the Matrix homeserver at matrix.riverwood.town and the Sable web client provided at chat.riverwood.town. It supplements the privacy policy for the Riverwood website.

No data protection officer has been appointed. The homeserver is self-hosted by the controller in Germany. Optional client features described below connect to external providers.

What the homeserver processes

Account and profile

Your Matrix user ID, display name, avatar, account-creation time, account status, linked Mastodon identity, and any profile information you choose to provide.

Sessions, devices, and encryption

Access and refresh tokens, device identifiers and names, session dates, last-seen information, IP addresses, user-agent information, public device and cross-signing keys, one-time keys, and encrypted key backups if you enable them.

Rooms and communications

Room memberships and invitations, room names and settings, power levels and other state events, messages, edits, reactions, redactions, files, voice messages, call-signalling events, read receipts, typing and presence information, reports, and moderation records. What is visible to the server depends on whether a room uses end-to-end encryption.

Technical logs

Request time, IP address, requested endpoint, response status, user agent, and diagnostic or security events. Ordinary technical logs are retained for 20 days.

Signing in with Mastodon

Riverwood uses the Mastodon service at social.riverwood.town as its single sign-on provider. During sign-in, Matrix receives the stable account identifier and the profile claims configured for login, such as username, display name, or avatar. Matrix stores the external identifier so future sign-ins return you to the same Matrix account.

Your Mastodon password is entered on the Mastodon service and is not provided to the Matrix homeserver. Matrix creates its own session and device tokens after successful authentication. Deleting or disabling one account does not necessarily delete the other; contact privacy@riverwood.town if both should be removed.

Messages, files, and encryption

End-to-end encrypted rooms

In an encrypted room, compatible Matrix clients encrypt messages and files before uploading them. Riverwood stores and relays ciphertext and cannot normally read the content without a decryption key. Private keys remain on participating devices. If you enable secure key backup, the homeserver stores an encrypted backup that can be unlocked only with your recovery key or recovery method.

Encryption does not hide the information needed to operate Matrix. The homeserver still processes your Matrix ID, participating devices, room membership, event type and size, timestamps, delivery routing, and other protocol metadata. Room participants who possess the keys can read and copy decrypted content.

Unencrypted rooms

Messages and files in rooms without end-to-end encryption are stored in readable form. They are visible to participants according to the room’s access and history settings and are technically accessible to the controller. Administrative access is limited to what is necessary for maintenance, security, abuse handling, legal obligations, and data-subject requests.

HTTPS protects data while it travels between clients and Riverwood, but HTTPS alone does not make a room end-to-end encrypted. Check the room’s encryption indicator before sharing sensitive information.

Sable and push notifications

Push notifications are optional. When you enable them in the Sable web, Android, or iOS client, the client registers a “pusher” with the Riverwood homeserver. Riverwood then stores the gateway address, application identifier, device or application label, language, notification settings, a device-specific push key or token, and the time at which that key was updated. A push key is an identifier that permits notifications to be routed to a particular app installation.

Sable uses Matrix’s event_id_only format. When a notification rule matches, Riverwood sends the Sable-selected Sygnal gateway the room ID, event ID, unread and missed-call counts where applicable, delivery priority, application ID, push key and update time, and notification presentation settings. The request also exposes ordinary connection data such as its time and the homeserver’s IP address. Message content, sender name, and room name are not included in this gateway request. Sable retrieves the event from Riverwood and assembles the visible notification on your device. See Sable’s notification documentation.

The gateway relays the notification to the platform push provider: Apple Push Notification Service for Apple devices or Firebase Cloud Messaging for Android. The gateway and platform provider receive the push token and the technical delivery data needed to reach the device. These providers can associate delivery activity with an app installation and process it under their own privacy terms.

You can prevent this processing by leaving push notifications disabled. If you previously enabled them, disable push in Sable’s notification settings and revoke the app’s notification permission in your browser or operating system. Removing the pusher stops Riverwood from sending new notification requests to its gateway.

GIF search with GIPHY

Sable includes an optional GIF picker powered by the GIPHY API. When the client requests trending GIFs, performs a search, or loads GIPHY-hosted preview or media files, your device connects to services operated by Giphy, Inc. GIPHY can receive your IP address, browser and device information, request time, search terms, the GIFs viewed or selected, and identifiers or cookie information that your device sends. Search terms can themselves contain personal or sensitive information, so do not enter information you do not want to disclose to GIPHY.

GIPHY processes this information as an independent provider under its privacy policy. GIPHY states that its services are hosted and operated in the United States and that it participates in the EU–U.S. Data Privacy Framework. Riverwood does not receive GIPHY’s usage logs and cannot determine or control GIPHY’s retention periods or further processing.

You can avoid search-related transfers by not opening or using the GIF picker. A GIPHY-hosted GIF posted in a room can still cause a receiving client to contact GIPHY when it displays or downloads that media. A GIF you send becomes part of the room history and is then handled like other room content, including federation and retention described in this notice.

Federation and connected rooms

Matrix federation lets people on different homeservers join the same room. If a room contains a member from another homeserver, Riverwood sends that homeserver the room events it needs to maintain its copy. Depending on the room and encryption settings, this can include your Matrix ID, display name, avatar, membership and state events, messages, files, reactions, and encrypted event content.

Remote homeservers are operated independently and may keep their copies under different rules. Riverwood sends redactions and erasure-related updates through the protocol but cannot guarantee that every remote server or client deletes an existing copy. Remote homeservers can be located outside the European Union or European Economic Area.

Bots, bridges, widgets, integrations, and third-party clients can receive additional data when you add them, use them, or join a room containing them. Their operators act under their own privacy terms. If you want to avoid federation or third-country replication, use rooms containing only Riverwood accounts and do not add bridges, bots, or external widgets.

Purposes and legal bases

Providing Matrix

Account creation, authentication, rooms, messaging, media, encryption support, synchronisation, and federation are processed under Article 6(1)(b) GDPR to provide the communication service you request.

Optional notifications and GIF search

If you activate push notifications or request GIF search results, the data needed for that feature is processed under Article 6(1)(b) GDPR to provide the function you requested. GIPHY and the push providers determine their own legal bases for processing under their respective privacy terms.

Security and moderation

Logs, rate limits, abuse reports, moderation records, and measures against spam or attacks are processed under Article 6(1)(f) GDPR. The legitimate interests are protecting users and maintaining a secure, reliable service.

Legal duties

Data may be preserved or disclosed where required under Article 6(1)(c) GDPR or where necessary to establish, exercise, or defend legal claims.

Contact

Messages sent to Riverwood are handled under Article 6(1)(b) GDPR for account or service matters and Article 6(1)(f) GDPR for other enquiries.

A Matrix ID, linked authentication identifier, session and device data, room membership, and the events needed for requested communications are required to provide the service. Without them, Riverwood cannot create or operate a Matrix account. Display names, avatars, presence, read receipts, notifications, GIF search, and similar profile or convenience features are optional where the client provides a setting.

The Matrix service does not use personal data for advertising, visitor profiling, or automated decisions with legal or similarly significant effects. External providers may process data for their own purposes as described in their privacy terms.

Retention, redaction, and account deletion

Account and profile data are retained while the account is active. Room events and uploaded media do not have a general fixed expiry unless a room-specific or server retention policy applies. Matrix state events, including membership and room administration history, may need to remain to preserve the integrity and permissions of a room.

Push registrations remain on the homeserver until you or the client removes them, the provider reports the push key as invalid, or the related account is deleted. Notification delivery may leave short-lived technical logs covered by the ordinary 20-day log period. The Sable gateway, Apple, Google, and GIPHY set their own retention periods for data processed independently; consult their privacy information for details.

Redacting a message removes most of its content from the event served by cooperating homeservers, while a reduced event remains in the room history. Redaction cannot remove screenshots, downloads, quotations, notifications, or copies already held by participants or non-cooperating remote systems.

When an account is deactivated, active sessions and devices are revoked, the account leaves joined rooms, and account data and encryption keys held for the account are removed where supported. If erasure is requested, the profile is anonymised and the account is marked erased. Previously sent messages and files are not automatically deleted from room histories, and existing participants may retain access to their copies. Uploaded media and the external sign-on mapping may require a separate erasure request.

To deactivate the account and request erasure, use the account-management option offered by your Matrix client or email privacy@riverwood.town. Technical logs are normally deleted after 20 days; records connected with an incident or legal claim may be retained until the matter is resolved. Operational backups, where present, are isolated for disaster recovery and overwritten through the ordinary backup rotation.

Recipients and international transfers

Data is available to the room participants and devices permitted by each room’s configuration. Federated room data is also received by the operators of every participating homeserver. Bots, bridges, widgets, or other integrations receive data only when the relevant feature or room uses them.

If you enable Sable push notifications, recipients include the push gateway registered by Sable and the platform provider used by your device: Apple for APNs or Google for Firebase Cloud Messaging. The precise gateway URL and push key are stored in your Matrix pusher registration. Riverwood does not operate these external delivery services and cannot control their independent processing or server locations.

If you use GIF search or load GIPHY-hosted media, Giphy, Inc. in the United States receives the requests described above. GIPHY states that it relies on the EU–U.S. Data Privacy Framework for covered transfers. Its certification and privacy terms can change, so the current information linked in the GIPHY section applies.

Riverwood is self-hosted in Germany and does not use a separate hosting processor for the homeserver. Federation can nevertheless send data repeatedly to independently operated homeservers anywhere in the world when this is necessary to deliver the federated conversations you choose to join. Riverwood cannot select the location of another participant’s homeserver or provide contractual safeguards on its behalf. Consider this before joining a federated room or sending personal information.

Data may also be disclosed to public authorities where Riverwood is legally required to do so, or to legal and technical advisers where necessary to protect the service or handle a claim.

Your rights and contact

Where the legal requirements are met, you may request access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), and data portability (Article 20). Where processing is based on legitimate interests, you may object on grounds relating to your particular situation under Article 21 GDPR.

Send requests concerning Riverwood to privacy@riverwood.town. Riverwood may need to verify that you control the affected account. Protocol and federation constraints may limit erasure from copies held by other participants or independent homeservers; those limits will be explained when a request is handled. Requests concerning data held independently by Sable’s gateway, Apple, Google, or GIPHY must also be directed to the relevant provider.

You may complain to the Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden, or another competent supervisory authority.

Last revised: 24 September 2026 · Technical references: Matrix specification · Matrix Push Gateway API · Sable notifications · Matrix encryption guide · GIPHY privacy policy.