Last updated: 27 October 2026
The short version: Riviera has no servers of its own, no analytics, no trackers, and no advertising. Your records stay on your iPhone and leave it only in features you choose to use (iCloud Sync, Apple TV, Shared Garage, exported backups and reports, Calendar and Reminders entries, and buttons or Shortcuts that hand a place, your car's position or your VIN to another app or website, such as Share, Copy, directions and the recall check) or inside an iCloud or computer backup of your iPhone, if you make one. To work, the app talks directly to Renault, Apple and a few public map, weather and fuel-price services, listed below. The app never sends anything to the developer by itself. Apart from anonymous crash and usage reports that Apple passes on if you opted in to share them, feedback sent through TestFlight, and anything you choose to send (such as an e-mail), the developer receives nothing.
Riviera is an independent, community-built iOS companion app for Renault connected vehicles, made by an individual developer. It is not affiliated with, endorsed by, or sponsored by Renault Group or any of its subsidiaries. Contact details are at the end of this page.
| Data | Where it is stored | Notes |
|---|---|---|
| My Renault e-mail and sign-in | iOS Keychain (this iPhone only; items are saved as this-device-only, so they are never synced and are not restored onto a different iPhone) | Your e-mail is sent to Renault when you type it to sign in; Riviera keeps it on the iPhone to label the account. Riviera also keeps the login token Renault issues, and a list of the accounts you have signed in with on this iPhone (each with its e-mail and its own login token) so you can switch between them, a beta feature in Settings. Signing out ends the current session but keeps that list until you use Delete All My Data. Riviera also keeps your Renault person ID and account ID in the Keychain and in its normal app storage, which a device backup includes, and, if you add one in Settings, your own Tankerkönig key. Keychain items can outlast deleting the app, so use Delete All My Data first if you want them gone. |
| Password | Never stored | Sent once, over an encrypted connection, only to Renault's sign-in service (Gigya) and never saved by Riviera. It is held in memory only while you are on the sign-in screen. iOS may separately offer to save it in your own password manager; that is your choice. Renault's login token handles later sign-ins until Renault expires it (about 30 days); then you type your password again. |
| Vehicle data (VIN, model, fuel or charge level, odometer, lock state, position) | On this device (and in a backup of this iPhone, if you make one), plus a summary copy in your personal iCloud if you switch on Apple TV sharing | Fetched from Renault's servers (the Gigya sign-in and the Kamereon vehicle API) and cached locally, together with tyre pressure, climate and window state, charging settings, and your connected-service and warranty contracts. Riviera also keeps, on the device: a log of the positions Renault reports for your car, for up to 90 days (older ones are dropped whenever a new one is saved); a cache of the 200 most recent street addresses for those places, kept until Delete All My Data; odometer readings for up to a year (used for lease mileage, the usage chart and service-due estimates); a list of the remote commands you sent and whether they succeeded; and, if you search fuel prices in Romania (or the low-fuel alert looks up the nearest station there), the stations and prices Riviera received, for up to four of those searches. The request carries the position rounded to about 100 metres (see "Where the app sends network requests"). Each search's result is filed under a point rounded to about 1 km, holds the stations within a radius of at least 10 km of that point, and is kept until a later search replaces it or you use Delete All My Data. Names you give places are described below. This is your car's position as Renault reports it, not your phone's. Signing out removes the cached copy of the car as last fetched (its details, latest readings and position) and the copies shown in widgets, Live Activities and on Apple TV. Everything else stays on the device after you sign out, until you use Delete All My Data: your fuel, service, repair, subscription and lease records; the position log and the odometer readings (they are trimmed to 90 days and a year only when a new one is saved, so nothing is trimmed while you stay signed out); the address cache (capped at the 200 most recent addresses); the command list (capped at the latest 30 commands for each car); the VIN and model name that key them; the car's position while an unlock reminder is armed; and the last fuel, odometer and lock values the app keeps to spot changes. |
| Fuel records, service history, repairs, subscriptions, lease and bank-credit details | On this device (and in a backup of this iPhone, if you make one); in your personal iCloud (its Drive container and key-value storage) if you enable iCloud Sync; and as a full copy in your private iCloud (CloudKit), visible to and changeable by the people you invite, if you use Shared Garage | Entered by you, except fuel fill-ups Riviera detects from the car's fuel level and service entries taken from Renault's service history. These records include dealer, lender and insurer names, notes, and who covered each cost (you, warranty or insurance). Charge sessions you log (or Riviera detects) are the exception: they stay on this device (and in a backup of this iPhone, if you make one) and are not part of iCloud Sync, Shared Garage or exports. Any names you give places are saved with the place's position, rounded to about 10 metres (on this iPhone, in iCloud Sync, in Shared Garage and in exports), and stay until you remove them. iCloud Sync is optional and off until you turn it on; it uses your private iCloud container and also copies your service schedule, the car's name, the names you gave places and settings such as language, country, currency and units. The developer has no access to it. A record you delete is not erased from its copies: it stays as a hidden "deleted" entry that still holds its original contents (amounts, notes, dealer and station names) on this iPhone, in any backup file you export, in the iCloud Sync files, and in the Shared Garage copy (yours, or the owner's if you joined theirs). Delete All My Data removes the ones on this iPhone, in your iCloud Sync files and in a Shared Garage copy you own. It does not remove them from other devices that already received them, from a Shared Garage you joined, or from backup files you saved. If you accept someone else's Shared Garage invitation and then choose one of your cars to merge it into, that car's records (and all your named places) are written into the owner's iCloud copy instead of one in your own iCloud, where the owner and everyone they invited can read them. |
| Documents and scans you attach | On this iPhone only | Photos, scans and PDFs you attach to service, repair and subscription records (insurance, vignette, road tax, inspection, driving licence and similar). Fuel receipts and lease contracts you scan are read to fill in the form and are not kept. Text is read on the device with Apple's text recognition and is not uploaded; the dealer, date, amount and up to four lines of work it finds are copied into the record you save, and go wherever that record goes. If you import a lease contract from Files, the file's name is saved in the lease record. The files are kept in the app's private folder, protected while the phone is locked, and left out of iCloud Sync, Shared Garage and device backups, but a record that uses one keeps a reference to it (a random file name), which syncs with the record. They go into a backup you export only if you turn on Include documents. |
| Backups you export | Wherever you choose to save them. Riviera also leaves the file it created in the app's temporary folder until iOS clears it or you run Delete All My Data. | Created only when you tap Export Backup (or Export Backup Before Deleting). A portable copy of the records you entered for the selected car: fuel, maintenance and service history, repairs, subscriptions, and lease and bank-credit details, plus the car's VIN, records you deleted in the app (kept as hidden entries) and all your saved place names, each with the map position it is attached to (to about 10 metres). It leaves out parking history, live vehicle data, the separate odometer log, the EV charge log and app settings. Odometer values stored in your fuel, service, repair and lease records (typed by you or taken from the car) are included. |
| History reports you export | Wherever you choose to save or share them. Riviera also leaves the file it created in the app's temporary folder until iOS clears it or you run Delete All My Data. | Created only when you tap Export History Report (a PDF or spreadsheet for a resale or lease return). It lists the car's service, repair, ownership and, if you choose, fuel records, and it names the car and its VIN. The PDF also embeds, as machine-readable transfer data, the car's full service, repair and ownership records and every fuel fill-up (with station names and notes), whether or not the visible pages list them, so the next owner can import them; prices are removed from that data unless you turn on Include prices. The lease-return version also prints the lease dates, allowance and odometer figures. Anyone you give the PDF to receives all of this. |
| Your phone's location | Your exact position is not stored | Asked for only while the app is open, and only when a screen needs it: to centre and sort charger and dealer searches on you, to show your position and distance from the car on the map, and to update the distance on the parked-car Lock Screen card when you start it or reopen the app. Fuel stations are sorted from your car's position, not your phone's. At first sign-in Riviera suggests your country from your phone's region setting; if you have already allowed location, it uses one reading instead, which Apple's geocoder turns into a country, and only the country is kept. The app language follows your phone until you choose one. Riviera has no background location tracking and never uses "Always" location. |
| Calendar and Reminders (optional) | The Calendar and Reminders apps on your device, in your default calendar and Reminders list as set in iOS Settings (which may sync to that account's provider) | If you allow it and tap Add to Calendar or Set Reminder on a service item, Riviera adds that service's estimated due date, titled "Riviera - service Service Due (estimated)", with the target kilometres, last service date, your current odometer reading and your estimated average daily distance in the notes; the title says "(rough estimate)" instead when the date is only a rough projection. Riviera updates or removes those entries itself when you change or delete the matching service item, and they follow wherever your default calendar or list is stored. It does not include the car's name or VIN, and lease and insurance dates are not added. Riviera keeps track of the entries by identifier and does not read your other events or reminders. |
| Camera and photos (optional) | Nothing extra is stored | If you allow the camera, Riviera uses it only when you tap Scan, to capture a document or receipt. Photos are picked in the iOS photo picker, so Riviera sees only the pictures you choose, never your photo library. Anything you keep is stored as described under "Documents and scans you attach". |
| Widgets and Lock Screen cards | On device | Widgets read a summary that Riviera copies to a container shared only with its own widget extension: the car's name and VIN, fuel or charge level, range, lock state, next service, average consumption, lease progress in kilometres (never money, in widgets), the parked position and your own label for it, and your language, units and theme. The street address is included only if you turn on Show address on Lock Screen. The Lock Screen and Dynamic Island cards are Live Activities (parked car, lock and unlock, pre-conditioning): Riviera hands iOS their content directly: the car's name and VIN, the parked position and time parked, the street address if address display is on, the parking-meter times, the distance from your phone to the car (worked out from a one-time location fix), and, for pre-conditioning, the fuel level, range, lock state and target temperature. They end when the activity finishes or you sign out. Notifications and Live Activities are created on your device. |
| Diagnostics log | On this iPhone (and in a backup of this iPhone, if you make one) | Recent app events and screen visits. It is not uploaded or synced by Riviera, and it leaves the device only if you choose to send it, or inside a backup of this iPhone if you make one. See Diagnostics. |
iCloud Sync and Apple TV are separate switches, off until you turn them on. Shared Garage has no switch: it starts when you tap Share Garage… (or open an invitation). All of them use Apple's iCloud under your own Apple ID; none uses a server run by the developer.
Riviera keeps a diagnostics log on your device so that a problem can be understood without asking you to reproduce it. It holds the most recent 160 app events (including lock readings and the times of remote commands and when the app launched or moved between the foreground and background) and up to 24 recent visits, with the time of each, to a handful of screens such as Controls, Consumption, Parking History and the maps.
Riviera never uploads this log, and it leaves your iPhone only if you choose to send it, or inside a backup of your iPhone (iCloud or computer) if you make one. Riviera has no server. Three things can send it, and each only acts when you tap it: Export Redacted Diagnostics, Report a Problem and the Send Report button on the "Something went wrong" card. Export lets you choose where the file goes; Report a Problem and Send Report prepare an e-mail addressed to the developer (riviera.appsupport@icloud.com), and nothing is sent until you send it. Export Redacted Diagnostics and Report a Problem show you the complete file first. Send Report builds the e-mail text itself instead of attaching a file: the same diagnostics, plus the time and the text of the error that triggered the card (redacted the same way); if no mail app can open the draft, it copies that text to your clipboard instead. These e-mails are sent from your own mail account, so the developer also sees the address and name you send from and anything you write; the redaction applies only to the diagnostics text.
The file you send holds the recorded events and screen visits plus your iOS version, your iPhone's model identifier (for example iPhone17,2) and screen size, the app version and build, your country, language and units, whether iCloud Sync, Beta and Demo Mode are on, a summary of your car's model, year, powertrain and connected services, the car's last reported lock and door state with its time, the times of unlock reminders and alerts and whether that alert is switched on, the names and end dates of its Renault connected-service contracts, whether its lock and remote commands work, its last eight remote commands with their times, how many automatic Renault reads the app has made recently, and, in some event lines, the address path of a Renault request (with the VIN and account identifiers masked).
Before an event is saved, Riviera removes anything that looks like an e-mail address, a VIN, a sign-in token, a coordinate pair written with four or more decimals or a number labelled latitude or longitude, and any account or person identifier, whether labelled (such as accountId=) or part of a Renault web address. It also removes the name you gave the car that was selected when the app started, if that name is at least three characters long. A rename, switching to another car or a first sign-in is covered only after the app is restarted. The app never logs your password and is written to avoid logging names, places and street addresses. The removal above covers only the items it lists: it does not recognise other names, place names or street addresses, and because it works by pattern it cannot recognise free text, so read the file before you send it.
You can read the recorded events at any time in Settings → Help & Support → Diagnostics → Diagnostics Log, and the complete file in the review step of Export Redacted Diagnostics. You can clear the log from the Diagnostics screen. When you export or report, Riviera also leaves the file it created in the app's cache folder (excluded from backups) until iOS clears it or you run Delete All My Data; Clear Diagnostics does not remove that copy. Delete All My Data removes the log and that file along with everything else.
Riviera communicates only with:
While the app is closed, a background refresh (at most about every 15 minutes, when iOS allows it) may contact Renault and update your widgets. If you use iCloud Sync, Shared Garage or Apple TV sharing, it may also update those iCloud copies, for example with a refill it detected and saved automatically. While notifications are allowed, it may also contact Open-Meteo (when a weather alert is on; the hail alert is on by default) and, when your fuel is low and the low-fuel alert is on (it is by default), a fuel-price provider for the nearest station, using your car's parked position rounded as above. Riviera never tracks your phone's location in the background.
Notifications and Lock Screen cards are created on your device. Riviera does not register for or send push notifications and has no server that could send them; iCloud itself may use Apple's push service to tell your devices that synced data changed.
Some buttons open a website or another app: for example Renault pages, official vehicle portals, dealer websites, Apple Maps, Google Maps or Waze for directions, Apple Weather, the phone dialler or your mail app. Those requests are made by your browser or that app, not by Riviera, and are governed by their own policies. Directions and weather buttons hand the exact position of your car or the place to that app (directions in Apple Maps or Google Maps also carry the name you gave the car; Waze and Apple Weather receive only the position), and the recall check adds your VIN to the link so Renault's page can pre-fill it. To offer your preferred maps app, Riviera checks whether Google Maps or Waze is installed.
Share and Copy buttons (the parked spot, the VIN, an address, a backup, a report) hand exactly what you chose to the iOS share sheet or clipboard, and where it goes next is up to you. Sharing the parked spot includes its exact coordinates. Riviera writes to the clipboard only when you tap a Copy button, or when you tap Send Report and no mail app can open the draft (it then copies the report text, which includes the redacted diagnostics). It never reads the clipboard.
iOS keeps a cache of the answers from the public providers, from Renault's public websites (the dealer locator and the accessories catalogue) and from the server that supplies your car's picture, on your device. The request addresses in it can contain the rounded position (dealer locator and map searches), your car's model codes (accessories), your VIN if the web address Renault supplies for your car's picture contains it, and, for German fuel searches, your own Tankerkönig key; cookies those sites set are stored and sent back on later requests. Only the Renault sign-in and vehicle-data sessions (Gigya and Kamereon) are not cached or stored this way. Delete All My Data clears both the cache and the cookies.
There are no Riviera servers. No analytics, advertising, crash-reporting or tracking SDKs are embedded, and the app contains zero third-party code dependencies. Separately from Riviera, Apple may give the developer anonymous crash reports and usage figures for the app (for example downloads and sessions) if you have switched on Share With App Developers in iOS Settings → Privacy & Security → Analytics & Improvements, and the feedback, screenshots and crash reports that TestFlight testers choose to send.
Riviera has no developer-side database. Your data is held on your device (and in any backup of your iPhone), by Renault for your connected-car account, and in the iCloud, Apple TV, Calendar, Reminders and Shared Garage features you choose to use. When a feature needs it, your car's position is sent to Apple as exact coordinates and, rounded to about 100 metres and together with your IP address, to Renault's dealer locator and to the public map, weather and fuel-price services listed above. For dealer and charger searches your phone's position is handled the same way. The one-time country check sends your phone's position to Apple only. Those services keep their own records under their own policies. You can see most of the data Riviera holds in the app (not the hidden "deleted" entries), export the records you entered as an Export Backup file (car by car; that file leaves out the position history, the separate odometer log, the EV charge log, the command list and settings, although odometer values inside your fuel, service, repair and lease records are included), and erase it, as described above, without asking the developer. For data in your Renault account, contact Renault. For anything you e-mailed to riviera.appsupport@icloud.com, write to that address and the developer will delete it on request. You can also complain to your local data-protection authority.
Riviera is intended for vehicle owners and is not directed at children under 16.
If this policy changes, the updated version will be published at this address with a new date.
Privacy questions: riviera.appsupport@icloud.com, or the contact address shown in the app under Settings → Help & Support.