Privacy Policy

This policy explains how personal data is handled when you use Ripledd — both the website ripledd.com (the waitlist, the information and support pages, the internal admin area, and the public and signed-in web app) and the Ripledd mobile app for iOS and Android. It is written to meet the EU General Data Protection Regulation (GDPR) and the ePrivacy rules on cookies.

On this page

• 1. Who is responsible
• 2. What this policy covers
• 3. What we collect and why
• 4. Analytics and advertising
• 5. Cookies and local storage
• 6. Who we share data with
• 7. International transfers
• 8. How long we keep data
• 9. Deleting your account
• 10. Your rights
• 11. Children
• 12. Security
• 13. Changes to this policy
• 14. Contact

1. Who is responsible

Ripledd is operated by an individual (a natural person) established in the European Union. That person is the "data controller" for the processing described here.

Controller: Elias Kofler, operating as "Ripledd". Contact for privacy matters and to exercise your rights: privacy@ripledd.com. For content and abuse reports: abuse@ripledd.com.

The privacy contact above reaches the person responsible for handling data-protection questions and rights requests.

2. What this policy covers

• The website (ripledd.com): the waitlist, the information pages, the support form, the staff-only /admin area, and the web app. Public content is available without signing in; an account enables posting and interactions. Public URLs include /home, /photo/…, /thought/… and /@handle; older /app and /post/… links redirect to their current equivalents.
• The app: the web and native iOS/Android clients, where you sign in, build a profile, post images and text, follow people, and receive notifications.

Where a section applies to only one of the two, it says so.

3. What we collect and why

3.1 Website — joining the waitlist

When you submit the waitlist form we collect your email address, your device preference (iOS or Android), and the date and queue position assigned to you.

• Purpose: to email you when Ripledd opens, and to understand demand.
• Legal basis: your consent, given when you submit the form (Art. 6(1)(a) GDPR). You can withdraw it at any time — use the unsubscribe link in any waitlist email or write to privacy@ripledd.com — without affecting processing done before you withdrew.

Email preferences are stored separately from your waitlist entry and account. We record your email address, the optional email categories you agreed to, the consent source and date where available, and changes to those preferences. The unsubscribe link in an optional Ripledd email stops all optional emails for that address, including future campaigns. We retain the opt-out record to honor your choice; joining the waitlist again does not automatically undo it. Essential account emails, such as verification codes and password resets, continue when needed. Waitlist consent alone does not subscribe you to other optional email categories.

3.2 Website — contacting support

The support form collects your name, email address, an optional Ripledd handle, the topic you pick (report / technical / other), and the message you write. Please don't include special-category data (health, beliefs, and so on) or passwords and payment details in the message.

• Purpose: to receive, answer, and keep a record of your request.
• Legal basis: our legitimate interest in running a support function and answering people who contact us (Art. 6(1)(f) GDPR); where your request relates to a pre-contractual step, Art. 6(1)(b) also applies.

3.3 Website — public browsing and the web app

You can browse public content without an account. Signing in enables account features, whose data processing is explained in sections 3.6–3.15. Requests go to our API ("ripledd-gateway"), operated on our infrastructure through Cloudflare. Connection data such as IP address, user-agent, timestamp and requested resource is processed to deliver requests, maintain security and diagnose faults. Optional analytics is separate and disabled by default.

Legal basis: contractual or pre-contractual necessity where applicable (Art. 6(1)(b) GDPR), and our legitimate interests in service availability, security, abuse prevention and fault diagnosis (Art. 6(1)(f) GDPR).

3.4 Website — content shown in the public web app

Posts, images, handles, and profile details displayed in the public web app are published by Ripledd users and hosted on our infrastructure (see section 6). If content in the public web app is about you and you want it removed, contact privacy@ripledd.com or abuse@ripledd.com.

3.5 Website — the internal admin area

/admin is staff-only. It is gated by a password and then a sign-in through Supabase Auth (Google, Apple, or email code), which processes the signing-in person's email, name, profile picture, and authentication tokens. Legal basis: our legitimate interest in securing internal tooling (Art. 6(1)(f) GDPR).

3.6 App — account and sign-in

You create an account with email and a password, or with Sign in with Google or Sign in with Apple.

• Email sign-up: we store your email address and a securely hashed password (hashing is done by Supabase Auth — we never see the plain password). A 6-digit code is emailed to confirm the address. Before you enter a password, the app checks whether an email already has an account so it can send you to the right screen (sign in vs create account).
• Google: we receive your email address, name, profile picture, and a Google account identifier.
• Apple: we receive your name (only on the very first authorisation) and either your real email or Apple's private relay email, plus an Apple user identifier.
• Sessions: after sign-in, authentication tokens (a JWT access token and a refresh token) are stored on your device. If you add more than one account to the in-app account switcher, each account's refresh token and a little profile chrome (name, handle, avatar URL) are kept in your device's storage so you can switch between them (up to six).

Purpose: to create and secure your account and keep you signed in. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR); for the "does this email have an account" check, our legitimate interest in a usable sign-in flow and in limiting blind credential-stuffing (Art. 6(1)(f)).

3.6.1 Terms acceptance and privacy information

We record your account ID, accepted Terms version, acceptance timestamp and the Privacy Policy version provided alongside the Terms. Acceptance is checked per account and version, not on each login or device. Existing accounts without a record are asked once; we do not fabricate earlier acceptance. A privacy notice is information, not blanket consent to data processing.

Purpose and legal basis: managing the account agreement (Art. 6(1)(b) GDPR) and our legitimate interest in evidence of the agreement (Art. 6(1)(f) GDPR). Optional analytics and email choices are not required for acceptance.

3.6.2 Optional email choices

Account signup and waitlist signup create or reuse one subscriber record per normalized email address. This identity record does not itself grant consent. Optional topics are launch/waitlist announcements, product news and activity emails. New account topics are off by default. We preserve a waitlist subscription only when you separately requested it; it does not grant consent to the other topics.

In Settings → Privacy & emails, verified account holders can change each topic or unsubscribe from all optional emails. Every optional email includes a universal unsubscribe link. We record consent source, timestamps and changes, and retain a global opt-out to prevent future imports from resubscribing you. Re-enabling one topic after a global opt-out enables only that topic. Changing your account email does not transfer consent from the old address. Account deletion stops optional emails to its current address unless another active account still uses that address. Verification, recovery, security and necessary legal/service notices remain separate and must not be used to send promotions.

Legal basis: consent for optional email delivery (Art. 6(1)(a) GDPR and §174 TKG 2021), and our legitimate interest in maintaining preference and suppression evidence (Art. 6(1)(f) GDPR). No new topic is enabled merely because you signed in, accepted the Terms, or were added to a subscriber table.

3.7 App — your profile

Your profile holds a username / handle, a display name, an optional bio (up to 160 characters), an optional avatar image, one optional external link with a label, and public counts (followers, following, posts, likes). Your profile and these fields are public — visible in the app and in the web app at /@handle.

Purpose: to give you an identity other people can find and follow. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

3.8 App — content you create

When you post, we process the images you choose, any text / caption or "thought", comments and replies, and @-mentions of other users.

• Images you pick are uploaded to our API and re-encoded server-side into three JPEG sizes (thumbnail, medium, full). Re-encoding removes embedded file metadata, including camera EXIF data and any GPS location tags — we do not read, keep, or attach that data.
• Finished images are stored in Cloudflare R2 object storage and delivered through a CDN (cdn.ripledd.com). Anything you post publicly is public: it can be viewed in the app and on the website by its public URL (ripledd.com/photo/… or ripledd.com/thought/…), and other users can reply to it.
• Text-only "thoughts" and comments skip the image steps.

Purpose: to store, display, and distribute the content you publish. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

3.9 App — follows, likes, bookmarks

We record who you follow, the posts you like, and the posts you bookmark (bookmarks are private to you). Follows and likes are visible to others as counts and, for follows, as connection lists.

Purpose: to build your feed, show interaction counts, and let people see their followers. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

3.9.1 App — blocking and abuse reports

When you block an account, we store your account ID, the blocked account ID, the time of the block, and, if applicable, the source post or comment ID. We use this relationship to hide content, prevent interactions, remove existing follows, and manage your blocked-users list. A copy of your safety settings is cached on your device to keep blocked content hidden when offline.

Blocking also creates a private support/moderation report containing the reporter’s account ID, name and handle, the blocked account’s ID and handle, and the source content ID when provided. Reporting a post or comment similarly identifies the reporter and content, and includes the reporter’s account email if available. These records are available to Ripledd for abuse review; we do not send a block notification to the blocked account or publish your blocked-users list.

Purpose and legal basis: providing account safety controls as part of our service (Art. 6(1)(b) GDPR) and our legitimate interests in investigating abuse and protecting users (Art. 6(1)(f) GDPR). Blocks remain until you unblock the account or either account is deleted. Moderation reports follow the support request retention period in section 8; unblocking does not withdraw a report.

3.10 App — search and automated image understanding

To power search, every post's image(s) and caption are processed by our own CLIP model (running on the self-hosted "ripledd-inference" service) to produce numeric vector embeddings. The embeddings, plus each image's pixel dimensions, are stored alongside the post. When you run a search, the text you type is sent to our API and turned into a vector so it can be compared against post vectors; search text is not stored beyond ordinary server logs. Recent searches are kept only on your device.

There is no third-party AI provider involved and this processing does not make any decision that has a legal or similarly significant effect on you.

Purpose: semantic and similarity search of public posts. Legal basis: performance of our contract with you and our legitimate interest in a useful search feature (Art. 6(1)(b) and (f) GDPR).

3.11 App — post views

While you are signed in, opening a post records a view: the post ID, your user ID, which screen it was seen on (feed, detail, or thought), the carousel slide index, and a timestamp. Views are rate-limited to one per post per minute and capped at 100 per post per user. They drive the public view count on a post. This first-party viewing history is separate from optional PostHog analytics and is recorded regardless of the optional analytics choice. It is not forwarded to PostHog. We intend to use viewing history for future relevant content recommendations; personalised recommendations based on this history are not currently served. Before introducing that use, we will explain its operation and available controls and assess its lawful basis.

Purpose: to show creators how much reach a post has. Legal basis: our legitimate interest in basic post analytics for creators (Art. 6(1)(f) GDPR).

3.12 App — notifications and push

When someone likes, comments on, replies to, follows, or @-mentions you, we create a notification record (type, who did it, which post, read state, timestamps). You can turn each category on or off in settings; those preferences are stored server-side.

If you grant the OS notification permission, we register an Expo push token and your platform (iOS or Android) so we can send phone push notifications. The push token is deleted when you sign out, when you use "Reset App", or when the push provider reports it as no longer valid. A push message sent to your device contains the other person's name, a short preview of the post text, and the other person's avatar image. Push is delivered via Expo's push service and then Apple's or Google's push transport (see section 6).

Purpose: to tell you about activity involving you. Legal basis: performance of our contract with you for the in-app notification list (Art. 6(1)(b) GDPR); your device-level permission (consent) for OS push notifications, which you can withdraw at any time in your device settings or in the app.

3.13 App — device permissions

• Photo library: requested so you can pick images to post or set an avatar. The app only reads the specific photos you select — it does not scan or index your library. On iOS, a picked photo stored in iCloud may be downloaded to a local file so it can be uploaded.
• Notifications: requested so we can send push notifications (see 3.12).

Both permissions are optional, are asked for during onboarding (and again at the point of use), and can be declined or later changed in your device settings. The app does not request or use your location, contacts, microphone, or camera roll beyond the photos you explicitly choose.

3.14 App — data stored on your device

The app keeps a local cache to work quickly and offline: an on-device SQLite database (cached profiles, follow states, your own user row) and key–value storage (your session tokens, theme and accent choice, the onboarding-complete flag, your recent searches, a notification-badge preference, the multi-account switcher vault, and your optional-analytics choice). This data stays on your device; "Reset App" in Settings → Danger Zone clears all of it and signs you out.

3.15 Website and app — technical log data

Our self-hosted API ("ripledd-gateway") logs the IP address, user-agent, request path, and timestamp of requests; the self-hosted embedding service logs the calling IP for rate-limiting. The app also periodically contacts Expo's update servers to check for over-the-air JavaScript updates, which involves basic device and app-runtime information. The mobile app has no crash-reporting SDK. Its optional PostHog analytics is described separately in section 4.3 and does not capture exceptions or logs.

• Purpose: delivering requests, security and abuse prevention, rate limiting, debugging, and shipping fixes.
• Legal basis: our legitimate interest in operating and securing the service (Art. 6(1)(f) GDPR).

4. Analytics and advertising

Ripledd currently shows no advertising and uses no advertising SDK. Optional analytics is off by default. Turning it down does not remove any account feature. The web app and native app use device-local choices in Settings → Privacy & emails; marketing/information pages have their own browser-local choice under Privacy settings in the footer. A choice on one surface does not silently enable tracking on another device or surface.

A valid saved choice is remembered for up to 180 days. When a grant expires or no longer matches the disclosed purpose, analytics remains off; we do not force a login prompt. You can review and enable it in settings. Both refusals and grants are respected. Where supported, Do Not Track or Global Privacy Control keeps optional browser analytics off.

4.1 Technical performance

The website no longer loads the Vercel Speed Insights browser SDK. Server-side request handling and proportionate fault/security monitoring are described in section 3.15. They are separate from optional client-side analytics; describing a browser SDK as “cookieless” would not by itself remove consent requirements.

4.2 PostHog — marketing and information website

The website sends optional, explicitly allowed events to Ripledd’s gateway only when you enable analytics through Privacy settings. The staff-only /admin area and standalone unsubscribe page are excluded. The browser does not load a PostHog SDK or contact PostHog directly.

The gateway builds a new payload with the event name and approved categorical properties, such as a broad page area, feature category or outcome. It excludes account IDs, names, handles, email addresses, post IDs, exact URLs and paths, queries, search text, form values, referrers, client IP addresses, browser/device headers and cookies. Arbitrary property values are rejected even when their field name is allowed. Replay, profiles, advertising and fingerprinting are not used. Events are sent promptly, rather than as weekly totals.

Every forwarded event receives a new random event-only identifier, with no user/session identifier or identity mapping. Event timestamps are rounded down to the hour. PostHog sees the gateway’s network connection, not the visitor’s. PostHog Cloud EU processes these limited events in Frankfurt; person-profile processing and GeoIP enrichment are disabled. This prevents deliberate linkage through a shared analytics identifier, but timing and unusual combinations may still allow correlation. We do not promise absolute anonymity or treat this relay as an exemption from consent. Ripledd’s infrastructure necessarily handles the incoming connection; its proportionate security processing remains separate.

Legal basis: consent (Art. 6(1)(a) GDPR). Withdrawal stops new optional contributions; an event already sent cannot be recalled. No persistent analytics identifier, session history or delivery queue is kept on your device.

4.3 PostHog — web and native app

The app uses the same gateway relay only if you enable Share usage analytics in Settings → Privacy & emails. This choice is local to this device/browser, not automatically copied to another device or Ripledd surface. The app loads no PostHog SDK. No optional analytics checkbox appears during authentication.

Allowed events describe broad screen areas, feature actions, authentication outcomes, content categories, interaction states and search-result count ranges. The same server-side restrictions described in section 4.2 apply. No account, post or session identifiers, client IPs, exact paths, content, free text, auth or push tokens, recordings or crash reports are forwarded. Each event gets a fresh identifier; the gateway retains no link from that identifier to an account.

Legal basis: consent (Art. 6(1)(a) GDPR). Declining or withdrawing this choice does not turn off the first-party post-view records described in section 3.11. Those are separate service records, never included in PostHog payloads. The same terminal-access principles apply to native apps as to web storage.

4.4 Operational data without optional analytics

Account, content and other records necessary to provide requested functions, and proportionate security/availability logs, are processed under the purposes and legal bases in section 3. Administrative totals can be calculated from those service records (for example account or post counts). This does not permit hidden clickstream tracking, fingerprinting, cross-device profiling or unrestricted reuse of identified activity. Optional analytics being off is not bypassed by moving the same tracking to a server. Retention and access controls apply to the underlying personal data even where the resulting total is anonymous.

5. Cookies and local storage

We explain essential storage rather than requiring an “accept all” action. Cookies and other terminal storage/access are assessed by purpose under §165(3) TKG 2021. Storage strictly necessary for a feature you request can be used without a separate opt-in; optional analytics is subject to its own choice. This applies to local storage and native device storage as well as cookies.

We set no advertising cookies or persistent PostHog analytics identifiers. Details of an OAuth provider's storage are governed by that provider's own notice. You can remove local data through browser/device controls or Settings → Danger Zone → Reset App. Clearing login storage may sign you out; resetting the device does not delete your account or its saved terms acceptance.

6. Who we share data with

The API (ripledd-gateway) and the embedding service (ripledd-inference) run on hardware we operate ourselves in Austria; they are not outsourced to a hosting provider. We do not sell personal data. We use the providers below for their stated roles. Infrastructure/analytics processing requires the appropriate processing arrangements and transfer safeguards; authentication providers and app stores may also act as independent controllers under their own notices. The presence of a provider in this list is not consent to optional analytics or proof of a blanket exemption from data-protection requirements.

We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and security of Ripledd, our users, or the public — including reporting content that sexualises minors to the competent authorities.

7. International transfers

Some providers are established outside the European Economic Area, mainly in the United States (Cloudflare, Expo, Google, Apple). PostHog analytics data is sent to its EU Cloud region in Germany. Where other data is transferred there, it is protected by the EU–US Data Privacy Framework (for certified recipients) and/or the European Commission's Standard Contractual Clauses, together with additional technical and organisational safeguards. You can ask us for a copy of the relevant safeguard.

8. How long we keep data

• Account and profile: until you delete your account (see section 9).
• Posts, images, captions, comments, and their embeddings: until you delete them or your account. Deleting a post removes the database rows immediately; the stored image files are purged on a short cycle and may persist briefly in CDN caches and routine backups.
• Blocks: until you unblock or either account is deleted; related moderation reports follow the support-request retention period below.
• Follows, likes, bookmarks: until you undo them or delete your account.
• Notifications: on a rolling window of up to about 12 months, then pruned; an emptied placeholder row may be kept for like entries to enforce push cool-downs.
• Push tokens: until you sign out, use "Reset App", or the token becomes invalid.
• Post-view records: retained only while needed to measure post reach, limit repeated counting and evaluate feed performance. A planned recommendation feature is not by itself a reason to keep identifiable history indefinitely. We assess whether individual viewing records are still needed for those purposes and delete or irreversibly anonymise them when they are no longer needed. Anonymous aggregate counts may be kept longer.
• Support requests: up to 24 months after the request is resolved, then deleted or anonymised.
• Server and API logs: normally 30–90 days, then rotated and deleted, unless an entry is needed longer to investigate an incident.
• Terms acceptance: version and acceptance date for the life of the account; removed with it.
• Email preferences and suppression: while needed to manage requested subscriptions, honor an opt-out and demonstrate the choice; rights requests are handled through the privacy contact. Account deletion stops optional mail but does not automatically remove suppression evidence.
• PostHog analytics: limited website and app events retained only while needed to evaluate feature usage, compare releases and understand usage trends. We assess continued need based on those purposes, the age and detail of the events, and whether anonymous aggregate statistics can meet the same need. Any events that remain personal data are deleted or irreversibly anonymised when no longer needed. Anonymous aggregate statistics may be kept longer. Turning analytics off stops new capture; requests to erase existing data are handled through the privacy contact. No visitor profile or shared visitor/session identifier is created by this relay. Events captured before this relay was introduced may still contain the earlier temporary identifiers; this change does not retroactively anonymise them. The local consent choice expires after 180 days without a forced prompt.
• Waitlist entries: until Ripledd launches plus a short transition period, or until you ask to be removed — whichever comes first.
• On-device data: until you clear it, use "Reset App", or uninstall.

9. Deleting your account

You can delete your account in Settings → Danger Zone → Delete Account. This removes your account and associated profile, posts, comments, likes, bookmarks, follows, blocks, notifications, push tokens, and embeddings. Stored media may remain briefly in CDN caches or routine backups. Limited support and moderation records may be retained for abuse investigations and according to section 8.

You can also request deletion by emailing privacy@ripledd.com from the account’s email address (or providing your handle). We respond to deletion requests within 30 days, subject to applicable legal retention requirements.

Signing out, or using "Reset App" in Settings → Danger Zone, only clears data from your device — it does not delete your account or your content.

To have a waitlist entry, support records, or analytics data deleted, email the same address. Because the new relay assigns an independent random identifier to each event and sends no account details, we cannot reliably locate a new event as yours. Earlier events may contain temporary identifiers; turning analytics off always stops future collection.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and get a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict processing, or object to it — including to any processing we base on legitimate interests, and at any time to direct marketing;
• receive data you gave us in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing carried out beforehand.

To exercise any of these, email privacy@ripledd.com. We reply within one month. You also have the right to complain to your local data protection authority — for EEA authorities see edpb.europa.eu.

11. Children

Ripledd is not directed at people under 16 (or the higher digital-consent age set by your country, where applicable). We do not knowingly process the personal data of children below that age. If you believe a child has given us data, contact privacy@ripledd.com and we will delete it.

12. Security

We use transport encryption (HTTPS) everywhere, signed-token (JWT) authentication, password hashing handled by Supabase Auth, per-user scoping of stored files, rate limiting, and access controls on our self-hosted infrastructure. Our backend embedding service is reachable only from our own API, protected by a shared secret and network isolation. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data and to notify you and the authorities of a breach where the law requires.

13. Changes to this policy

We may update this policy. We will change the "last updated" date above, and for material changes we will take reasonable steps to notify you — on the website or in the app. Information updates do not require blanket acceptance of the Privacy Policy. If an optional purpose materially changes, the old grant is not used for the new purpose: it remains off until you choose to enable it in settings. Ordinary sign-ins do not trigger a new consent request.

14. Contact

• Privacy questions and rights requests: privacy@ripledd.com
• Content and abuse reports: abuse@ripledd.com
• General support: support@ripledd.com

See also our Terms of Service.