Privacy Policy

1. Who is responsible

Ripledd is operated by an individual (a natural person) established in the European Union. That person is the “data controller” for the processing described here.

Controller: Elias Kofler, operating as “Ripledd”. Contact for privacy matters and to exercise your rights: [email protected]. For content and abuse reports: [email protected]. A postal contact address is available on request.

We have not appointed a Data Protection Officer because we are not legally required to; the contact above reaches the person responsible.

2. What we collect and why

2.1 Joining the waitlist

When you submit the waitlist form we collect your email address, your device preference (iOS, Android, or “prefer not to say”), and the date and queue position assigned to you.

• Purpose: to email you when Ripledd opens, and to understand demand (how many people are waiting, on which platform).
• Legal basis: your consent, given when you submit the form (Art. 6(1)(a) GDPR). You can withdraw it at any time — use the unsubscribe link in any waitlist email or write to [email protected] — without affecting processing done before you withdrew.

2.2 Contacting support

The support form collects your name, email address, an optional Ripledd handle, the topic you pick, and the message you write. Please don’t include special-category data (health, beliefs, and so on) in the message.

• Purpose: to receive, answer, and keep a record of your request.
• Legal basis: our legitimate interest in running a support function and answering people who contact us (Art. 6(1)(f) GDPR); where your request relates to a pre-contractual step, Art. 6(1)(b) also applies.

2.3 Browsing the web viewer

The viewer at /app (also served at /home, /post/…, and /@handle) is read-only and anonymous — there is no account and no sign-in. When your browser loads content, requests go to our API (“ripledd-gateway”), which we self-host and expose to the internet through a Cloudflare tunnel. That server records standard technical log data: IP address, user-agent string, timestamp, and the resource requested; Cloudflare, as the proxy in front of it, processes the same connection data in transit (see section 5).

• Purpose: to deliver the content you asked for, keep the service secure (abuse and rate-limit protection), and diagnose faults.
• Legal basis: our legitimate interest in operating, securing, and maintaining the service (Art. 6(1)(f) GDPR).

2.4 Content shown in the viewer

Posts, images, handles, and profile details displayed in the viewer are published by Ripledd users and hosted on our infrastructure (see section 5). If content in the viewer is about you and you want it removed, contact [email protected] or [email protected].

2.5 The internal admin area

/admin is staff-only. It uses Google sign-in through Supabase Auth, which processes the signing-in person’s email, name, profile picture, and authentication tokens. Legal basis: our legitimate interest in securing internal tooling (Art. 6(1)(f) GDPR).

3. Analytics and advertising

3.1 Vercel Speed Insights

Every page loads Vercel Speed Insights, which reports aggregate performance metrics (Core Web Vitals). It sets no cookies, does not build a profile, and does not identify you. Because it is not used to track individuals, it runs without a consent prompt, on the basis of our legitimate interest in a fast site (Art. 6(1)(f) GDPR).

3.2 Google Analytics 4 — consent required

Google Analytics 4 (measurement ID G-GTMF8RHMLG) loads only if you opt into the “Analytics” category in the cookie banner. Until then, nothing is requested from Google and no analytics cookie is set.

• What it does: sets _ga / _ga_<id> cookies and measures pages viewed, sessions, approximate location (country / region, derived from a shortened IP), and device and browser type. GA4 does not log or store full IP addresses.
• Processor: Google Ireland Ltd. / Google LLC.
• Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy cookie rules). Withdraw any time via “Cookie settings” in the footer — we delete the GA cookies when you do.
• Retention at Google: up to 14 months for user- and event-level data.

3.3 Google AdSense — consent required, currently off

The viewer contains an integration for Google AdSense but it is not active (no ad account is connected). If it is switched on in future, it will load only if you opt into the “Advertising” category. It may then set cookies to display ads, cap how often you see them, and measure ad performance. Personalised advertising stays off unless you consent. Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy cookie rules).

4. Cookies and local storage

Manage or change your choice at any time through “Cookie settings” in the footer. Your choice is stored on your device only — we keep no server-side copy of it.

5. Who processes your data

The API (ripledd-gateway) runs on hardware we operate ourselves in Austria; it is not outsourced to a hosting provider. Apart from that, we do not sell personal data and share it only with the service providers below, each acting as our processor under a data-processing agreement, or where the law requires disclosure.

6. International transfers

Some providers are established outside the European Economic Area, mainly in the United States (Google, Vercel, Cloudflare). Where data is transferred there, it is protected by the EU–US Data Privacy Framework (for certified recipients) and/or the European Commission’s Standard Contractual Clauses, together with additional technical and organisational safeguards. You can ask us for a copy of the relevant safeguard.

7. How long we keep data

• Waitlist entries: until Ripledd launches plus a short transition period, or until you ask to be removed — whichever comes first.
• Support requests: up to 24 months after the request is resolved, then deleted or anonymised.
• Server and API logs: normally 30–90 days, then rotated and deleted, unless an entry is needed longer to investigate an incident.
• Analytics data: per Google’s retention setting, at most 14 months.
• Your cookie-consent choice: stored on your device until you clear it.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and get a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict processing, or object to it — including to any processing we base on legitimate interests, and at any time to direct marketing;
• receive data you gave us in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing carried out beforehand.

To exercise any of these, email [email protected]. We reply within one month. You also have the right to complain to your local data protection authority — for EEA authorities see edpb.europa.eu.

9. Children

The site and Ripledd are not directed at people under 16 (or the higher digital-consent age set by your country, where applicable). We do not knowingly process the personal data of children below that age. If you believe a child has given us data, contact [email protected] and we will delete it.

10. Security

We use transport encryption (HTTPS) everywhere, access controls on our systems, and established infrastructure providers. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data and to notify you and the authorities of a breach where the law requires.

11. Changes to this policy

We may update this policy. We will change the “last updated” date above, and for material changes that affect a basis of consent we will show the cookie banner again so you can re-confirm your choice.

12. Contact

See also our Terms of Service.