Privacy Policy

This policy explains how personal data is handled when you use Ripledd — both the website ripledd.com (the waitlist, the information and support pages, the internal admin area, and the read-only web viewer of public Ripledd content) and the Ripledd mobile app for iOS and Android. It is written to meet the EU General Data Protection Regulation (GDPR) and the ePrivacy rules on cookies.

On this page

• 1. Who is responsible
• 2. What this policy covers
• 3. What we collect and why
• 4. Analytics and advertising
• 5. Cookies and local storage
• 6. Who we share data with
• 7. International transfers
• 8. How long we keep data
• 9. Deleting your account
• 10. Your rights
• 11. Children
• 12. Security
• 13. Changes to this policy
• 14. Contact

1. Who is responsible

Ripledd is operated by an individual (a natural person) established in the European Union. That person is the "data controller" for the processing described here.

Controller: Elias Kofler, operating as "Ripledd". Contact for privacy matters and to exercise your rights: [email protected]. For content and abuse reports: [email protected]. A postal contact address is available on request.

We have not appointed a Data Protection Officer or an Art. 27 representative because we are not legally required to; the contact above reaches the person responsible.

2. What this policy covers

• The website (ripledd.com): the waitlist, the information pages, the support form, the staff-only /admin area, and the anonymous read-only web viewer served at /app, /home, /post/… and /@handle.
• The mobile app: the account-based iOS/Android client, where you sign in, build a profile, post images and text, follow people, and receive notifications.

Where a section applies to only one of the two, it says so.

3. What we collect and why

3.1 Website — joining the waitlist

When you submit the waitlist form we collect your email address, your device preference (iOS or Android), and the date and queue position assigned to you.

• Purpose: to email you when Ripledd opens, and to understand demand.
• Legal basis: your consent, given when you submit the form (Art. 6(1)(a) GDPR). You can withdraw it at any time — use the unsubscribe link in any waitlist email or write to [email protected] — without affecting processing done before you withdrew.

3.2 Website — contacting support

The support form collects your name, email address, an optional Ripledd handle, the topic you pick (report / technical / other), and the message you write. Please don't include special-category data (health, beliefs, and so on) or passwords and payment details in the message.

• Purpose: to receive, answer, and keep a record of your request.
• Legal basis: our legitimate interest in running a support function and answering people who contact us (Art. 6(1)(f) GDPR); where your request relates to a pre-contractual step, Art. 6(1)(b) also applies.

3.3 Website — browsing the web viewer

The viewer is read-only and anonymous — there is no account and no sign-in. When your browser loads content, requests go to our API ("ripledd-gateway"), which we self-host and expose to the internet through a Cloudflare tunnel. That server records standard technical log data: IP address, user-agent string, timestamp, and the resource requested; Cloudflare, as the proxy in front of it, processes the same connection data in transit (see section 6).

• Purpose: to deliver the content you asked for, keep the service secure (abuse and rate-limit protection), and diagnose faults.
• Legal basis: our legitimate interest in operating, securing, and maintaining the service (Art. 6(1)(f) GDPR).

3.4 Website — content shown in the viewer

Posts, images, handles, and profile details displayed in the viewer are published by Ripledd users and hosted on our infrastructure (see section 6). If content in the viewer is about you and you want it removed, contact [email protected] or [email protected].

3.5 Website — the internal admin area

/admin is staff-only. It is gated by a password and then a sign-in through Supabase Auth (Google, Apple, or email code), which processes the signing-in person's email, name, profile picture, and authentication tokens. Legal basis: our legitimate interest in securing internal tooling (Art. 6(1)(f) GDPR).

3.6 App — account and sign-in

You create an account with email and a password, or with Sign in with Google or Sign in with Apple.

• Email sign-up: we store your email address and a securely hashed password (hashing is done by Supabase Auth — we never see the plain password). A 6-digit code is emailed to confirm the address. Before you enter a password, the app checks whether an email already has an account so it can send you to the right screen (sign in vs create account).
• Google: we receive your email address, name, profile picture, and a Google account identifier.
• Apple: we receive your name (only on the very first authorisation) and either your real email or Apple's private relay email, plus an Apple user identifier.
• Sessions: after sign-in, authentication tokens (a JWT access token and a refresh token) are stored on your device. If you add more than one account to the in-app account switcher, each account's refresh token and a little profile chrome (name, handle, avatar URL) are kept in your device's storage so you can switch between them (up to six).

Purpose: to create and secure your account and keep you signed in. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR); for the "does this email have an account" check, our legitimate interest in a usable sign-in flow and in limiting blind credential-stuffing (Art. 6(1)(f)).

3.7 App — your profile

Your profile holds a username / handle, a display name, an optional bio (up to 160 characters), an optional avatar image, one optional external link with a label, and public counts (followers, following, posts, likes). Your profile and these fields are public — visible in the app and in the website's read-only viewer at /@handle.

Purpose: to give you an identity other people can find and follow. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

3.8 App — content you create

When you post, we process the images you choose, any text / caption or "thought", comments and replies, and @-mentions of other users.

• Images you pick are uploaded to our API and re-encoded server-side into three JPEG sizes (thumbnail, medium, full). Re-encoding removes embedded file metadata, including camera EXIF data and any GPS location tags — we do not read, keep, or attach that data.
• Finished images are stored in Cloudflare R2 object storage and delivered through a CDN (cdn.ripledd.com). Anything you post publicly is public: it can be viewed in the app and on the website by its public URL (ripledd.com/post/…), and other users can reply to it.
• Text-only "thoughts" and comments skip the image steps.

Purpose: to store, display, and distribute the content you publish. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

3.9 App — follows, likes, bookmarks

We record who you follow, the posts you like, and the posts you bookmark (bookmarks are private to you). Follows and likes are visible to others as counts and, for follows, as connection lists.

Purpose: to build your feed, show interaction counts, and let people see their followers. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

3.10 App — search and automated image understanding

To power search, every post's image(s) and caption are processed by our own CLIP model (running on the self-hosted "ripledd-inference" service) to produce numeric vector embeddings. The embeddings, plus each image's pixel dimensions, are stored alongside the post. When you run a search, the text you type is sent to our API and turned into a vector so it can be compared against post vectors; search text is not stored beyond ordinary server logs. Recent searches are kept only on your device.

There is no third-party AI provider involved and this processing does not make any decision that has a legal or similarly significant effect on you.

Purpose: semantic and similarity search of public posts. Legal basis: performance of our contract with you and our legitimate interest in a useful search feature (Art. 6(1)(b) and (f) GDPR).

3.11 App — post views

While you are signed in, opening a post records a view: the post ID, your user ID, which screen it was seen on (feed, detail, or thought), the carousel slide index, and a timestamp. Views are rate-limited to one per post per minute and capped at 100 per post per user. They drive the public view count on a post.

Purpose: to show creators how much reach a post has. Legal basis: our legitimate interest in basic post analytics for creators (Art. 6(1)(f) GDPR).

3.12 App — notifications and push

When someone likes, comments on, replies to, follows, or @-mentions you, we create a notification record (type, who did it, which post, read state, timestamps). You can turn each category on or off in settings; those preferences are stored server-side.

If you grant the OS notification permission, we register an Expo push token and your platform (iOS or Android) so we can send phone push notifications. The push token is deleted when you sign out, when you use "Reset App", or when the push provider reports it as no longer valid. A push message sent to your device contains the other person's name, a short preview of the post text, and the other person's avatar image. Push is delivered via Expo's push service and then Apple's or Google's push transport (see section 6).

Purpose: to tell you about activity involving you. Legal basis: performance of our contract with you for the in-app notification list (Art. 6(1)(b) GDPR); your device-level permission (consent) for OS push notifications, which you can withdraw at any time in your device settings or in the app.

3.13 App — device permissions

• Photo library: requested so you can pick images to post or set an avatar. The app only reads the specific photos you select — it does not scan or index your library. On iOS, a picked photo stored in iCloud may be downloaded to a local file so it can be uploaded.
• Notifications: requested so we can send push notifications (see 3.12).

Both permissions are optional, are asked for during onboarding (and again at the point of use), and can be declined or later changed in your device settings. The app does not request or use your location, contacts, microphone, or camera roll beyond the photos you explicitly choose.

3.14 App — data stored on your device

The app keeps a local cache to work quickly and offline: an on-device SQLite database (cached profiles, follow states, your own user row) and key–value storage (your session tokens, theme and accent choice, the onboarding-complete flag, your recent searches, a notification-badge preference, and the multi-account switcher vault). This data stays on your device; "Reset App" in Advanced settings clears all of it and signs you out.

3.15 Website and app — technical log data

Our self-hosted API ("ripledd-gateway") logs the IP address, user-agent, request path, and timestamp of requests; the self-hosted embedding service logs the calling IP for rate-limiting. The app also periodically contacts Expo's update servers to check for over-the-air JavaScript updates, which involves basic device and app-runtime information. There is no third-party analytics SDK and no crash-reporting SDK in the mobile app.

• Purpose: delivering requests, security and abuse prevention, rate limiting, debugging, and shipping fixes.
• Legal basis: our legitimate interest in operating and securing the service (Art. 6(1)(f) GDPR).

4. Analytics and advertising

Ripledd runs no advertising, on the website or in the app, and uses no third-party analytics or advertising SDKs anywhere. There is no Google Analytics, no Google AdSense, and no cross-site or cookie-based tracking. The only measurement tool is the cookieless performance monitor described below.

4.1 Vercel Speed Insights (website)

Every website page loads Vercel Speed Insights, which reports aggregate performance metrics (Core Web Vitals). It sets no cookies, does not build a profile, and does not identify you. Legal basis: our legitimate interest in a fast site (Art. 6(1)(f) GDPR).

5. Cookies and local storage

The website sets no analytics, advertising, or other optional cookies, so there is no cookie banner and nothing to opt in or out of. The mobile app uses your device's own storage, not cookies.

6. Who we share data with

The API (ripledd-gateway) and the embedding service (ripledd-inference) run on hardware we operate ourselves in Austria; they are not outsourced to a hosting provider. Apart from that, we do not sell personal data and share it only with the service providers below — each acting as our processor under a data-processing agreement — or where the law requires disclosure.

We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and security of Ripledd, our users, or the public — including reporting content that sexualises minors to the competent authorities.

7. International transfers

Some providers are established outside the European Economic Area, mainly in the United States (Cloudflare, Expo, Vercel, Google, Apple). Where data is transferred there, it is protected by the EU–US Data Privacy Framework (for certified recipients) and/or the European Commission's Standard Contractual Clauses, together with additional technical and organisational safeguards. You can ask us for a copy of the relevant safeguard.

8. How long we keep data

• Account and profile: until you delete your account (see section 9).
• Posts, images, captions, comments, and their embeddings: until you delete them or your account. Deleting a post removes the database rows immediately; the stored image files are purged on a short cycle and may persist briefly in CDN caches and routine backups.
• Follows, likes, bookmarks: until you undo them or delete your account.
• Notifications: on a rolling window of up to about 12 months, then pruned; an emptied placeholder row may be kept for like entries to enforce push cool-downs.
• Push tokens: until you sign out, use "Reset App", or the token becomes invalid.
• Post-view records: up to about 12 months, then aggregated or deleted.
• Support requests: up to 24 months after the request is resolved, then deleted or anonymised.
• Server and API logs: normally 30–90 days, then rotated and deleted, unless an entry is needed longer to investigate an incident.
• Waitlist entries: until Ripledd launches plus a short transition period, or until you ask to be removed — whichever comes first.
• On-device data: until you clear it, use "Reset App", or uninstall.

9. Deleting your account

The app does not yet have an in-app "delete account" button. To delete your account, email [email protected] from the email address on the account (or tell us your handle). We will delete your profile, posts, images, comments, likes, bookmarks, follows, notifications, push tokens, and embeddings within 30 days, except where we must keep limited records for legal reasons (for example an open abuse investigation) or in routine backups that age out on their normal schedule.

Signing out, or using "Reset App" in Advanced settings, only clears data from your device — it does not delete your account or your content.

To have a waitlist entry or support records deleted, email the same address.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and get a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict processing, or object to it — including to any processing we base on legitimate interests, and at any time to direct marketing;
• receive data you gave us in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing carried out beforehand.

To exercise any of these, email [email protected]. We reply within one month. You also have the right to complain to your local data protection authority — for EEA authorities see edpb.europa.eu.

11. Children

Ripledd is not directed at people under 16 (or the higher digital-consent age set by your country, where applicable). We do not knowingly process the personal data of children below that age. If you believe a child has given us data, contact [email protected] and we will delete it.

12. Security

We use transport encryption (HTTPS) everywhere, signed-token (JWT) authentication, password hashing handled by Supabase Auth, per-user scoping of stored files, rate limiting, and access controls on our self-hosted infrastructure. Our backend embedding service is reachable only from our own API, protected by a shared secret and network isolation. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data and to notify you and the authorities of a breach where the law requires.

13. Changes to this policy

We may update this policy. We will change the "last updated" date above, and for material changes we will take reasonable steps to notify you — on the website or in the app.

14. Contact

• Privacy questions and rights requests: [email protected]
• Content and abuse reports: [email protected]
• General support: [email protected]

See also our Terms of Service.