The small print, written kindly.

Terms & conditions

RippleCore is provided to you through your Circle. By joining one you agree to use it as intended: to write down genuine good things, and to treat the other members with respect.

What you write goes to the audience you choose. A story goes to the Circle you shared it in — its members, and the partner backing that Circle if it is a sponsored card. If you are 18 or over and the Circle allows it, you may also choose to share a story with every signed-in RippleCore member; that choice is made one story at a time and starts on the Circle alone. A quick act is a private note: it counts towards what you have done, and nobody else can read it.

There is no ad network on RippleCore and no advertising profile of you. A sponsored card is one a local partner placed in a Circle, and it is labelled as sponsored where it appears. The partner sees how many times the card was seen and its link followed in the last thirty days, and how many reactions came back — counted as totals over their own cards. RippleCore does not record who saw a sponsored card, only that it was seen. Where a card was seen or its link followed one to four times, the total is shown as “fewer than five”, so a small Circle’s partner cannot work out who it was; the number of reactions is shown as it is. They do not receive your profile, and they are never given your contact details.

Placeholder summary — the full Terms & Conditions will be published here.

Privacy policy

Privacy here is architectural rather than a setting. Everything you write is scoped to a Circle on the server: another Circle cannot read it, and somebody signed out cannot read it at all.

A quick act is yours alone — not the Circle, not its officers, not the partner backing it. Not even a Circle officer can read one, and that is enforced in the collection rule rather than in the screens.

Where a moment happened is chosen per act: exact, approximate, town (the default) or hidden. The value is coarsened before it is stored, so a town-level act is one whose precise point was never kept — a search, an export or a backup has no more precise point to find. A place name you type is the exception: it is kept and shown as you typed it, unless you choose hidden. “Use my location” reads your device’s position once, and only when you press it. Nothing else in RippleCore asks where you are.

We collect what the product needs and nothing for advertising, because there is none. Members respond to a moment with a reaction, a save or a follow; there is no comment to leave and no direct message to send, because the product has neither.

What you write is kept while it is still doing something for somebody, and then it goes. A revoked or expired invite goes thirty days after it is revoked or expires, and a report that was dismissed ninety days after it was dismissed. An application to join a Circle, and a partner’s request to back one, go thirty days after a Circle approves it, ninety days after it is declined, and a hundred and eighty days after it is asked and never answered. An unclaimed reward voucher, an RSVP to an event, and the contact details of whoever was running that event all go ninety days after the expiry or the event they belong to, and so do the entries in a challenge that has finished. Before an RSVP goes, the hours of a volunteering session you came to are added to a total per Circle and per year that only you can see, kept while you are a member of that Circle, and the Circle keeps how many people signed up and came, without their names. In the same way, before a finished challenge’s entries go, the number of that Circle’s challenges you finished is kept for you alone while you are a member, and the Circle keeps how many took part and finished, without their names. Everything else stays until it is deleted or you delete your account; leaving a Circle removes your profile there but not the posts you wrote in it, and an imported address from a Circle that moved here is blanked ninety days after the run that wrote it — the record it sits on stays, because that record is what stops a second account being made for the same person. If you left your name and email on the coming-soon page, they go three hundred and sixty-five days after you sent them. A sponsored card being seen or followed is recorded without saying by whom, and that record goes thirty days after it was made. A notification goes ninety days after you read it, and one you never open goes three hundred and sixty-five days after it was sent.

The server keeps a short record of requests to it, so that a fault can be diagnosed: the route, the answer, how long it took, which account asked, and the network the request came from with the part of the address that picks out one device removed before the row is written. No request body, no password and no message you sent is in it, and those rows go at the latest a hundred and eighty days after they are written, and sooner when the record is full, because it keeps only the newest two thousand requests.

You do not have to ask us for your data, and you do not have to ask us to delete it. The Account screen in the app writes everything the server holds about you into a file you keep, and deletes your account when you tell it to — your posts, your profile, your photographs, your reactions and your place in every Circle go with it, and the deletion is immediate rather than a flag on a row.

A summary. The full privacy notice — who processes the data, every window, and how to exercise a right — is at /privacy/.

Safeguarding

Sharing does not have to mean exposing. Map defaults protect the most vulnerable member, and every point on the map is coarsened before it is written.

A Circle is either listed publicly or not listed at all, and the choice belongs to that Circle. Nothing inside a Circle is readable without an account in either case. A story is read by the members of the Circle it was shared in, unless its author, being 18 or over, chose to share it with every signed-in member. A listed Circle’s admin can switch that off for the Circle, and an unlisted, safeguarded Circle never allows it.

There are no comments and no direct messages, so there is nothing to troll and nowhere to be piled on. If something is unkind, a report goes to the people who already run that Circle — a flag on their own desk — and an officer can take the post down.

Placeholder summary — the Safeguarding policy will be published here.