What we keep, and what you can do about it.

Who we are

RippleCore Ltd is registered in England and Wales, company number 16603478, with its registered office at 12 Kennedy Avenue, Whitley, Melksham, Wiltshire, SN12 8QT, United Kingdom. Our registration with the Information Commissioner's Office is ZC266619.

James Kellock is accountable for data protection and is who to write to: jk@ripplecore.co. We have not appointed a Data Protection Officer, because the law does not require one at our size and for the data we hold, and that decision is written down rather than assumed.

For people in the European Union, our representative under Article 27 of the EU GDPR is [EU REPRESENTATIVE: name and contact address, GDPR-12]. You can write to them instead of us about anything in this notice.

What we collect

What you give us: your name, a username, your email address and a password, which is stored only as a hash that cannot be read back. Where signing in with Google is offered and you choose it, Google tells us your name, your email address, the id of your Google account and the address of your Google picture, which we store and do not show; we tell Google nothing about what you do here, though Google knows that you signed in and when. When you make an account we also ask your age as a band (under 16, 16 or 17, or 18 or over), never a date: if you say you are under 16 the sign-up form stops there, so no account is made and nothing is kept, and we do not check the answer; otherwise we keep the band, only you can see it, and you can change it from your account. We do not check it. In each Circle, a display name, handle, short bio, an avatar if you add one and up to three links — you can be a different person in different Circles. Then what you choose to write: stories and quick acts, photographs, who you tag, reactions, saves, event RSVPs, volunteering hours, challenge entries, wishlist items and votes, rewards you claim, requests to join a Circle, and anything you report.

Where a moment happened, if you say: exact, approximate, town (the default) or hidden. The value is coarsened before it is stored, so a town-level act is one whose precise point was never kept. Your device’s position is read once, only when you press “use my location”, and never otherwise.

What the server records: a short log of requests — the route, the answer, how long it took, which account asked, and the network the request came from with the part of the address that identifies one device removed before the row is written. No request body, no password, no message. Our email provider keeps delivery records for 30 days.

• No date of birth, gender, ethnicity, religion or any other demographic field. The one thing we ask about age is the band described above, never a birthday.
• No face recognition, fingerprints or other biometrics.
• No card or bank details: nothing is paid for here.
• No advertising network, no analytics script, no third-party cookie, and a map that draws its own dots rather than fetching tiles from another company. The only cookie keeps you signed in, apart from one that lasts five minutes while you sign in with Google, where that is offered; your browser also keeps a queue so the app works offline.
• Nothing bought from a data broker, and nothing combined with data about you from anywhere else.

Why we use it

Every purpose has a lawful basis, and the table below is the whole list. “Contract” means we cannot provide what you signed up for without it. “Legitimate interests” means we weighed our reason against your privacy and wrote down the result; ask us for it, and you can object at any time.

We never ask about your health, religion, beliefs, politics or anything else the law treats as special. If you mention such a thing in a post or a bio, you are choosing to share it with the people who can read that post or bio: your Circle, or every signed-in member for a story you chose to share that widely; we do not index it, infer from it, or use it for anything.

Who can see what you share

A story goes to the Circle you shared it in — its members, and the partner backing that Circle if it is a sponsored card. A quick act is yours alone: not the Circle, not its officers, not the partner, and that is enforced in the rule the server applies rather than in the screens.

If you are 18 or over and your Circle allows it, you can share a story with every signed-in RippleCore member. You choose each time, and it starts on “Circle members only”. A story shared this way names nobody and shows its place no closer than its town. People outside your Circle see your display name, the story and how many reacted; they do not see who reacted or anything else on your profile, and they can report it to your Circle’s admins. You can take it back to your Circle from its menu, and so can your Circle’s admins. A Circle’s admin can turn this off for the whole Circle, and a safeguarded Circle never allows it.

A Circle is either listed publicly or not listed at all, and that choice belongs to the Circle. Either way nothing inside it is readable without an account. A safeguarded Circle, its posts and its members are invisible from outside it.

There are no comments and no direct messages anywhere in RippleCore, because there is no collection to store either. If something is unkind, a report goes to the people who already run that Circle.

A partner that sponsors a Circle sees how many times its card was seen and its link followed in the last 30 days, and how many reactions came back — totals over its own cards. We do not record who saw a sponsored card, only that it was seen. A total of one to four is shown as “fewer than five”, so a small Circle’s partner cannot work out who. Partners never receive your profile or your contact details.

We do not sell personal data, and we never will.

Companies that help us run it

Each is bound by a contract that lets them use the data only to provide their service to us. Google is the exception, and reaches your data only if you choose to sign in with it: it provides your own Google account, under its own privacy policy. We will update this page, and tell you where it affects you, before adding a new one.

How long we keep it

A job runs every night at 04:10 UTC and deletes what has passed the windows below. Before an RSVP or a finished challenge entry goes, what it added up to is kept without the record it came from: your volunteering hours and the challenges you finished stay as a total only you can see, while you are a member of that Circle, and the Circle keeps how many people took part, without their names.

Backups are kept for up to three months. Something you deleted goes as the backups expire, and we do not restore it.

Your rights

You do not have to ask us for your data, and you do not have to ask us to delete it. The Account screen in the app writes everything the server holds about you into a file you keep, and deletes your account when you tell it to — your posts, your profile, your photographs, your reactions and your place in every Circle go with it, and the deletion is immediate rather than a flag on a row. You can correct anything by editing your profile and your posts.

For anything the app does not do for you — restricting or objecting to a use, withdrawing consent to an email, or a copy in another form — write to jk@ripplecore.co. We acknowledge within five working days and finish within one month, and there is no charge.

If you are unhappy with how we have handled your data, tell us first and we will look at it properly. You can also complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.

How we protect it

Everything travels over an encrypted connection. Passwords are stored only as salted hashes, and nobody here can read them. Every kind of record has a rule on the server deciding who may read or change it, and those rules are covered by automated tests rather than by care. Signing in and posting are rate-limited, so an attacker cannot guess a password at speed. Access to the live service is limited to our own staff, and used only for support, security or a fault. We run our own security reviews and a monthly automated vulnerability scan.

Being straight with you: RippleCore is a small, young company. We do not hold SOC 2 or ISO 27001 ourselves, we have not yet had an independent penetration test, and the database is not separately encrypted beyond the protection our hosting gives it. Those three are planned, and this page changes when they are done rather than before.

Age

You can sign up to RippleCore yourself from the age of 16. If you are younger, you can join only a private Circle run by an approved school or other organisation, and its officers approve each member. If you are under 13, joining also needs a parent's consent or your school's authorisation: an officer's approval on its own is not enough.

[CONFIRM BUILT: the shared Circle is switched on] One Circle has everyone in it. It is called Everyday Kindness, and you are a member of it from the day you make your account; you cannot leave it while you have one. What is posted there is read by every member of RippleCore, and by nobody without an account. Only members who have told us they are 18 or over can post in it. Nobody can see a list of who is in it: your profile there is seen only by you and by the RippleCore staff who look after that Circle. If you react to a post there, other members see how many people reacted and not that you did. That Circle has no events, challenges or wishlist. A post there cannot name another person.

[CONFIRM BUILT: GDPR-04, GDPR-05] If you are under 18, what you share stays inside your Circle. Your profile and what you post are seen only by its members, and your profile stays hidden until your membership is approved. You cannot post or comment publicly, or react anywhere people outside your Circle could see who you are, and nobody outside your Circle can contact you directly. You can still read public content suited to your age. Turning 18 does not make your profile or anything you shared before public.

If you believe someone under 16 has signed up on their own, or a child under 13 has joined without the consent they need, write to jk@ripplecore.co and we will close the account.

Where a school, college, youth organisation or employer runs RippleCore for its own members, that organisation decides what is collected and how, and its own privacy notice and safeguarding arrangements apply.

Automated decisions

Nothing about you is decided by automated means alone, and we do not profile you. The numbers RippleCore works out — your hours, a Circle’s totals, what a partner is shown — are counts, and none of them decides anything about you.

Changes to this notice

If we change this in a way that affects you — a new purpose, a new company handling your data, a longer window — we will tell you by email or in the app before it takes effect, and say here what changed.