Privacy policy

What Ripple keeps

Your account

Your name and photo, which you can change in Settings, your email address and the ways you sign in. If you sign in with a private relay address, also a contact address you confirm. Your settings, such as appearance, how sources are sorted and which messages notify you. While quiet hours are on, Ripple also keeps your time zone so they start and end on time; turning them off removes it. Your photo is kept as a small square image at a private link, so sign-in can show it after you sign out; Remove photo erases it at once.

Messages and sources

Everything sent to your account: titles, text, links, thread names, alert levels and sounds, with their read, archive and snooze state. Sources keep their names, icons, images and default alerts, sounds and links. All of it stays until you delete it.

Signed-in browsers

For each browser: how it signed in, when it was last used, and its user agent, which names the browser and operating system and their versions. Settings uses it to list the browser under Signed in as, for example, Safari on a Mac.

Send keys and API tokens

Each source’s send key is kept as a one-way hash that checks requests, and as an encrypted copy so you can view it again in Settings. An API token is kept only as a one-way hash, with the name you gave it and when it was last used; one unused for 180 days is deleted.

Emails to support

What you write to help@ripplepush.com and Ripple’s replies.

Why Ripple uses it

Ripple uses your account, messages, sources, sign-ins and notification addresses to provide the service you signed up for, and your emails to support to answer you. To keep Ripple secure and working, it limits sign-in attempts, names the country a sign-in request came from, reports errors and checks that Ripple is up, which privacy law calls a legitimate interest; none of that uses your messages. You need an email address to have an account, and Ripple makes no automated decisions that significantly affect you.

Signing in

Email codes. Ripple emails a six-digit code that works for five minutes. The email names the country the request came from, looked up from your IP address in a copy of IPinfo’s database on Ripple’s own servers, so IPinfo never sees it. Its icon and font load from Ripple’s website at the same address in every email, and Ripple doesn’t track whether emails are opened. Codes are stored only as keyed hashes. So the screen can offer to open your inbox, Ripple’s servers look up which service receives mail for your address’s domain in its public DNS records; the answer is held in memory for up to an hour and never stored. IP address data is powered by IPinfo.

Apple. Apple shares your Apple ID’s identifier, its verified email address, which can be a private relay address, and, the first time, your name if you choose to share it, which Ripple suggests as your account’s name. Ripple keeps these with your account, along with the sign-in tokens Apple issues.

Google. Ripple asks Google only for your verified email address and your name, never your contacts or files, and accepts only Gmail and Google Workspace addresses. Google also shares your Google profile photo, which Ripple doesn’t keep. Ripple keeps the address, the name, which it suggests as your account’s name, and your Google account’s identifier. Ripple’s use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

Connecting Apple or Google. When you connect Apple or Google in Settings, they share the same information as when you sign in with them, which Ripple uses to check the connection. Ripple keeps your Apple ID’s or Google account’s identifier with the account you’re signed in to, so either one opens it, along with the sign-in tokens Apple issues. The account keeps its own email address and name.

Staying signed in. A browser stays signed in while it’s used, for up to a year, and signs out after 180 days without use. Signed-in browsers are kept without their IP addresses. To limit abuse, Ripple counts sign-in requests per IP address; the counts are held in memory for up to a minute and never stored. It also counts, for a day, the codes sent to each email address, kept as a keyed hash, and to each account. Daily totals of codes sent, sign-ins, sign-ups and failures by method identify no one and are kept.

Browser notifications

When you turn on notifications, your browser gives Ripple an address at its push service (Apple, Google, Mozilla or Microsoft, depending on the browser). Ripple keeps the address with the browser’s user agent. Each notification carries the message’s or thread’s title, the start of its text, its source, its alert level and a link to it in Ripple, encrypted so only your browser can read it. The push service sees that a notification was sent, not what it says. Ripple keeps that address only while the browser stays signed in. Turning notifications off or signing the browser out, there or from another browser, deletes it. When its sign-in expires, notifications stop at once and the address is deleted shortly after.

Cookies and browser storage

Ripple sets only its own cookies, each needed to run it: one that keeps you signed in, two that hold your language and time zone so dates read correctly, and a few that remember the layout. A short-lived cookie protects signing in with Apple or Google. Once you sign in, a cookie that only the sign-in page receives remembers, for up to 400 days, the email address and sign-in method this browser last used, with your photo’s link, so sign-in can offer to continue with them; Use another email removes it. Commands also remembers the last 12 commands you ran in this browser, such as going to a source, so it can list them first. If you turn off Browser notifications in Settings, this browser remembers that so Ripple doesn’t set them up again, and the docs remember the language you last picked for their code. These stay in this browser until you clear its site data and are never sent to Ripple. Lists also remember where you scrolled until you close the tab.

Ripple doesn’t track you across other sites, so there’s nothing for Do Not Track or Global Privacy Control to turn off.

Images from senders

A source icon given as a web address, and any image inside a message, loads from wherever its sender hosts it. That host can see your IP address and browser when you view it.

Who else handles your data

Besides the push services and image hosts above, Ripple shares personal information only with these providers, so they can run Ripple; when the law requires it; or if Ripple is sold. Providers may use their own subprocessors, such as the cloud AI services behind Sentry’s assistant.

Railway

Runs Ripple’s servers and database in the United States. Railway’s own request logs record each request’s IP address, browser and page; Ripple’s logs add your account’s ID for some requests, never message content.

Cloudflare

Carries all traffic between your browser or scripts and Ripple, decrypting it on the way through, so it sees your IP address and what’s sent. It also stores an encrypted copy of the database each night.

Amazon Web Services

Sends the emails with sign-in and confirmation codes.

Sentry

Receives error reports and the timing of requests and page loads. These can include the page’s address, your account’s ID, your browser’s description and the site of anything the page refused to load. They never include message content, email addresses, cookies or your IP address. Sentry also receives counts and timings of message sends and deliveries, without your account’s ID or any message details, and its AI assistant analyzes new errors to suggest fixes.

Linear

Tracks Ripple’s work, including errors copied from Sentry to be fixed.

Better Stack

Checks that Ripple is up. It receives no personal information.

Google Workspace

Holds Ripple’s support email.

Apple and Google

Learn that you use Ripple when you sign in with them or connect them.

If Ripple is sold or merged, your information may move to the new owner, who must keep to this policy for it. Ripple will tell you by email or on this page.

Where it’s stored

Ripple runs in the United States, so if you use it from elsewhere, including the EU or UK, your information is handled there. Railway, Cloudflare, Amazon Web Services, Sentry, Linear and Google Workspace are each bound by a data protection agreement that includes the European Commission’s standard contractual clauses, the EU’s approved terms for protecting information sent abroad, and the UK’s addendum to them. Email help@ripplepush.com for a copy. Apple, Google and the push services handle what they receive under their own privacy policies.

How long it stays

Messages and sources stay until you delete them. Deleted items wait in Trash for 30 days, then go permanently; Delete forever and Empty Trash remove them at once. Database backups hold everything, deleted items included, for up to about four weeks, and are used only to recover the service.

Your account stays until you delete it. Railway deletes its logs after 7 days. Sentry keeps error reports for 90 days and timings for 30, with a sample of timings kept for 13 months. Errors copied to Linear stay with their issue. Emails to support stay until you ask for them to be deleted. Sign-ins, notification addresses, API tokens and sign-in limits end as described above.

Security

Connections to Ripple are encrypted. Ripple stores messages on its servers so it can search, sync and show them; they aren’t end-to-end encrypted. Ripple looks at your messages only to fix a problem you report, or when the law requires it.

Your choices

You can delete messages and sources, reset a source’s send key, remove API tokens and sign out other browsers at any time. In Settings › Account, Download your data saves everything in your account except keys as one JSON file, with your photo and links to your source images. Delete account emails you a code to confirm, then erases your account at once, with its photo, messages, sources and their images, send keys, API tokens, settings, sign-ins and notification addresses; every browser signs out, and Ripple asks Apple to revoke its access if you signed in with Apple. Backups let go of the account about four weeks later.

To ask what Ripple holds about you, to correct it, or to have your account deleted for you, email help@ripplepush.com from an address on your account. Depending on where you live, you can also object to how Ripple uses your information, ask it to limit that use, or complain to your local data protection authority. Ripple acts on these requests within 30 days, and using them never changes how Ripple treats you.

Children

Ripple isn’t meant for anyone under 13 and doesn’t knowingly collect their information. If you think a child under 13 has given Ripple information, email help@ripplepush.com and it will be deleted.

Changes

When Ripple changes what it keeps or shares, it updates this page and the date at the top. If a change affects how your information is used, Ripple emails you before it takes effect.

Who runs Ripple

Jonathan Laniado runs Ripple and, as its data controller, is responsible for your information under this policy. Questions about privacy go to help@ripplepush.com.