Privacy at Ripple

The short version

• We collect only the information needed to sign people in, record help, request confirmation and maintain an accurate count.
• A recipient's email address is private, encrypted in storage and never displayed publicly.
• Help does not enter the public count unless the person who received it confirms it.
• Public impact information is aggregated. We do not publish recipient names or email addresses.
• We do not sell personal information or use recipient details for advertising.
• You can ask to access, correct or remove information by emailing hello@rippleau.com.

Information we collect

If you create an account

We collect:

• your email address;
• the display name you choose;
• authentication and session information needed to keep you signed in; and
• routine technical information generated when the service is used, such as timestamps, request and security logs, device or browser information and IP-derived information handled by our service providers.

If you record help

We collect:

• the first name of the person you helped;
• their email address;
• the kind of help;
• when the help record was created; and
• its confirmation and counting status.

If someone records help they gave you

We initially receive your first name and email address from that person.

We use your email address to send a private confirmation request, protect the confirmation link, match your response to the correct record and avoid counting the same person more than once.

You can respond without creating an account. We collect your answer, which is one of:

• the help happened;
• it did not really describe what happened; or
• it did not happen.

A confirmation link expires after 14 days. A replacement request may invalidate an earlier link.

If you contact us

We collect the information you include in your message and use it to respond, investigate a request or resolve a complaint.

How we collect information

We collect information:

• directly from you when you create an account, use Ripple, confirm help or contact us;
• from a person who records help they gave you; and
• automatically through essential authentication, security and hosting systems.

When someone gives us another person's details, they must only do so for genuine help and where that person would reasonably expect to receive the confirmation request.

Why we use it

We use personal information to:

• provide sign-in and account features;
• create and manage private help records;
• send and manage confirmation requests;
• record the recipient's response;
• count confirmed help and count each recipient once;
• show a giver the status of help they recorded;
• prevent duplicate, dishonest or abusive activity;
• protect the security and reliability of Ripple;
• respond to access, correction, deletion and complaint requests; and
• meet applicable legal obligations.

Ripple may automatically hold apparent self-help out of the public count for review. This does not make an employment, education, credit, housing or other significant decision about anyone.

What becomes public

Ripple may publish:

• the total number of people who have confirmed receiving help;
• the total number of confirmed acts of help;
• progress toward the shared goal; and
• privacy-protected aggregate trends, such as broad help categories or changes over time.

We do not publish recipient names, email addresses, individual confirmation answers, private help records or account email addresses.

Small category or time-period groups are suppressed where publishing them could make an individual easier to infer.

A signed-in giver can privately see the first name they entered and the status of their own help records.

How recipient addresses are protected

Recipient email addresses are encrypted before storage.

Ripple also creates a separate keyed, one-way value from a normalised address. This allows the system to recognise the same recipient and count that person once without using the readable address for matching.

Encryption reduces risk but no online system can promise absolute security. Access is restricted to server-side functions needed to operate Ripple.

Service providers and overseas processing

We use service providers to operate Ripple:

• Supabase provides the production database and authentication. Ripple's primary Supabase project data is hosted in Sydney, Australia.
• Vercel hosts and delivers the website and may process operational and request logs.
• Resend sends sign-in and confirmation emails.

These providers and their authorised subprocessors may process information in Australia, the United States and other countries where they operate. Privacy protections and legal rights may differ between countries.

We disclose information to these providers only where needed to operate, secure and support Ripple. We may also disclose information where required by law or to protect people, Ripple or the public from serious harm or unlawful activity.

Claude Code and UTS Startups

Claude Code was used as a software-development tool. It does not operate Ripple, decide whether ordinary help counts or receive production names, email addresses or help records through normal use.

UTS Startups has supported the project but does not operate Ripple and does not receive Ripple user information through normal use.

Cookies and analytics

Ripple uses essential cookies to create and refresh a secure sign-in session.

At launch, Ripple does not use advertising cookies, behavioural tracking or third-party analytics.

If analytics or non-essential tracking is introduced later, this policy and the consent experience will be reviewed before it is enabled.

How long we keep information

We keep information only for as long as it is needed to operate Ripple, maintain the integrity of confirmed counts, protect the service, handle requests or meet legal obligations.

Account and profile information is generally kept while the account exists.

If a giver deletes their account:

• their account, profile and sign-in information are removed;
• help that was never confirmed and counted is removed;
• confirmation records attached to their help are removed; and
• help already confirmed and counted may remain so the public count does not become inaccurate.

For retained counted help, the giver is removed, the recipient name entered by the giver is removed and any written description or confirmation response is removed. Protected references needed to recognise the recipient and avoid counting that person twice may remain.

If you are a recipient, you can ask us to correct or remove information connected with you. We will assess what can be removed while keeping the system accurate and respecting other people's rights.

Access, correction and deletion

You can ask us to:

• explain whether we hold personal information about you;
• provide access to it;
• correct inaccurate information;
• remove information where appropriate; or
• delete your Ripple account.

Signed-in users can delete their account from their profile.

For any other request, email hello@rippleau.com. We may need to verify that you are the person concerned before acting. We will respond within a reasonable period.

Privacy questions and complaints

If you have a privacy question or believe Ripple has handled your information incorrectly, email hello@rippleau.com.

Include enough information for us to understand the issue, but do not send passwords, confirmation links or unnecessary sensitive information.

We will review the concern, investigate where needed and explain our response.

If you are not satisfied, you may also have the right to contact the Office of the Australian Information Commissioner at oaic.gov.au.

Data breaches

If we become aware of a data breach, we will investigate it and take steps to reduce harm. Where Australian law requires notification, we will notify affected people and the Office of the Australian Information Commissioner.

Changes to this policy

We may update this policy when Ripple changes, when service providers change or when legal requirements change.

The current version and its effective date will always appear on this page. If a change materially affects how existing personal information is handled, we will take reasonable steps to make that change clear.