Privacy Policy

Effective date: November 2, 2026

Overview

Ripplo LLC, a Tennessee limited liability company ("Ripplo", "we", "us", "our") operates the Ripplo platform at ripplo.ai, including the web application, CLI tool, and associated APIs. This policy describes what data we collect, why, how we use it, and your rights regarding that data.

By using Ripplo, you agree to the collection and use of information as described in this policy.

What We Collect

When you sign up via GitHub, we receive your name, email address, and profile image from GitHub. We do not collect or store your GitHub password.

If you create or join an organization, we store the organization name, slug, logo, and membership details including roles and invited email addresses.

When Ripplo reviews a pull request or runs your workflows, we collect and store:

  • The workflows Ripplo writes for your application, stored as code
  • Run metadata (status, branch, commit SHA, timestamps)
  • A recording of each run: the rendered pages, console messages, and the network calls the page made, including request and response bodies with credential-like fields removed
  • Screenshots of your application captured during a run
  • Review findings and a log of what the reviewer did, including the parts of your source code it read
  • AI model token usage (model name, input and output token counts)

This data comes from the test environment you point Ripplo at, signed in as a test user Ripplo creates. Ripplo is not designed to process personal data of your end users. The security page at ripplo.ai/docs/security describes each item and where it is kept.

We automatically collect your IP address and browser user agent string when you log in. This is stored as part of session management and is not actively used for analytics, geolocation, or tracking.

We track the number of test runs and AI token usage per organization to enforce plan limits and calculate billing.

How We Use Your Data

  • To provide and operate the Ripplo testing platform
  • To authenticate your identity and manage your account
  • To execute AI-powered end-to-end tests against your application
  • To enforce usage limits and process billing through Stripe
  • To improve the service through aggregated, non-identifying analytics
  • To send transactional communications (account verification, billing notifications)

We do not sell your personal data. We do not use your test execution data to train AI models.

Third-Party Services

We share data with the following third-party services as necessary to operate Ripplo:

  • OpenRouter and the model providers it routes to (AI models) — During a review, the reviewer’s prompts, including the source code it reads and your application’s page content and screenshots, are sent through OpenRouter to the model Ripplo is configured with. Organizations can instead point Ripplo at their own model endpoint, in which case nothing goes to OpenRouter.
  • Stripe (payment processing) — Stripe handles all payment information. We do not store credit card numbers or billing addresses on our servers.
  • GitHub — We access your GitHub account for OAuth login and, if you install the Ripplo GitHub App, to read the code in the repositories you select and post comments and checks on pull requests.
  • Amazon Web Services — Our servers and database, reviews, and test runs are hosted on AWS in the us-east-1 region. Run recordings and screenshots are stored in Amazon S3 and served through time-limited signed URLs.
  • Cloudflare (DNS and backup) — Cloudflare provides DNS for ripplo.ai and holds a backup copy of run recordings and screenshots in Cloudflare R2, which we will delete by December 2, 2026.
  • Railway (infrastructure hosting) — We hold a backup copy of our database on Railway, which we will delete by December 2, 2026.
  • Better Stack (logging) — Application logs from our servers and workers, with request and response headers removed.
  • PostHog (product analytics) — We use PostHog to understand how the product is used through page views, basic user identification (user ID, email, name), and automatic interaction capture (clicks, form submissions, and other UI events). We do not use session recording.
  • Linear — Only if you connect it, to read the issues a review refers to.

Data Retention and Deletion

Run recordings, results, and reviewer logs are retained until you close your organization or ask us to delete your data. You may request deletion of specific data at any time by contacting us.

Account data (name, email, organization membership) is retained for as long as your account is active. You can delete your organization or your account from the dashboard, which removes its records. Email us to have stored recordings and reviewer logs deleted as well.

Cookies and Local Storage

We use a single session cookie to keep you logged in. This cookie is essential for the service to function and cannot be disabled.

We also store non-sensitive UI preferences in your browser’s local storage (such as sidebar layout). This data never leaves your device.

We do not use advertising cookies, marketing pixels, or cross-site tracking of any kind.

Security

We take reasonable measures to protect your data, including:

  • All data in transit is encrypted via HTTPS/TLS
  • The secrets Ripplo holds for your project, such as sign-in client secrets and signing keys, are encrypted at rest with AES-256-GCM
  • Recordings and screenshots are accessible only via time-limited signed URLs
  • All API endpoints require authentication and enforce organization-level access controls
  • Webhook payloads are verified using cryptographic signatures

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to mail@ripplo.ai. More detail is on ripplo.ai/docs/security.

Children’s Privacy

Ripplo is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

International Users

Ripplo is operated from the United States. If you are accessing the service from outside the US, your data will be transferred to and processed in the United States and other countries where our service providers operate. By using Ripplo, you consent to this transfer.

If you are located in the European Economic Area (EEA) or United Kingdom, you may have additional rights under GDPR, including the right to access, rectify, or erase your personal data, and the right to data portability. To exercise these rights, contact us at mail@ripplo.ai.

Your Rights

Regardless of where you are located, you may request:

  • Access — A copy of the personal data we hold about you
  • Correction — Updates to inaccurate or incomplete data
  • Deletion — Removal of your account and all associated data
  • Data export — A machine-readable export of your data

To make any of these requests, email us at mail@ripplo.ai. We will respond within 30 days.

Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by updating the effective date at the top of this page. Your continued use of Ripplo after changes are posted constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy or how we handle your data, contact us at mail@ripplo.ai.