Scope and who we are
Rippll LLC ("Rippll," "we," "us," or "our") operates rippll.ai and the related websites, web apps, account pages, creator tools, subscriber tools, alerts, brokerage-connection features, integrations, and communications (collectively, the "Services"). This Privacy Policy explains how we handle personal information in connection with the Services. It applies to visitors, subscribers, creators (also called traders), and anyone else who uses the Services.
The Services are offered only to residents of the United States who are at least 18 years old and the age of majority where they live. Features described in this policy apply only where they are available or enabled for your account; not every feature is available to every user or with every brokerage.
Brokerages, payment processors, authentication providers, Discord, X, Whop, and other third-party services you use with Rippll have their own privacy policies, which govern their handling of your information. This policy does not replace any disclosure a brokerage, payment processor, or other third party gives you.
Information we collect
Information you give us
- Account information, such as your email address, your role (subscriber or creator), and your preferences.
- Profile and settings, such as username, bio, location, timezone, language, country, and phone number. We store phone numbers encrypted.
- Creator applications and onboarding, such as your legal name, phone number, country or region, application answers, and your acceptance of creator terms. We store these onboarding fields encrypted and do not show them on public profiles.
- Creator profile content you choose to publish, such as display name, handle, tagline, avatar and banner images, social links, markets and trading style, strategy descriptions, FAQ entries, and disclosures.
- Trading activity on Rippll, such as trade signals a creator publishes (through the web app or Discord commands), the copy settings, sizing limits, exit preferences, risk settings, and approvals a subscriber chooses, and the automation rules you set up.
- Consent records, such as the version, scope, and time of your copy-trading authorization, your acceptance of creator terms, and the consent (including any phrase you type) you give before enabling live automations.
- Referral and tip activity, such as the referral links or codes you use or share, who referred whom, and tips you send or receive.
- Waitlist and contact submissions, such as the name, email address, and trading interests you give us when you join a waitlist, and the name, email, topic, and message you send through our contact form or by email.
Information from brokerages and connected services
- Brokerage connection information. When you connect a brokerage account, directly or through a brokerage-connection provider, we receive connection identifiers, the brokerage name, account numbers and the last digits we use to label accounts, account nicknames, connection status, and permissions. Depending on the brokerage and connection method, we also store the credentials needed to operate the connection, which may include encrypted OAuth access tokens, encrypted refresh tokens, encrypted personal access tokens, an encrypted connection-provider user secret, or encrypted API keys you paste in. Rippll does not ask for or store your broker username and password.
- Brokerage account data, such as balances, positions, orders, fills, order status, and timestamps, and the copy history, previews, and reconciliation records we create from them.
- Prediction-market accounts. Where available, if you connect your own prediction-market account for automations, we store the API key identifier and secret you provide (encrypted) and the orders, fills, and balances needed to run and report on your rules.
- Discord and X. If you link Discord or X, we receive identifiers such as your user id, handle, and (for Discord servers you connect) server and channel ids. For X, we store encrypted OAuth tokens so we can post on your behalf when you ask us to.
- Whop. If a creator imports reviews from Whop, we receive the review content, rating, and the reviewer's display name or username as shown on Whop.
- Payments. From our payment processor we receive customer and subscription identifiers, plan and billing status, and payment, refund, and dispute records. We do not receive or store full card numbers or bank account numbers.
Information collected automatically
- Device and log information, such as IP address, browser and operating system, device type, pages requested, timestamps, request metadata, error reports, and security events. Our hosting provider and our own servers record this in logs.
- Cookies and similar technologies, including local storage and session storage, used for sign-in, security, referrals, preferences, and product analytics. See Cookies, local storage, and product analytics.
- Product analytics, such as which screens you view and general device information, collected as described in that section, including approximate location derived from your IP address.
- Referral signals. When you use a referral link, we keep a hashed identifier for your browser session, and for abuse limits we keep only a keyed hash of your IP address, not the address itself.
- Email events, such as whether an email we sent was delivered, bounced, or was marked as spam.
Information from other sources
- Authentication. Our authentication provider, Clerk, provides your email address, an account identifier, and session information when you sign up or sign in. If you use Sign in with Google (for example, to join a waitlist), Google provides your name, email address, and a Google account identifier.
- Payments. Stripe provides the payment and payout records described above. Stripe collects creators' identity and bank information for payouts directly, under its own terms.
- Referrals. If you arrive through someone's referral link, we record that link so the referral can be attributed.
- Whop, Discord, and X, as described above, when you connect them.
Public information
Some information is public by design. Anyone, including people without a Rippll account, may be able to see:
- A creator's public profile, including display name, handle, tagline, images, social links, markets, trading style, FAQ, disclosures, and imported reviews (including the reviewer names shown on Whop).
- A creator's track record and performance statistics, including leaderboard rankings. Creator performance is calculated from prices and fills the creator enters and is not verified with a brokerage.
- Trade signals a creator chooses to broadcast to a Discord server or to the creator's own X account.
Think carefully before adding personal information to public profile fields. Information that has been posted publicly or to third-party services may be copied or kept by others, and we cannot remove it from places we do not control.
What creators see about subscribers
Creators do not see their subscribers' names, email addresses, brokerage accounts, or positions. In creator tools, each subscriber or tipper appears under a masked label derived from an internal identifier (for example, "Follower" followed by a short code), together with counts, subscription and tip amounts, revenue, and similar aggregated information.
How we use information
- Provide, operate, maintain, and troubleshoot the Services.
- Create and secure accounts, authenticate users, and enforce role-based and operator access.
- Run the features you choose, including brokerage connections, trade signals, copy-trading, previews, sizing and risk limits, exits, alerts, automations, broadcasts, and review imports.
- Record your consents and the actions taken on your account, so we can show what happened and why.
- Process subscriptions, tips, referral attribution, payouts, refunds, and disputes, and meet tax and accounting obligations.
- Review creator applications, profile changes, images, and prices before they go live, and moderate the platform.
- Send service messages, alerts, security notices, support replies, digests, and, where permitted, marketing emails.
- Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our terms, including limits on referral abuse.
- Understand how the Services are used, measure performance, fix errors, and develop and improve features.
- Comply with law, respond to lawful requests, and establish, exercise, or defend legal claims.
Aggregated and de-identified data
We may create aggregated or de-identified information from platform activity and use it for analytics, product improvement, research, reporting, and other lawful business purposes. Aggregated or de-identified data is data processed so that it cannot reasonably be used to identify, or be linked to, a particular person or account. We will maintain such data in de-identified form, will not attempt to re-identify it except as permitted by law, and will require recipients to do the same where the law requires it.
Security
We use administrative, technical, and physical safeguards designed to protect personal information, including:
- Encryption in transit between your browser and our Services.
- Application-level encryption (AES-256-GCM) for brokerage and integration credentials, such as OAuth tokens, connection-provider secrets, and API keys, and for sensitive fields such as creator onboarding details, creator applications, and phone numbers.
- Records, with counts, of every decryption of a brokerage credential.
- Access controls, audit logs of account and operator actions, and redaction of sensitive values from logs and error reports.
We do not collect brokerage usernames or passwords. Other information, including brokerage account numbers, is protected by our access controls but is not encrypted at the application level. No system is perfectly secure, and we cannot guarantee the security of information. You are responsible for protecting your devices, email, brokerage accounts, and sign-in methods, and for telling us promptly at the address below if you believe your account has been compromised.
Retention and account closure
We keep personal information for as long as your account is active and afterward as needed to maintain trading, consent, and audit records; meet payment, tax, and accounting obligations; handle refunds, chargebacks, and disputes; protect security and prevent fraud; enforce our agreements; and comply with law. Some records have shorter, specific periods, for example:
- Referral attribution candidates tied to a browser: about 30 days, then removed in routine cleanup.
- Periodic snapshots of subscriber brokerage activity: about 90 days.
- Records of attempts to connect a prediction-market account: about 7 days.
- Server logs: according to our hosting provider's log retention.
Disconnecting a brokerage or integration. When you disconnect a brokerage, we revoke or stop using the connection's credentials and stop collecting new data through it. We keep the historical records described above.
Closing your account. You cannot close your account while you have a paid subscription that will renew; cancel your paid subscriptions first. Closing or deleting your account deactivates it. We do not immediately erase it: we keep the records we need for trading history, payments and taxes, security, disputes, and legal obligations. When an account is closed, we revoke its prediction-market automations and destroy the stored prediction-market API keys. You may ask us to delete other personal information by contacting us; we handle these requests individually and may keep information where one of the needs above applies.
Your choices and rights
- Account and profile. You can review and update much of your account, profile, and settings in the product.
- Access, correction, and deletion. You may ask us for a copy of, or to correct or delete, your personal information by emailing legal@rippll.ai. Deletion is subject to the retention needs in Retention and account closure.
- Connections. You can disconnect brokerages, Discord, X, and Whop where the product offers that control, or revoke access directly with the third-party service.
- Email. You can unsubscribe from marketing and digest emails using the link in those emails. We will still send service, security, billing, and transactional messages.
- Cookies and analytics. You can accept or reject product analytics in our cookie banner and change your choice any time with the Cookie settings link in the site footer. We treat a Global Privacy Control signal as a rejection. You can also limit cookies and local storage through your browser settings, as described in Cookies, local storage, and product analytics.
We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law. We will not discriminate against you for exercising a privacy right.
California notice
If you are a California resident, this section supplements this policy and serves as our notice at collection under the California Consumer Privacy Act, as amended (CCPA). In the past 12 months we have collected the categories below, from the sources described in Information we collect, for the purposes described in How we use information. We disclose each category for business purposes to the categories of recipients described in How we share information.
| Category | Examples | Retention |
|---|---|---|
| Identifiers | Name, email address, account and authentication identifiers, username and handle, IP address, device and session identifiers, Discord and X identifiers, and payment-processor customer identifiers. | While your account is active, and afterward for trading, payment, tax, security, dispute, and legal needs. |
| Customer records | Name, phone number, email address, and billing and subscription records. | While your account is active, and afterward for payment, tax, dispute, and legal needs. |
| Commercial information | Subscriptions, tips, referrals, payouts, refunds, and disputes; trade signals, copies, and approvals. | While your account is active, and afterward for trading, payment, tax, dispute, and legal needs. |
| Internet or other electronic network activity | Server logs, security events, error reports, and product-analytics events (screens viewed, browser and device information, shortened page addresses). | According to the hosting provider's log retention, the analytics provider's retention, and as needed for security and debugging. |
| Geolocation data (approximate) | Approximate location (country, region, and city) derived from IP address, and the location or country you enter. We do not collect precise geolocation. | As for internet activity and account information above. |
| Financial information | Brokerage account numbers, balances, positions, orders, and fills. | While the connection or account is active, and afterward for trading, dispute, and legal needs; some snapshots about 90 days. |
| Sensitive personal information | Brokerage and integration credentials (such as encrypted access tokens and API keys) that allow access to a financial account, together with the account information above. | While the connection is active; revoked or destroyed as described in Retention and account closure. |
We do not sell personal information. We do not sell or share personal information for cross-context behavioral advertising, including personal information of consumers under 16. We use sensitive personal information only for purposes permitted by the CCPA, such as providing the Services you request, security, fraud prevention, and legal compliance, and not to infer characteristics about you. We do not use personal information to build profiles for advertising.
California residents may have the right to know what personal information we collect, use, and disclose; to access and receive a copy of it; to correct it; to delete it, subject to legal exceptions; and not to be discriminated against for exercising these rights. To make a request, email legal@rippll.ai. We will verify your request using information associated with your account. You may use an authorized agent, and we may require proof of the agent's authority and verification of your identity.
Children
The Services are not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will take steps to deactivate the account and delete the information as required by law. If you believe a minor has provided us with personal information, contact us at the address below.
Where data is processed
Rippll is a United States service, offered only to United States residents. We and our service providers store and process personal information in the United States.
Changes
We may update this policy from time to time. If we make material changes, we will notify you by reasonable means, such as email, an in-app notice, or a notice on this page. Changes take effect on the effective date shown. The dates and version at the top of this page show when it was last updated.
Contact
For privacy questions or requests, contact:
Rippll LLC
Email: legal@rippll.ai
Website: rippll.ai