This policy covers the website at tryripcord.com and the Ripcord application at app.tryripcord.com (together, the Service), operated by Ripcord (the company being formed by Jeremy Hazan; the legal entity will be named here once incorporated). Questions go to [email protected].
The website is static pages served by Vercel. We run no analytics scripts, no advertising pixels and no tracking cookies on it. Vercel and Cloudflare keep standard server logs (IP address, user agent, requested page) for their own operation; see their privacy policies for retention. The website sets no cookies of its own, so it shows no cookie banner: there is nothing to consent to. Two pages embed a third party for a function you ask for: the demo page loads a Cal.com booking calendar, and the pricing page's waitlist form sends the address and fleet size you type to our application. Cal.com may set its own cookies inside its frame, under Cal.com's privacy policy. If you email us, we keep the email.
When you sign in we store your email address, your display name, the time of sign-in and a session identifier. Sign-in is by a one-time link sent to your email or by Google. With Google sign-in we receive your email address, whether Google has verified it, your name and your Google account identifier; we do not receive your password and we ask for no other Google data. Your workspace is keyed to your email domain so that colleagues can join it.
The application sets one cookie: a session identifier, marked HttpOnly and SameSite, valid for thirty days and cleared when you sign out. It is strictly necessary to keep you signed in, so it needs no consent. The sign-in page loads Google's sign-in widget, which runs in its own frame under Google's privacy policy. The application also keeps a few small preferences in your browser's own storage, such as whether you skipped setup or have read a brief; those never leave your browser. The public demo signs visitors into a shared read-only workspace with the same session cookie and stores nothing about them.
Ripcord's purpose is to record and gate the actions of AI agents you connect. For each action we store: the agent's name, the tool called, the action's parameters as they left your environment, the risk verdict and its reasons, the decision a person took and their name and role, and whether the action ran, failed or was reversed. This record is a hash-chained ledger and is kept for the life of your workspace, because its purpose is to be an audit trail.
Parameters are processed by the Ripcord gateway inside your own environment before they reach us. Where you configure data rules, personal data in tool arguments and results is replaced with pseudonyms there, and the table that maps pseudonyms back to real values stays in your environment. We never hold your systems' credentials: the gateway does, on your side.
We use a small number of providers to run the Service: Railway for hosting the application and its database, Vercel and Cloudflare for the website, Resend for delivering sign-in links and notifications, Google for Google sign-in, Cal.com for demo bookings, Slack or Microsoft Teams when you connect them for approvals, and Anthropic for model inference when you choose a Claude brain or turn on the morning brief. Each receives only what its function needs. The current list is available on request and will be published on this page when the application opens to customers.
Account data is kept while your workspace exists. Sign-in links expire after fifteen minutes and are single use; sessions expire after thirty days. The ledger is kept for the life of the workspace. When a workspace owner asks us to delete the workspace, we delete accounts, keys, rules and the ledger within thirty days, except where a legal obligation requires keeping a record, in which case we keep only what the obligation requires and tell you.
You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. If you are in the European Union or the United Kingdom you have these rights under the GDPR and may also complain to your supervisory authority. Write to [email protected]; we answer within thirty days.
Sign-in tokens, session identifiers and gateway keys are stored as hashes. Transport is encrypted. The ledger is tamper-evident: every entry is chained to the previous one by a cryptographic hash, and any alteration is detectable.
When this policy changes we update the date at the top and, for material changes, tell signed-in users in the application. Earlier versions are available on request.