Privacy Policy

1. Introduction

Ring-Ring values every ride and every stride. This Privacy Policy explains what personal data we collect when you use the Ring-Ring app and website, why we collect it, how long we keep it, who we share it with, and what rights you have over it.

Ring-Ring's approach to your data rests on a small number of fixed commitments:

• No advertising, and no advertising trackers of any kind
• We never sell your personal data
• Your subscription pays for the service — your data is not the product
• Movement sensing can be switched on or off by you at any time, in the app
• Your individual routes are never stored on Ring-Ring's servers, and never published
• Contributing to civic mobility statistics is a separate, explicit, revocable choice — never a condition of using Ring-Ring. It is not switched on yet: Ring-Ring has published no such statistics, and will not do so before you have been asked
• What you say about a place is yours. It is stored with an expiry date, you can delete it, and the words never leave Ring-Ring's own relay

This policy applies to the Ring-Ring mobile application, ring-ring.nu, and any connected dashboards used by gift partners, employers, cities, and membership organisations.

2. Who is responsible for your data

Ring-Ring® B.V., Lisdoddelaan 30, 1087 KA Amsterdam, the Netherlands (KvK 63050269, VAT NL824098389B01), is the data controller for the personal data described in this policy ("Ring-Ring", "we", "us").

Data protection contact: privacy@ring-ring.nu

Definitions

• Gifts — the non-monetary value you accumulate for verified rides and strides.
• Sats — the unit of digital value made available to you through Ring-Ring's value system, held in the app's wallet.
• Rides and strides — cycling and walking activity detected and valued by the app.
• Trusted partners — third-party processors that provide sensing detection, payment processing, and settlement infrastructure on Ring-Ring's behalf, under written data processing agreements.
• Open protocol — the decentralised, public network to which Ring-Ring may publish aggregated mobility statistics. Individual routes are never published to it by Ring-Ring.

3. What data we collect

3.1 Account data

Name, email address, authentication credentials — Ring-Ring uses passwordless / magic-link and, where applicable, social sign-in; we do not store plaintext passwords — account role, and account activity timestamps.

3.2 Movement data

With your permission, the app detects walking and cycling automatically. The detection is performed by our sensing partner, whose software runs inside the app and processes your device's location: GPS coordinates, route paths, timestamps, distance, and detected mode of travel. Background location access is required for detection to work while the app is closed; you control this permission in your device settings and in the app, at any time.

Ring-Ring itself receives only a summary of each trip — mode of travel, distance and timing. Your route is not sent to, read by, or stored on Ring-Ring's servers. Section 5 sets out exactly how this works, including how the app is still able to show you your own route on a map.

3.3 Value data

Your Gifts balance and redemption history, your sats balance, connected multiplier status, and steward-status progress where applicable.

3.4 Payment data

For individual subscriptions, payment is handled directly by Apple or Google — Ring-Ring receives confirmation that a valid subscription exists, but never sees or stores your card details. For organisation subscriptions, payment is handled by our payment partner; we store invoicing details but not full card or bank details.

3.5 Cryptographic identity and wallet keys

Ring-Ring generates a cryptographic keypair to give you a decentralised, self-sovereign identity within the open protocol. This keypair is not tied to your name unless you choose to link it publicly. Only its public component is stored on our servers.

The app also creates a wallet that only you control. The seed that controls the funds in it is generated on your own device, held in your device's secure keystore, and never transmitted to Ring-Ring, to our partners, or to anyone else. We cannot read it, recover it, or move your sats. One consequence matters more than the rest: the app does not yet offer a recovery phrase or backup, so if you lose your device, the sats in that wallet are lost with it. Keep balances small until wallet recovery is available.

3.6 Device and technical data

Device type, operating system, app version, crash and performance logs, and IP address, collected for security, reliability, and fraud-prevention purposes.

3.7 Civic data: measuring, reporting, sharing

Ring-Ring's civic layer has three parts, and they work differently enough that it is worth keeping them apart. Measuring is what your rides and strides add up to. Reporting is what you choose to say about a place. Sharing is what leaves Ring-Ring, and to whom.

Measuring — and it is not switched on

Ring-Ring publishes no mobility statistics today, and will not begin before you have been asked. When it does begin, it will be a separate, explicit choice that is off until you make it, revocable at any time, and never a condition of using Ring-Ring. Withdrawing it stops future trips contributing.

What it will produce, when you have said yes: zone-to-zone journey counts per mode and time period, and the distribution of flow across the street network. Never your individual route, in any form. Four rules govern every figure:

• A figure is published only where at least ten distinct people contribute to it.
• No single person may dominate one, so twelve trips cannot in practice be one frequent commuter.
• Times are coarsened into periods rather than moments — never per minute, never per day per person.
• The first and last few hundred metres of every trip are removed before any calculation, so home and work addresses never enter it.

Reporting — yours, and deletable

You can say something about a place: what is wrong with it, or what is right. A report carries where (a stretch of street, not a point), what (a category from a fixed list), when (coarsely), optionally a note in your own words, and the pseudonymous key that lets you manage it afterwards.

A report never carries the trip it came from. You usually write one while out, which is the natural moment — but it is stored detached: no trip id, no route reference, no way back to your movement.

The note you write is kept on Ring-Ring's own relay, expires by itself, and you can delete it at any time from My reports in the app. It is never published to the open protocol — what leaves Ring-Ring is the category, never your words.

Sharing — what leaves, and where it can never be recalled

Three destinations, and the difference between them is whether anything can be taken back:

• Ring-Ring's own relay. Reports, notes, counters. We can delete, and retention periods apply.
• Public relays. Aggregates and category counts only — never a note, never a route. This is a public, decentralised network: nothing published there can be withdrawn, by us or by anyone.
• Your own key. Separately, you may choose to publish something yourself. That is your act rather than Ring-Ring's processing, it is off by default, and it is equally permanent.

What Ring-Ring publishes is signed by Ring-Ring, not by you.

4. Why we use your data, and our legal basis

5. How your data moves through Ring-Ring

• Your device detects a ride or stride. That sensing runs through our sensing partner, which processes your location data on Ring-Ring's behalf under a written data processing agreement.
• Ring-Ring's servers receive the summary of each trip — mode, distance and timing — and use it to calculate your Gifts and sats. The route itself is deliberately never sent to our servers, and we neither read nor store it.
• When you look at one of your rides on the map, the app fetches that route straight from our sensing partner using a token issued for you alone, draws it on your screen, and discards it. It does not pass through Ring-Ring.
• Payouts settle through settlement infrastructure partners acting on Ring-Ring's behalf. Ring-Ring never takes custody of your funds: sats are paid out to the wallet on your own device, which only you control.
• Civic measuring is not running. No aggregated statistics have been published, and none will be before you have been asked. When it starts, and only if you have said yes, your trips will contribute to aggregates published under Ring-Ring's own signature — group figures that cannot be traced back to you — and you can withdraw at any time so that future trips stop contributing.
• A report you write is stored on Ring-Ring's own relay, detached from the trip it came from. Your words stay there, expire by themselves, and can be deleted by you. Only the category ever reaches a public relay.

6. Who we share your data with

We do not sell your personal data, to anyone, ever. We share limited data only with:

• Trusted partners who provide sensing, payment, and settlement infrastructure — bound by written data processing agreements. Movement sensing is provided by a single sensing partner; it is the only partner that receives your location data.
• Your employer, city, or membership organisation — but only ever in aggregate, non-identifying form. They never receive your individual movement history.
• Gift partners — only confirmation that a redemption occurred, never your movement history.
• Regulators or law enforcement, only where legally required.
• A successor entity in the event of a bona fide business transfer, always subject to the protections of Ring-Ring's steward-ownership structure and this policy.

7. Data separation between roles

Ring-Ring's architecture enforces strict separation between stakeholder roles. These rules are structural, not just policy:

• Your individual ride and stride data is never visible to employers, cities, or membership organisations at an individual level — aggregate data only.
• An employer cannot see which of their connected employees are active or inactive, only collective totals.
• A city receives civic data only from citizens who explicitly opted in, and only as aggregated statistics — never an individual trace.
• A gift partner sees redemption events but never your broader movement history.
• If you hold more than one role, each dashboard is siloed — data does not cross between your roles.

8. International data transfers

Where a trusted partner processes data outside the European Economic Area, Ring-Ring ensures an appropriate safeguard is in place before the transfer occurs — such as the European Commission's Standard Contractual Clauses, or an adequacy decision covering that country.

9. Data retention

We retain your account, movement, and value data for as long as your account remains active, and for a limited period afterward where necessary to meet legal, tax, security, or dispute-resolution obligations.

Aggregated statistics already published to the open protocol persist on that public, decentralised infrastructure independently of your account. They describe groups rather than individuals, and are therefore no longer personal data. The same permanence applies to any route you chose to publish yourself, under your own key.

10. Your rights

Subject to the conditions of the GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time — for example, turning off civic sharing — without affecting processing carried out before withdrawal

11. Account and data deletion

You can ask us to delete your account and the personal data associated with it at any time, whether or not you still have the app installed. Email privacy@ring-ring.nu from the address your account uses, or from any address if you tell us which account you mean. No reason is required.

We confirm the request, delete your account data — account details, trips, and value history — and keep only what tax, accounting or fraud-prevention law obliges us to retain, for the period that law prescribes. We complete this within the timeframe the GDPR sets, and confirm to you when it is done. Deletion from within the app itself is being built; until it ships, email is the route.

Two things deletion cannot reach. Aggregated statistics already published to the open protocol describe groups rather than individuals and cannot be withdrawn from it; the same is true of any route you chose to publish yourself, under your own key. And the sats in your wallet are yours, held on your own device: they are unaffected by deleting your Ring-Ring account, and we could not move them even if you asked.

12. Children's privacy

This version of Ring-Ring is for adults: it is not directed at, and not knowingly used by, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will remove it.

Eighteen is not a privacy threshold, and it is worth saying which one it is. Under the GDPR a child can consent to a service like this from 16 in the Netherlands. The reason Ring-Ring asks for more is what this build puts on the phone: it creates a wallet that holds real value, the key to it never leaves the device, and there is no recovery phrase yet — so a lost phone is lost money, with nobody who can restore it. That is not something to hand a twelve-year-old, and no amount of consent makes it a good idea.

It changes when the family account ships. Children will take part as soon as they walk or cycle with their own phone: the child earns Gifts, the sats go to the adult who holds the account, and the child holds no keys at all. That removes the reason for the limit rather than working around it. When it arrives, this section is rewritten with it, and a children's section is added rather than this one being quietly deleted.

13. Security

We apply industry-standard technical and organisational safeguards — including encryption of data in transit and at rest, access controls, and regular security review of our own systems and our trusted partners' — to protect your personal data.

14. Changes to this policy

Where we make material changes to this policy, we will notify you in-app before the changes take effect. The effective date at the top of this page always reflects the version currently in force.

15. Contact us