Privacy Policy

1. Introduction

This Privacy Policy describes how Ribbon (“Company,” “we,” “us,” or “our”) collects, uses, discloses, stores, and otherwise processes personal information in connection with the Ribbon service available at https://rbbn.app and related applications, emails, and services (collectively, the “Service”).

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, do not use the Service.

This Policy should be read together with our Terms of Service. In the event of a conflict regarding personal information processing, this Privacy Policy controls to the extent of the conflict.

2. Controller / Responsible Party

The data controller (or equivalent responsible party) for personal information processed through the Service is:

Ribbon
Address available upon written request to hello@rbbn.app
Contact: hello@rbbn.app

3. Scope and Applicability

This Privacy Policy applies to personal information we process when you:

• create or use a Ribbon account;
• connect third-party accounts (including X) to the Service;
• upload exports or other content to the Service;
• use the Ribbon browser extension to import bookmarks from your own X session;
• receive digests, transactional email, or product communications;
• make purchases or manage subscriptions; or
• otherwise interact with the Service.

This Policy does not apply to third-party websites, products, or services that we do not control, including X (Twitter), payment processors, or model providers, except to the extent we receive personal information from them in connection with the Service.

4. Categories of Personal Information We Collect

We collect personal information from you directly, automatically through your use of the Service, and from third parties you authorize.

4.1 Information you provide

• Account identifiers: name, email address, authentication credentials/tokens associated with magic-link sign-in, and account preferences (including digest interval and digest delivery email).
• Content you submit: uploaded bookmark exports, files, and any text or metadata contained therein.
• Communications: messages you send to support or legal contacts, and related correspondence.
• Billing details necessary to administer subscriptions (processed primarily by our payment processor; we typically receive limited billing metadata such as customer ID, subscription status, and plan).

4.2 Information from connected third-party services (including X)

If you choose to connect an X account, we receive information authorized by you via X’s OAuth permissions, which may include:

• X user identifiers, username, display name, and profile image URL;
• bookmarked posts and related metadata (including post text, author information, engagement metrics, timestamps, folder labels if available, post URLs, and URLs for attached media such as photos, videos, or GIF previews when provided by X);
• OAuth access and refresh tokens (stored encrypted at rest) and associated scope/expiry information; and
• if you authorize list-related permissions, information necessary to create or modify X Lists on your behalf.

We do not receive your X password. Connection is optional. You may revoke access via X’s application settings and/or by disconnecting within the Service (where available). Revocation or disconnection may limit or terminate related Service functionality.

Media and images. As currently constituted, Ribbon stores media and avatar information primarily as HTTPS URLs (and related metadata) in our database. We do not generally download or re-host image or video binary files on Ribbon-operated file storage. When you view the Library or receive a digest email, your browser or email client typically retrieves those files directly from third-party hosts (such as X’s CDN), which we do not control. URL strings and post text remain Customer Content stored with your account.

4.3 Information generated by the Service

• Derived insights: themes, theses, interest profiles, rankings, digests, and related analytical outputs generated from your bookmarks and settings.
• Usage and diagnostics: log data, device/browser type, IP address, timestamps, approximate location derived from IP, referral URLs, and error/performance telemetry reasonably necessary to operate and secure the Service.
• Cookies and similar technologies: session cookies and similar identifiers required for authentication and security. We do not rely on third-party advertising cookies for the core Service.

5. Purposes and Legal Bases for Processing

We process personal information for the following purposes:

• Provide the Service: authenticate users; sync and store bookmarks; generate digests and insights; deliver email; create optional X Lists when authorized; provide customer support.
• Account and subscription administration: billing, plan entitlements, fraud prevention, and accounting.
• Security and integrity: detect, prevent, and respond to abuse, unauthorized access, and technical issues.
• Improve and develop the Service: aggregated or de-identified analytics, quality evaluation of digest generation, and operational metrics. We do not sell personal information.
• Communications: transactional messages (security, billing, digests you request) and, where permitted by law, limited product notices. You may opt out of non-essential marketing emails where applicable; transactional messages may still be sent.
• Legal compliance: comply with law, enforce Terms, and establish, exercise, or defend legal claims.

Where required by applicable law (including GDPR/UK GDPR), we rely on one or more of: performance of a contract; legitimate interests (that are not overridden by your rights); consent (including for optional third-party connections and certain communications); and legal obligation.

6. Artificial Intelligence and Automated Processing

The Service uses automated systems, including third-party large language models and related infrastructure, to analyze bookmark content and generate digests, theses, themes, and insights.

To provide these features, we may transmit relevant portions of your bookmark text, author metadata, and related signals to subprocessors that host model inference. We do not intentionally transmit your X OAuth tokens to model providers.

Outputs may be inaccurate, incomplete, or unrepresentative. Digests and insights are informational tools and do not constitute professional advice. You remain responsible for how you use outputs.

We do not use your bookmark content to train publicly available foundation models operated by us. Third-party model providers may process prompts under their own terms; we select providers and configurations intended to restrict retention and training where commercially available, but you acknowledge that provider practices may change and are governed by their policies.

7. Disclosure of Personal Information

We may disclose personal information to:

• Service providers / subprocessors that perform services on our behalf, which may include: hosting and databases; authentication infrastructure; email delivery; payment processing (e.g., Stripe); job scheduling; logging/monitoring; and AI model inference providers. Such parties are authorized to process personal information only as needed to perform services for us and are required to protect it under contractual obligations appropriate to the sensitivity of the data.
• Third-party platforms you connect (including X), when you direct the Service to take actions on those platforms (for example, creating a List).
• Professional advisors (legal, accounting, insurance) under confidentiality obligations.
• Authorities and legal recipients when we believe disclosure is required by law, legal process, or to protect rights, safety, and security.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and continuity of privacy commitments where required.

We do not sell personal information as “sale” is commonly defined under U.S. state privacy laws, and we do not share personal information for cross-context behavioral advertising. If that changes, we will update this Policy and provide required opt-out mechanisms.

8. International Transfers

We may process and store personal information in the United States and other countries where we or our subprocessors operate. Those countries may have data protection laws different from those in your jurisdiction. Where required, we implement appropriate transfer mechanisms (such as Standard Contractual Clauses) for cross-border transfers.

9. Retention

We retain personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. In general:

• Account, bookmark, digest, and insight data are retained while your account remains active and for a reasonable period thereafter as needed for backups, dispute resolution, and legal compliance.
• OAuth tokens are retained while the connection remains authorized and are deleted or rendered unusable upon disconnection or account deletion, subject to residual backup cycles.
• Billing records may be retained as required for tax, accounting, and fraud prevention.
• Logs and security records are retained for limited periods consistent with security and operational needs.

Upon verified account deletion requests, we will delete or de-identify personal information in active systems within a commercially reasonable period, except where retention is required or permitted by law.

10. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including encryption of certain secrets at rest (such as third-party access tokens), access controls, and transmission security via HTTPS. No method of transmission or storage is completely secure. You are responsible for maintaining the security of your email account used for authentication and for promptly notifying us of suspected unauthorized access.

11. Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, or export personal information; to object to or restrict certain processing; to withdraw consent where processing is consent-based; and to lodge a complaint with a supervisory authority.

You may also: disconnect third-party integrations; adjust digest preferences; and cancel subscriptions through the billing portal where available.

To exercise rights, email hello@rbbn.app from the email associated with your account and describe your request. We may need to verify your identity before fulfilling requests. We will not discriminate against you for exercising rights under applicable law.

California residents: We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. California residents may request know/access, deletion, and correction rights subject to exceptions. Contact hello@rbbn.app.

EEA/UK residents: You may contact us at hello@rbbn.app to exercise GDPR/UK GDPR rights. If we appoint an EU/UK representative, contact details will be posted on the Service.

12. Children’s Privacy

The Service is not directed to individuals under 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have collected such information, contact hello@rbbn.app and we will take appropriate steps to delete it.

14. Third-Party Services and Platform Dependency

The Service depends on third-party platforms and APIs, including X. Those platforms’ availability, terms, rate limits, pricing, and data access policies are outside our control. Changes by third parties may reduce, alter, or eliminate features of the Service. Personal information handled by those platforms is also subject to their privacy policies.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date indicates the latest revision. Material changes will be posted on the Service and, where required by law, communicated to you. Continued use after the effective date of changes constitutes acceptance of the updated Policy, except where additional consent is required by law.

16. Contact

For privacy, abuse, copyright (DMCA), legal notices, or other questions about this Policy or the Service, contact hello@rbbn.app. Please use a clear subject line (for example “Privacy Request,” “Abuse Report,” or “DMCA Notice”).