This policy explains what personal data Ridori collects when you use the app, why we collect it, and your rights under the GDPR.
1. Who we are
The data controller is Andrii Horlov, based in Porto, Portugal. You can reach us at support@ridori.app. We operate the Ridori Android app (ridori.app).
2. What data we collect and why
Account credentials
Email address and password (or Google Sign-In token) used to create and authenticate your account. Legal basis: performance of a contract (to provide the service).
Profile information
Your display name, family name, a short bio, and profile photos. This is shown to other users so they can decide whether to connect with you. Legal basis: performance of a contract.
Children's details
Names and ages of your children, entered by you. Used to match families with children of similar ages. Legal basis: performance of a contract. See section 7 for more on children's data.
Approximate location
We use your approximate location (neighbourhood or area, not precise GPS coordinates) to show you nearby families. Your exact address is never stored or shared. Legal basis: performance of a contract.
Messages
Chat messages sent between connected users are stored in our database to deliver them and to allow you to view conversation history. Legal basis: performance of a contract.
Online and activity status
Whether you are currently active in the app and when you were last active. Used to show other users whether you are available. Legal basis: legitimate interests (improving the usefulness of the connection experience). You can limit visibility of your online status in the app settings.
Connections and blocks
Records of which users you have connected with or blocked. Used to manage your social graph and enforce blocks. Legal basis: performance of a contract.
Reports about other users
If you report another user for violating our terms, we store the report to investigate and take action. Legal basis: legitimate interests (maintaining platform safety).
Push notification token
A Firebase Cloud Messaging (FCM) token is stored to send you push notifications about new messages and connection requests. Legal basis: performance of a contract. You can disable notifications in your device settings at any time.
Transactional emails
Your email address is passed to Brevo (our email provider) solely to send password reset emails and essential account notifications. It is not used for marketing without your consent. Legal basis: performance of a contract.
3. How long we keep your data
Account and profile data: Kept for as long as your account is active. Deleted within 30 days of account deletion.
Messages: Deleted with your account. We do not retain message history after deletion.
Safety reports: Retained for up to 2 years to maintain safety records, even after account deletion.
Usage logs: Anonymised technical logs may be retained for up to 90 days for debugging purposes.
Email (Brevo): Removed from Brevo within 30 days of account deletion.
4. Who we share your data with
We do not sell your data. We do not share it with advertisers. We share it only with the processors below, to the extent necessary to run the service.
Google Firebase (Google LLC, USA)
Provides authentication (Firebase Auth), database (Firestore), file storage (Cloud Storage), real-time data (RTDB), and push notifications (FCM). Governed by Google's data processing terms and Standard Contractual Clauses (SCCs) for transfers outside the EEA.
Brevo (Sendinblue SAS, France)
Used to send transactional emails (password reset, account notifications). Brevo is an EU-based processor and GDPR-compliant.
5. International transfers
Google Firebase processes data on servers that may be located outside the European Economic Area (EEA), including in the United States. These transfers are covered by Google's Standard Contractual Clauses (SCCs) approved by the European Commission, providing an adequate level of protection for your data.
6. Your rights under the GDPR
You have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Ask us to correct inaccurate or incomplete data.
- Erasure: Request deletion of your data. See Delete your account.
- Portability: Request your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting prior processing.
- Lodge a complaint: You can complain to the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados).
To exercise any of these rights, email support@ridori.app. We will respond within 30 days.
7. Children's data
Ridori is for parents and legal guardians aged 18 and over. The children's details stored in the app (names and ages) are entered by the parent or guardian about their own children. Parents control this information and can edit or delete it at any time through their profile, or by deleting their account. We do not knowingly collect data from children directly.
8. How to delete your account
You can delete your account and all associated data from within the app. See our Delete Account page for step-by-step instructions and information on what is retained after deletion.
9. Changes to this policy
If we make meaningful changes to this policy, we will notify you by email or through the app before the changes take effect. The date at the top of this page will always show when it was last updated.
10. Contact
For any privacy questions or to exercise your rights, email support@ridori.app. We aim to respond within 30 days.