Privacy policy

Last updated: 13 October 2026

1. Data controller

Falko Flamme
Reinganumstraße 25
60385 Frankfurt am Main
Germany

2. Hosting (Vercel)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the website, Vercel automatically processes technical access data in server logs: your IP address, user agent (browser type), and access timestamp. This data is technically necessary to deliver the website.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating a secure and stable website. Where data is transferred to the United States, this is based on the EU Standard Contractual Clauses. More information: vercel.com/legal/privacy-policy

3. Website analytics (Vercel Web Analytics)

On selected public pages, we count film starts, clicks to listening or book pages, and selected PDF download clicks. Only approved campaign identifiers are retained; other query parameters and URL fragments are removed. Private plan pages, team missions and language pages under /sprachen are excluded from analytics. When Do Not Track or Global Privacy Control is enabled, we send no page views or custom events to Web Analytics.

We use Vercel Web Analytics and see aggregate statistics about how this website is used. According to the provider, the service works without cookies and uses a short-lived hash of request data to identify visits; this association is discarded after 24 hours. It does not create visitor profiles across websites. The provider’s event data may include the URL, referrer, device information and region. More information: Vercel: Web Analytics privacy

On /start and /es, we count one actual playback start per episode and page visit (folge_play), with the episode number and page; /es also includes the language es. Pausing, resuming and buffering do not create another start there. On /hoeren and /en/hoeren, we count episode starts (folge_play), starts of episode 1 (folge1_start), playback reaching 80 percent (abschluss_80), and optional quick feedback submissions (feedback_gesendet). These are aggregate counters. Our own event fields contain no names, email addresses, free text or information about children. We do not store a listening date to count return visits.

Clicks from selected public pages, including /hoeren and /en/hoeren, to the listening entry or book page are counted as cta_click, with the source page and type of destination. On /buch, /en/buch, /es and /it, clicks to the offered Amazon editions are counted as amazon_click. Only fixed edition identifiers (for example B1-DE), the link position and source page are sent. For clicks on the additional US and UK links, we also send the marketplace label US or UK. An Amazon click does not prove a purchase; sales reports are not linked to a person or website visit this way.

An approved campaign label is temporarily kept in this tab’s memory during internal navigation between selected public pages and added to cta_click, amazon_click and folge_play. It is discarded when leaving the page, entering an excluded route or encountering unknown campaign parameters. It is not stored in cookies or browser storage and contains no visitor identifier. A new tab or reload does not inherit it unless the newly opened link contains an approved label.

When people share or recommend RITLOOP, we also count anonymously how often the device’s sharing window opens (Web Share API), how often a link is copied to the clipboard, how often someone arrives through a shared link marked “via=teilen” and whether an episode starts through such a link, how often free colouring pages are downloaded and how often links to our social-media profiles are clicked. Our own event fields contain only the type of destination, the page, the episode number where relevant and the channel name. They contain no names, email addresses, free text, recipients, children’s data or personal identifiers. We do not know whether a link was actually sent.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in statistical analysis and improving our offering.

3a. Website statistics with Metricool

On selected public entry pages, we also use Metricool to review page visits alongside our social-media statistics. We send the page address without free-form query parameters or fragments, an approved campaign identifier where applicable, and the domain of a known public referral source. We do not send full referring addresses, form entries, names or email addresses. Private plan pages, team missions and language listening pages are excluded, as are visits with Do Not Track or Global Privacy Control enabled. The website also works without this measurement.

The browser connects to Metricool Software, S.L. in Spain, which technically exposes its IP address. According to the provider, the IP is processed for the connection and geographic analysis but is not stored. Our integration sends no cookies, uses no local storage and loads no additional tracking script. More information: Metricool: data processing for website analytics.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in measuring the reach of our public content. The data is not used for personalised advertising. You can object to this measurement by enabling Do Not Track or Global Privacy Control in your browser, or by contacting us.

4. Cookies and local storage

This website does not use tracking, marketing or analytics cookies. The optional team mission uses a technical cookie to preserve discovered clues, as explained below.

On the listening page, your browser remembers only for the current session whether you have answered an episode’s quick feedback. A previously stored listening date for the return counter is deleted the next time you open the German or English listening page, provided your browser allows storage access. On “Six moments”, selected ideas and personal entries are saved locally in the browser on your device. New sharing links contain only known ideas, never personal entries. “Start again” deletes the saved plan; you can also remove local website data in your browser settings.

Language listening pages from the books

The separate pages under /sprachen/ do not load web analytics scripts or send listening events. If you turn on the option to remember your place, we store only the language, one recording’s identifier and file version, and its last playback position in your browser. This feature does not send those values to us. It creates no history of multiple recordings and stores no listening date. Turning the option off or clearing your saved place removes the entry; you can also delete it through your browser’s website-data settings. Playback works without this persistent storage when you leave the option off. Technical requests for pages and audio files remain subject to the hosting described above.

Dido team mission: saved discoveries

The team pages and QR redirects do not send page views, selections or individual answer histories to Web Analytics. Normal technical hosting access logs still apply (section 2). We do not request names, child profiles, microphone access or voice recordings.

Only when you submit a selection, the technical cookie ritloop_team_mission stores the discovered clue IDs, mission version, expiry time and an integrity signature. It contains no name, device identifier or history of incorrect answers. It is sent only to the mission endpoint to preserve stars and open the bonus after six discoveries. It expires 24 hours after the last submitted selection. Deleting this website’s browser data also removes your progress. Progress is not transferred between devices; there is no account or server-side child profile.

The cookie serves the mission you choose to use, not analytics or advertising. Songs and stories remain accessible without it. The optional parent feedback form creates a draft in your browser only. The website does not send it. If you open and send it in your email app, section 6 applies. Please do not include names, patient details or health information about children.

Six moments: shared links

For “Six moments”, we do not send page views or events to Vercel Web Analytics. Older plan links may contain personal entries in their address. Opening such a link sends that address to our hosting provider as part of the request; this change does not retrospectively delete existing logs. The page reads only known ideas from these older links, too.

5. Waitlist, test families, feedback, and ideas (Formspree)

We use Formspree for waitlist entries, test-family inquiries, feedback, and submitted family ideas. Depending on the form, we process your optional name, email address, optional approximate age information, rating, and voluntary free-text entries. Please do not enter children’s names, health information, or other identifying details in free-text fields.

Your information is used only for the purpose stated in the form and is not published without separate permission. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw consent at any time for the future by email. Information no longer needed is deleted once its purpose has been fulfilled or you withdraw consent, unless legal retention obligations apply.

Formspree processes submissions as a technical service provider in the United States. Formspree states that it uses Amazon Web Services in the US and the EU Standard Contractual Clauses. More information: formspree.io/security.

Getting started with Dido: local listening progress

On /start, your browser saves the selected language, current episode, file version and playback position so you can continue next time. These values stay on your device and are not transmitted to us by this feature. You can delete them in your browser’s website-data settings. No account is needed. The sample player on /es does not save progress.

Dido Post: a non-binding expression of interest

The Dido Post form asks only for the email address of the adult making the enquiry. We also send the form’s purpose and the wording and version of the consent given. As part of the submission, Formspree also processes technical access data, such as the IP address and browser information, as described in its privacy policy. We use the enquiry to send one message about the specific Dido Post offer, including its contents, total price and launch date. Submitting this form does not place an order, reserve a place or subscribe you to a general newsletter. This form does not collect information about children.

The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time, with effect for the future, by emailing hi@ritloop.com. We delete the enquiry when it is no longer needed for its purpose, if the project is cancelled or if you withdraw your consent, unless statutory retention obligations apply. Any later purchase or further contact requires its own legal basis.

6. Contact by email

When you email us, we process your information (email address and message content) solely to answer your inquiry. The legal basis is Article 6(1)(b) GDPR (handling inquiries or taking steps before entering a contract). We do not share this information with third parties.

7. Sharing, external links, and social-media profiles

Sharing buttons on our website use your device’s Web Share API. It opens your operating system’s sharing window only after you click; your device decides which apps appear. We do not know whom you send something to, or whether you send it. If this feature is unavailable, we copy the link to your device’s clipboard after you click, or display it for selection. Shared listening and information links may include “via=teilen”. This is used only for the anonymous counting described in section 3, changes nothing and does not identify anyone.

Our footer links to our Instagram and TikTok profiles. These are simple links: visiting our website does not load content, scripts, feeds, or tracking pixels from these platforms or send data to them. Only when you click a link do you leave our website. The respective provider’s privacy policy then applies (Meta Platforms Ireland Limited for Instagram and TikTok Technology Limited for TikTok).

All other external links, such as source references, also transmit data to the provider only after you click. Simply visiting our website sends no data to these providers.

8. Your rights

Under the GDPR, you have the following rights:

Access (Article 15 GDPR)
Rectification (Article 16 GDPR)
Erasure (Article 17 GDPR)
Restriction of processing (Article 18 GDPR)
Data portability (Article 20 GDPR)
Objection (Article 21 GDPR)

To exercise your rights, simply email: hi@ritloop.com

You also have the right to lodge a complaint with a data protection supervisory authority. The responsible authority is the Hessian Commissioner for Data Protection and Freedom of Information.

9. Date and changes to this policy

Privacy policy updated: 13 October 2026. We may update this policy when our website or the law changes, for example if new features such as a shop or newsletter are added. The current version published here applies.