Skip to content

Privacy policy

Last updated: September 2026

1. Data controller

Falko Flamme
Reinganumstraße 25
60385 Frankfurt am Main
Germany

Email: hi@ritloop.com

2. Hosting (Vercel)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the website, Vercel automatically processes technical access data in server logs: your IP address, user agent (browser type), and access timestamp. This data is technically necessary to deliver the website.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating a secure and stable website. Where data is transferred to the United States, this is based on the EU Standard Contractual Clauses. More information: vercel.com/legal/privacy-policy

3. Website analytics (Vercel Web Analytics)

We use Vercel Web Analytics and see aggregate statistics about how this website is used. According to the provider, the service works without cookies and uses a short-lived hash of request data to identify visits; this association is discarded after 24 hours. It does not create visitor profiles across websites. The provider’s event data may include the URL, referrer, device information and region. More information: Vercel: Web Analytics privacy

On the listening page, we count three additional events: how often episode 1 starts, how often at least 80 percent of an episode is played and how often optional quick feedback is submitted. We see aggregate counters. Our own event fields contain no names, email addresses, free text or information about children. We no longer store a listening date to count return visits.

When people share or recommend RITLOOP, we also count anonymously how often the device’s sharing window opens (Web Share API), how often a link is copied to the clipboard, how often someone arrives through a shared link marked “via=teilen” and whether an episode starts through such a link, how often free colouring pages are downloaded and how often links to our social-media profiles are clicked. Our own event fields contain only the type of destination, the page, the episode number where relevant and the channel name. They contain no names, email addresses, free text, recipients, children’s data or personal identifiers. We do not know whether a link was actually sent.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in statistical analysis and improving our offering.

4. Cookies and local storage

This website does not use tracking, marketing or analytics cookies. The optional team mission uses a technical cookie to preserve discovered clues, as explained below.

On the listening page, your browser remembers only for the current session whether you have answered an episode’s quick feedback. A previously stored listening date for the return counter is deleted the next time you open the German or English listening page, provided your browser allows storage access. On “Six moments”, selected ideas and personal entries are saved locally in the browser on your device. New sharing links contain only known ideas, never personal entries. “Start again” deletes the saved plan; you can also remove local website data in your browser settings.

Language listening pages from the books

The separate pages under /sprachen/ do not load web analytics scripts or send listening events. If you turn on the option to remember your place, we store only the language, one recording’s identifier and file version, and its last playback position in your browser. This feature does not send those values to us. It creates no history of multiple recordings and stores no listening date. Turning the option off or clearing your saved place removes the entry; you can also delete it through your browser’s website-data settings. Playback works without this persistent storage when you leave the option off. Technical requests for pages and audio files remain subject to the hosting described above.

Dido team mission: saved discoveries

The team pages and QR redirects do not send page views, selections or individual answer histories to Web Analytics. Normal technical hosting access logs still apply (section 2). We do not request names, child profiles, microphone access or voice recordings.

Only when you submit a selection, the technical cookie ritloop_team_mission stores the discovered clue IDs, mission version, expiry time and an integrity signature. It contains no name, device identifier or history of incorrect answers. It is sent only to the mission endpoint to preserve stars and open the bonus after six discoveries. It expires 24 hours after the last submitted selection. Deleting this website’s browser data also removes your progress. Progress is not transferred between devices; there is no account or server-side child profile.

The cookie serves the mission you choose to use, not analytics or advertising. Songs and stories remain accessible without it. The optional parent feedback form creates a draft in your browser only. The website does not send it. If you open and send it in your email app, section 6 applies. Please do not include names, patient details or health information about children.

Six moments: shared links

For “Six moments”, we do not send page views or events to Vercel Web Analytics. Older plan links may contain personal entries in their address. Opening such a link sends that address to our hosting provider as part of the request; this change does not retrospectively delete existing logs. The page reads only known ideas from these older links, too.

5. Waitlist, test families, feedback, and ideas (Formspree)

We use Formspree for waitlist entries, test-family inquiries, feedback, and submitted family ideas. Depending on the form, we process your optional name, email address, optional approximate age information, rating, and voluntary free-text entries. Please do not enter children’s names, health information, or other identifying details in free-text fields.

Your information is used only for the purpose stated in the form and is not published without separate permission. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw consent at any time for the future by email. Information no longer needed is deleted once its purpose has been fulfilled or you withdraw consent, unless legal retention obligations apply.

Formspree processes submissions as a technical service provider in the United States. Formspree states that it uses Amazon Web Services in the US and the EU Standard Contractual Clauses. More information: formspree.io/security.

6. Contact by email

When you email us, we process your information (email address and message content) solely to answer your inquiry. The legal basis is Article 6(1)(b) GDPR (handling inquiries or taking steps before entering a contract). We do not share this information with third parties.

7. Sharing, external links, and social-media profiles

Sharing buttons on our website use your device’s Web Share API. It opens your operating system’s sharing window only after you click; your device decides which apps appear. We do not know whom you send something to, or whether you send it. If this feature is unavailable, we copy the link to your device’s clipboard after you click, or display it for selection. Shared listening and information links may include “via=teilen”. This is used only for the anonymous counting described in section 3, changes nothing and does not identify anyone.

Our footer links to our Instagram and TikTok profiles. These are simple links: visiting our website does not load content, scripts, feeds, or tracking pixels from these platforms or send data to them. Only when you click a link do you leave our website. The respective provider’s privacy policy then applies (Meta Platforms Ireland Limited for Instagram and TikTok Technology Limited for TikTok).

All other external links, such as source references, also transmit data to the provider only after you click. Simply visiting our website sends no data to these providers.

8. Your rights

Under the GDPR, you have the following rights:

  • Access (Article 15 GDPR)
  • Rectification (Article 16 GDPR)
  • Erasure (Article 17 GDPR)
  • Restriction of processing (Article 18 GDPR)
  • Data portability (Article 20 GDPR)
  • Objection (Article 21 GDPR)

To exercise your rights, simply email: hi@ritloop.com

You also have the right to lodge a complaint with a data protection supervisory authority. The responsible authority is the Hessian Commissioner for Data Protection and Freedom of Information.

9. Date and changes to this policy

Privacy policy updated: September 2026. We may update this policy when our website or the law changes, for example if new features such as a shop or newsletter are added. The current version published here applies.