Privacy Policy

Ritmus (“we”, “our”, or “us”) runs ritmus.live and the Ritmus mobile apps (together, “the Service”) — a platform for creating event pages, gathering guests, and running an interactive live show at the venue. This policy explains what we collect, why, who we share it with, and what you can do about it. It covers everyone who uses the Service: organizers, guests who open an event page, and visitors who never create an account.

Account information Your email address, and — once you complete onboarding — a username, a display name and your date of birth. Optionally a profile photo, cover image, bio, a free-text location, a website and social handles (Instagram, X, Facebook, YouTube). Your date of birth and email are private and never shown on your public profile; everything else on your profile is public. Content you create Events and their details (name, description, venue, date, capacity), images, video and audio you upload, reel content, comments, poll votes, likes, RSVPs, Spotlight moments, wish list items and claims, direct messages, and anything you send us through the feedback form. Location If you allow it, we use your device’s precise location to show events near you on the Nearby map, and — at events whose organizer set a geofence — to work out whether you are at the venue. Location is used at the moment you ask for it and is not stored on your account. When you search for a venue, the text you type is sent to Google Places to return suggestions. Camera, microphone and motion sensors Some show modes ask for access to your camera (Fan Cam), microphone (sound-reactive lights) and motion sensors (tilt-driven lights). Audio and motion are processed on your device only — we never receive or store them. Fan Cam video is relayed live to the venue’s screen through our video provider while you are on air; we do not record it. Device and usage data Platform, timezone, app version, screen size, and accessibility settings your device reports (text scale, reduced motion); when you first and last used the Service; push notification tokens for each device you enable notifications on; and, in feedback reports, the screen you were on when you wrote it. Analytics We use Google Analytics 4 to understand how people move through the Service — screens viewed, sign-ups, sign-ins, whether a notification was opened, and where guests drop off on an event page. The only identifier we attach is your Ritmus account ID; we never send your email address, username or display name to Google Analytics. On the web this runs only after you accept it (see section 9). We do not use advertising identifiers and do not collect IDFA on iOS. Payment and billing If you pay for an event, our payment provider collects your card details directly — they never reach our servers. We store the billing name, country, address and tax ID you enter, plus a record of each payment (amount, tax, currency, date, and what it was for). Security and anti-abuse data To stop automated abuse we store a one-way hash (not the value itself) of the IP address used to view event pages or request a sign-in link, along with short-lived counters. When credits are granted for referrals we store a one-way hash of a normalized form of the new account’s email address, so the same inbox cannot earn credit twice. On the web we also use Firebase App Check with reCAPTCHA Enterprise, which analyses browser signals to tell people from bots.

We do not use tracking cookies of our own. On the web we store a small amount of data in your browser: • Your cookie/analytics choice. • Your sign-in session, kept by Firebase Authentication. • A random visitor ID, used only to count each person once in an event’s view counter. • Which event pages you have already opened, so you are not shown the intro screen twice. • Where to send you after signing in, and which event page referred you. • Whether we have already asked you about notifications. If you accept analytics, Google Analytics also sets its own cookies. You can clear all of this at any time in your browser settings; some features will simply forget your preferences.

• To run the Service: your account, your events, the live show, RSVPs, messages and notifications. • To send transactional email — sign-in links, welcome messages, invitations, agenda reminders, and news that an event was moved or called off. • To send product news, if you turned that on. • To show organizers aggregate numbers about their own event: views, RSVPs, comments, poll results and live audience counts. These are counts, not lists of who you are. • To take payment, issue invoices and apply credits. • To keep the Service safe: rate limiting, abuse and fraud prevention, and reviewing reports we receive. • To improve the Service through analytics. • To meet legal obligations.

Some things are public by design, and it is worth being explicit: • Your profile — display name, username, photo, cover, bio, location, website, social links, follower and event counts. • Events you organize that are published and public, including their venue, date, cover image and total view count. • Comments and Spotlight moments you post on an event page, shown with your avatar and @username. • Whether you are attending events — shown on your profile unless you turn it off in Settings → Privacy. • On Fan Cam, your camera appears on the venue’s big screen while the organizer has you on air. Direct messages, your email, date of birth, billing details, notification preferences, poll votes and likes are not public. Like and poll counts are shown as totals only.

We do not sell your personal data and we do not share it for advertising. We use the following providers, who process data on our behalf: • Google / Firebase — authentication, database, file storage, push notifications, hosting, video transcoding, App Check and Google Analytics. • Google Maps & Places — maps, venue search and geocoding. • LiveKit — the live video relay behind Fan Cam. • Dodo Payments — checkout, payment processing and invoices. Dodo acts as merchant of record for purchases you make from us. • Resend — delivery of our emails. • Our own live-show servers, which we run on Google Cloud, and which relay show commands during an event. We may also disclose data to law enforcement or authorities where we are legally required to, and to a buyer or successor if the Service is ever sold or merged. Organizers see aggregate statistics for their own events, and the list of accounts who RSVP’d to them. Event pages are public, so anyone with the link can see what you post on one.

We are a global service and our providers operate worldwide. Your data may be processed in countries other than your own, including the United States. Where required, our providers rely on the European Commission’s Standard Contractual Clauses or an equivalent transfer mechanism. Live-show servers are created in the region closest to the event.

Where the GDPR applies, we rely on: • Contract — running your account, your events, messaging, notifications you asked for, and taking payment. • Legitimate interests — keeping the Service secure, preventing abuse and fraud, and defending legal claims. • Consent — analytics on the web, push notifications, access to your location, camera, microphone and motion sensors, and product news. You can withdraw consent at any time. • Legal obligation — tax and accounting records.

On the web Analytics only starts after you accept it in the cookie banner. If you decline, no analytics is loaded at all. You can change your mind at any time under Settings → Privacy → Analytics. In the mobile apps Analytics collection begins when you first open the app, and there is currently no in-app switch to turn it off. What we collect is described here and in our App Store and Google Play listings; if you would rather not be included, contact us at privacy@ritmus.live and we will delete your analytics data.

We keep your account data for as long as your account exists. When you delete your account, we remove your profile, your personal events and their content, your RSVPs, likes, votes, comments, Spotlight submissions, wish list claims, credits and device tokens. A few things deliberately survive, and you should know which: • Invoices — kept as a record of payments made, for tax and accounting reasons. • Feedback and reports — kept but anonymised, so that deleting an account cannot erase a report about someone else. • Direct messages — a conversation belongs to two people. Your messages remain in the other person’s inbox, shown as from “Deleted User”. • The referral email hash — a one-way hash that cannot be read back, kept solely so the same inbox cannot claim referral credit again. • Events owned by an organization — they belong to the organization, not to you. Before deleting your account you choose, for each organization you own, whether to hand it over or delete it. Analytics data is retained by Google Analytics for 14 months. Anti-abuse counters expire automatically within about a day.

Depending on where you live, you may have the right to: • Access the personal data we hold about you. • Correct inaccurate data — most of it is editable in Settings. • Delete your data. You can do this yourself in Settings → Account → Delete account; the screen tells you exactly what will be removed before you confirm. • Object to or restrict certain processing. • Receive a copy of your data in a portable format. • Withdraw consent — for analytics, notifications, location, camera, microphone or motion — at any time, in Settings or your device settings. • Complain to your local data protection authority. To exercise any of these, write to privacy@ritmus.live. We answer within 30 days.

Access to your data is enforced on our servers, not just in the app: private documents are readable only by their owner, billing details only by the account owner, and administrative actions are logged. Traffic is encrypted in transit, IP addresses and referral emails are stored only as one-way hashes, and payment card details never reach us. No system is perfectly secure, and we cannot guarantee absolute security.

You must be at least 13 to use Ritmus, and we ask for your date of birth during sign-up to check. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, contact us at privacy@ritmus.live and we will delete it.

We may update this policy. If a change materially affects you, we will tell you by email or a notice in the Service before it takes effect. Continued use after a change means you accept the updated policy.

For privacy questions or requests, write to privacy@ritmus.live.