How Ristretto uses your data.

The short version

Ristretto uses the information you give us to create your account, find a suitable Ristretto partner, schedule the Ristretto, run the call, and send service messages. The current application has no advertising or data-sale integration.

You control whether you take part in matching. You can disconnect your calendar, pause future matching and optional profile prompts, replace or remove your profile picture, and delete your account.

Information we handle

• Account and sign-in data: your email address, one-time sign-in tokens, a hashed session token, session expiry, referral information, account dates, and account status.
• Profile data: your name, role, company, short introduction, topics, motivations, languages, time zone, weekly Ristretto goal, LinkedIn profile URL if you add one, and onboarding choices.
• Pictures and voice notes: a picture you upload or, when available, import from Telegram; an introduction recording; answers to profile prompts; and private post-Ristretto voice reflections. We also store file details such as type, size, duration, and storage key.
• Availability, booking, and calendar data: availability you set for matching and your personal sharing page, booking holds (including the visitor details needed to arrange the Ristretto), meeting duration, encrypted Google access and refresh tokens, token expiry, and calendar ID. Ristretto asks Google for busy periods to find free time, but does not save the titles or contents of your existing calendar events. It stores identifiers for calendar events it creates.
• Matching and Ristretto data: weekly participation, the people matched, proposed and changed times, match score and status, cancellations and their stated reason, feedback, private reflections, and whether a Ristretto was completed.
• Safety data: member blocks, conduct categories and seriousness, moderation status, appeals, policy and decision versions, and an audit trail of automated and administrator actions. A report contains the reporter’s encrypted description and only the chat messages or private transcript excerpts the reporter deliberately selects. Ristretto does not silently add private reflections, a full native transcript, call audio, or unrelated messages to a report. Permanent removal creates a keyed, one-way fingerprint of the account email so the same address cannot simply recreate the account; the safety block list does not contain the readable address.
• Call data: your choice of audio or video, consent time, join and leave times, heartbeats used to measure presence, whether you connected, and approximate time present. Ristretto’s web call does not record or store the call’s audio, video, or a transcript. On supported Apple devices, a transcript and encrypted personal memory may be created only after both people consent. They remain on the device by default. In a signed build with private iCloud support, you can separately opt in to sync app-encrypted records through your private iCloud database; the encryption key is carried by iCloud Keychain, and the Ristretto web service does not receive the transcript or key.
• Bot and message data: your Telegram chat ID or WhatsApp number, Telegram username when supplied, bot conversation state, message identifiers used to attach replies to the right question, your replies, notification contents, and delivery status. Voice replies are downloaded from the messaging provider and stored as Ristretto voice notes. Separate webhook records keep a provider update or message ID, processing status, attempt count, times, and a short error message when delivery fails; these records prevent the same message from being processed twice.
• Technical and security data: the essential login cookie, token hashes, request details used for rate limiting, and technical logs produced by the application and its hosting systems. These logs may include an IP address, time, requested page, and error details.
• Ritrovo inquiries: your name, work email, organization, intended participant groups, network boundaries, approximate participant count, and the outcome you want from a company or partner network.

What we use it for

• Authenticate you and protect the service from misuse.
• Set up your profile and improve matching between members.
• Find overlapping free time without showing your calendar details to another member.
• Create, change, and cancel Ristrettos and calendar invitations.
• Run end-to-end encrypted calls and determine whether a Ristretto took place.
• Send sign-in links, match updates, and optional profile questions by email, Telegram, or WhatsApp.
• Provide support, diagnose problems, and understand whether the service is working.
• Separate members who no longer want contact, detect repeated conduct reports, apply temporary protection, review cases, enforce the member covenant, and decide appeals.
• Review Ritrovo requests, prepare a network design call, and contact the person who submitted the request.

Who can receive data

Your Ristretto partner. Once you are matched, your partner can see your name, role, company, introduction, topics, picture, and introduction voice note. A designated first-Ristretto host can also see the motivations, languages, and time zone you submitted while joining, so they have the full joining profile for that conversation. If the Ristretto succeeds, your partner may also see the LinkedIn URL you chose to add. A cancellation reason is shown to the other person. Your calendar contents are not shown to them. The private profile answers, feedback, and reflections are not shown to them. A native transcript and native personal memory are also not shown to them. Report descriptions and reporter identities are also not shown to them. A member affected by a safety decision may be told the conduct category, the covenant rule applied, the restriction, and the explanation needed for an appeal.

Authorised Ristretto administrators. Administrators can open the encrypted information deliberately submitted in a safety case and its audit history. Ordinary private memories and unselected conversation material are outside that case view.

Service providers. We use providers to host the application and database, deliver email, connect web calls, check and update Google Calendar, and operate Telegram and WhatsApp messaging. They receive the information needed to perform those jobs. In particular, Google processes calendar requests, LiveKit infrastructure carries live call media, Telegram processes Telegram bot messages, and Meta processes WhatsApp messages. The initial automated moderation policy runs inside Ristretto’s server code and does not send report text to an external AI provider.

Legal and safety needs. We may disclose information if required by applicable law or when reasonably necessary to protect the service, its members, or others.

Call encryption

Call media is encrypted on participants’ devices and remains encrypted while LiveKit Cloud relays it, so LiveKit cannot read the call media. Ristretto’s backend distributes the room encryption key only to authenticated, authorised participants. That makes the backend a trusted key-distribution service; it is not a backend-blind design. Ristretto does not record or store call media or transcripts in the web service.

Cookies and session security

Ristretto’s application sets an essential cookie named coffee_session so you stay signed in. The cookie is not readable by browser scripts, expires after 30 days, and uses the browser’s SameSite=Lax protection. The database stores a hash of the session token rather than the token itself. The current application does not set advertising or analytics cookies.

Storage and deletion

Data is kept while your account is active and as needed to operate the service. Some records have their own expiry, such as one-time sign-in links and login sessions. Ristretto does not currently apply one single automatic deletion period to every other record.

Safety cases, encrypted submitted evidence, blocks, decisions, and appeals may be retained after ordinary account deletion when needed to protect members, prevent repeated abuse, explain a decision, or handle a dispute. The account is otherwise anonymised and the report packet is not used to train models. Contact Ristretto if you want to ask about deletion or restriction of a particular safety record.

Deleting your account removes your web profile details, private answers and reflections, voice and avatar files, calendar connection, availability, booking holds and their personal details, bot identity links, notifications, and active sessions. A native transcript or personal memory is not stored by the web service, so web account deletion cannot erase it from an Apple device or private iCloud database. Before deleting the web account, use the native app’s private-memory deletion control; when encrypted iCloud sync is on, choose its delete-everywhere action and wait for confirmation. A minimal anonymized account shell and past Ristretto records remain so the other participant’s history and aggregate service records still make sense. Those retained records can include the Ristretto time and status, rescheduling or cancellation details, attendance measurements, safety records, and technical webhook processing records, but no longer contain your profile or real email address.

See the data deletion instructions for the exact steps.

If you sent a Ritrovo inquiry without holding a Ristretto account, ask us to remove it through the contact route at the end of this notice, quoting the reference shown when you sent it, and we will delete the inquiry.

Native sign-in identities

If you use Sign in with Apple or Google in the native app, Ristretto stores the provider’s stable account subject only to link that sign-in method to your Ristretto account. Account deletion removes those native Apple/Google sign-in identities, so a later sign-in can create or attach to a new account rather than revive the deleted one.

Your choices

• Use pause in Telegram or WhatsApp to stop future matching and optional profile prompts; use join to resume. Essential updates for an already scheduled Ristretto may still be sent.
• Disconnect Google Calendar from the Calendar page. You can also revoke access in your Google account.
• Remove or replace your picture in Account settings.
• Delete your account in Account settings.
• Use the Safety centre to see a restriction, submit an appeal, and follow reports you made.
• Depending on where you live, you may have additional rights over your personal data. Contact us to ask about access, correction, restriction, objection, or another available privacy right.

Contact

For privacy questions, contact the Ristretto team through the same channel that invited you to the service.

We may update this notice when the service changes. The date at the top tells you when it was last revised.