Privacy Policy

Riptide is operated by Riptide Queue LLC, a New Jersey limited liability company ("Riptide," "we," "us"). This policy applies to sellers who create a Riptide workspace, team members that a seller invites to that workspace, and buyers whose order data a seller routes through Riptide during a live show. When we say "you" we mean the seller or team member; we say "buyer" explicitly when we mean an end buyer of an order from a connected store.

Seller and team-member data

• Account identity: your email address and display name, provided through our identity provider Clerk. Clerk stores sign-in metadata such as the time and IP of sign-in.
• Workspace membership: which Clerk organization(s) you belong to and your role in each (owner, admin, mod, viewer).
• Settings you configure: Discord webhook URLs (stored encrypted), alert-snooze preferences, ETA confidence settings, brand preferences.

Connected-store integration data

• Shop metadata (domain, timezone, currency, status) and the provider-assigned shop identifier, including Shopify or TikTok Shop.
• Encrypted provider access and refresh tokens, stored with a per-environment encryption key.
• The set of webhook topics registered for your store so we can reconcile them with the connected provider.

Order and queue data

• Order records received through authorized APIs and webhooks: order number, source channel (Shopify, TikTok Shop via Shopify, or a native TikTok Shop connection where available), line items (title, variant, SKU, quantity), payment and cancellation status, timestamps, and buyer contact and delivery details needed for packing.
• Queue projection: each order's position in a live session, its status (queued, on deck, live, completed, cancelled), ETA, and the public queue token we generate.
• Queue events: the append-only audit of every queue state change and operator action, with actor identity and payload.
• Webhook receipts: event identifiers, topic, signature validity and processing status, used to prevent duplicate processing. Current native Shopify and TikTok handlers retain minimal receipts rather than raw webhook bodies. Older or sandbox receipts may include payloads; their content follows the retention rule below.

Service operation data

• Server logs (requests, errors, performance metrics) via Fly.io.
• Access records: workspace and actor identifiers, timestamp, API route template or service operation, and case reference for operator reads. These records omit request bodies, raw URLs and returned customer data.
• When you enable mobile notifications: device push tokens, notification preferences, delivery status and notification content. Messages can include buyer aliases, show names and operational exception text.
• Minimal cookies required to keep you signed in through Clerk.

What we do not collect

We do not collect payment instruments or payment card details. Buyer delivery data may include names, contact details and shipping addresses supplied for packing workflows. We do not send those details or raw order notes to product analytics. We do not run third-party advertising trackers or sell data.

We use this data only to:

• Authenticate you and authorize actions in your workspace.
• Ingest authorized connected-store orders and project them into your live-session queue.
• Deliver Discord webhook messages you have configured and retry delivery on failure.
• Serve the public buyer queue pass and the on-stream overlay.
• Alert you to stalled queues, Discord delivery failures, and other operational issues, through the app and optional mobile notifications.
• Provide audit trails and wrap-up summaries so you can trust and debug your own data.
• Operate, secure, and improve the service, including troubleshooting and capacity planning.
• Meet our legal, accounting, and tax obligations.

We share data only with subprocessors we rely on to run the service, and only to the extent they need it for their role. The current list is at /subprocessors. We do not sell data, do not share it with advertisers, and do not train third-party machine-learning models on it.

We may disclose data when legally required (a subpoena, court order, or similar process), to protect Riptide's legal rights, or to prevent imminent harm. We will attempt to give you notice when we can.

If Riptide is acquired, merged, or reorganized, your data will transfer to the successor entity. We will notify you before that happens.

Riptide's application runs on Fly.io (primary region iad, Ashburn, Virginia) and its primary Postgres database runs in the same region. Encrypted database recovery backups are stored in Tigris with provider-managed Global placement; they are not restricted to the United States. Other providers process the categories listed on our subprocessors page; provider processing and support locations can differ from our primary application region.

• Workspace and account data: retained to provide the service and maintain workspace records. Cancellation or removal of a sign-in account does not automatically erase all workspace records. Contact support to request closure, export or deletion; we confirm the scope and completion of the request.
• Orders, queue entries, queue events: retained for the life of the workspace as your business record. You can request deletion of a specific session's data before the workspace is closed.
• Retained webhook content: payloads and headers for completed receipts are cleared after 90 days. Minimal event identifiers and processing status remain to prevent duplicate processing. Unresolved receipts remain available for investigation until resolved.
• Completed delivery jobs: payloads and errors are cleared after 90 days; minimal job and duplicate-prevention identifiers remain. Pending or failed jobs remain available for resolution.
• Minimal access-attempt records: cleared after 180 days. This does not delete business, financial, privacy or incident records. Scheduled cleanup can be delayed by outages; failures require review.
• Deletion safeguards: minimal workspace identifiers and erasure records remain to prevent deleted workspaces from being recreated or resurfacing during recovery. Recovery restores must apply erasure records before returning to service.
• Server logs: stored by our hosting provider for operational troubleshooting. Their retention is managed separately from application records; contact support for questions about a particular request.
• Recovery copies: database backups use a seven-day recovery window and volume snapshots have five-day retention. Erasure from active records does not immediately remove every recovery copy. Copies remain access-restricted until expiry. The recovery window is not a guaranteed maximum age of every retained backup.
• Records we must keep for legal, tax, or accounting reasons may be retained beyond these periods.

Traffic to Riptide is served over TLS. Provider access and refresh tokens and Discord webhook URLs are stored encrypted with a per-environment encryption key. Database credentials and other secrets are held as Fly app secrets, never in source control. Database connections are made over TLS. No system is immune to breach; if we discover a breach that affects your data, we will notify you in accordance with applicable law.

You can manage workspace settings in the app. Contact support for access, correction, export, account closure or deletion requests; not every record has a self-service deletion action. Depending on where you live, you may have additional rights under laws like the California Consumer Privacy Act (CCPA/CPRA) or the General Data Protection Regulation (GDPR), including the right to request a copy of your data, the right to ask us to delete it, and the right to object to certain processing. Email privacy@riptidequeue.com to exercise these rights. We verify your authority and respond within 30 days or any shorter applicable deadline. A downloaded export is not treated as a delivered privacy response until delivery is recorded.

Riptide is intended for sellers operating a business and is not directed to children under 16. If you believe a child has given us personal data, contact us and we will delete it.

Clerk uses cookies to keep you signed in. Optional PostHog product analytics are off until you choose to allow them. Browser analytics use a persistent random identifier in local storage; signed-in activity is associated with a Riptide seller identifier and workspace identifier, without sending names or email addresses. Your browser preference applies to this browser, and Do Not Track or Global Privacy Control keeps browser analytics off.

Workspace owners and administrators can separately allow workflow and overlay-health analytics in Settings. This measures successful automations and seller tasks, such as importing a paid order, completing a turn and verifying a package. Disabling the workspace setting stops collection and discards undelivered events. Your operational records and business reports remain in Riptide.

We collect only explicitly selected event names, normalized page names, workspace context, source labels and bounded task durations or error categories. We do not send customer contact details, addresses, order contents, payment details, tracking numbers, signed overlay links, form text or secrets. Public overlays and buyer queue pages are excluded from browser page tracking. Autocapture, surveys and automatic exception capture are disabled. PostHog is configured for US Cloud; see our subprocessors page. We do not run advertising cookies.

When workspace analytics are enabled, signed overlays may send bounded connection-health samples through Riptide: frame delivery, reconnects, polling fallback, stale frames, layout, and whether chases are visible. These samples do not contain buyer details, order contents, signed links, recordings, or viewer identifiers. Browser privacy signals disable the client reports. Sampling does not measure broadcast audience or exact uptime.

You may separately allow masked session recordings on supported public marketing and top-hits pages. Recordings begin only after an interaction such as a click, keypress or scroll. Page text and inputs are masked; forms, private workspaces, sign-in, checkout, buyer queues and overlays are excluded. Network bodies, console logs, camera, microphone and canvas capture are disabled. Recordings help us understand navigation and usability. You can withdraw this choice below; browser privacy signals also keep recording off. Site visit reports cover consenting browsers and may undercount visits blocked by privacy tools.

We may update this policy as Riptide evolves. Material changes will be posted on this page with a new effective date, and for active paid subscriptions we will email the workspace owner.

Questions about this policy or your data should go to privacy@riptidequeue.com. General support goes to support@riptidequeue.com. The contact page explains which mailbox reads what.