TRACES PRIVACY POLICY

Last Revised: February 4, 2015

Welcome to Traces — the app that allows you to experience content in location from Ripple, Inc. (“Ripple,” “we,” “us” or “our”).

These Terms of Service (“Terms”) apply to your access and use of the mobile application (the “App”), website (“Site”), and other online products and
services (collectively, the “Service”) of Ripple.

Accepting these Terms

BY DOWNLOADING THE APP OR OTHERWISE ACCESSING OR USING THE SERVICE, YOU AGREE TO BE BOUND BY ALL OF THE TERMS BELOW. Please read all of the terms before
you use the Service. If a term does not make sense to you, please let us know. If you don’t agree to all of the terms below, you may not use the Service.

Modifications

We reserve the right to change these Terms from time to time. For example, we may need to change these Terms if we come out with a new feature. If we make changes, we will notify you by revising the date at the top of the policy and, in some cases, we will provide you with additional notice (such as adding a statement to our homepage or sending you an email notification). We encourage you to review these Terms periodically to stay informed about our practices.

Whenever we make changes to these Terms, they are effective when the revised Terms are posted unless we notify you otherwise. If you continue to use the Service after the revised Terms have been posted, then you will be deemed to have accepted the changes to these Terms.

Description of the Service

Through the App, you can leave a digital message (together with images, videos) (a “Trace”) at a physical location for other specified users to pick up with their smartphones when they are at those physical locations before a certain point in time. To deliver a Trace, you must select the intended recipient from your contact list and then specify where you want the Trace to be visible. Accessing the specially placed Trace requires the recipient of the Trace to go to a specified GPS location at the right time and raise his or her smartphone in search of a floating droplet. Once the recipient’s smartphone aligns with the droplet, the droplet bursts and the content of the Trace is received.

You are responsible for your use of the App. Ripple is not responsible for anything you may encounter while using the App (including, but not limited to, physical hazards, traffic, and other people). Accordingly, you must exercise due care when using the App — always be fully aware of your surroundings at all times while trying to obtain the contents of a Trace.

Privacy Policy

This privacy policy explains how we collect, use and disclose information about you when you use our mobile application (the “App”), our website (the “Site”) and other online products and services that link to this privacy policy (collectively, the “Service”) or when you otherwise interact with us. By using the Service, you consent to our collection, use and disclosure of your personal information as described in this privacy policy.

Modifications

We may change this privacy policy from time to time. If we make changes, we will notify you by revising the date at the top of the policy and, in some cases, we will provide you with additional notice (such as adding a statement to our homepage or sending you an email notification). We encourage you to review the privacy policy periodically to stay informed about our practices and the ways you can help protect your privacy.

Collection of Information

Information You Provide to Us

We collect information you directly give us. For example, we collect information about you when you sign up for our Service, send a Trace, give feedback about the Service or otherwise communicate with us. The types of information we may collect include your email address, your mobile phone number and any other information you choose to provide. When you request that the App find your Friends, we also collect certain information from your contacts on your mobile device, such as your contacts names and phone numbers, so you can send private Traces to people you know who are already using the App. Contacts and phone numbers in our data base are hashed so we do not have access to identifiable information. When sending a user verification code and sending the first Trace to a contact, we do not hash the phone number in order to deliver an SMS notification but we delete it directly after the action. For information as to how to restrict the use of contact information, please see the “Your Choices” section below. We may also collect information about you from other users of the Service (for example, we may collect and hash your contact details from another user if such details are stored on the user’s mobile device). If you choose not to provide certain information, we may not be able to provide the Service to you or certain features of the Service may be unavailable or work
differently.

Information We Collect Automatically When You Use the Service

When you access or use our Service, we automatically collect certain information about you. This information includes:

Log Information: We log information about your use of the Service, including the type of device you use, access times, location information, Traces and mobile web pages viewed within the App. We anonymise this information by hashing it and use the data purely for analytic and product improvement purposes.

Device Information: We collect anonymised information about the mobile device you use to access our Service. Our third party service may collect data including the hardware model, operating system and version, unique device identifiers and mobile network information. We use this anonymised information from third party services for analytic and product improvement purposes.

Location Information: We collect information about the location of your device each time you access or use the Service. For more details, please see “Your Choices” below.

Use of Information

We do not use any cookies or tracking technologies, apart from GPS tracking which we use only in order to deliver content to you in location . We may use information about you for various purposes, including to:

Provide, deliver, maintain, test and improve our Service;

Send you technical notices, updates, confirmations, security alerts and support and administrative messages;

Respond to your comments, questions and requests and provide customer service;

Communicate with you about products, services, offers, promotions, rewards and events offered by Ripple and others, and provide news and information we think will be of interest to you;

Monitor and analyze trends, usage and activities in connection with our Service and improve and personalize the Service;

Detect, investigate and prevent any suspected breaches of our Terms of Service; and Link or combine with information we get from others to help understand your needs and provide you with better service; and Connect you with other users in your contacts.

Storage of Information

We take reasonable measures to protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction, but we cannot guarantee that our system is infallible.

Ripple is based in the United States, and the information we collect is governed by U.S. law. By accessing or using the Service or otherwise providing information to us, you consent to the processing and transfer of information in and to the U.S. and other countries.

Sharing of Information

We may share anonymised data about our users as follows or as otherwise described in this Privacy Policy:

With vendors, consultants and other service providers who need access to such information to carry out work on our behalf;

In response to a request for information if we believe disclosure is in accordance with any applicable law, regulation or legal process, or as otherwise required by any applicable law, rule or regulation;

If we believe your actions are inconsistent with the spirit or language of our user agreements or policies, or to protect the rights, property and safety of Ripple or others;

In connection with, or during negotiations of, any merger, sale of Ripple’s assets, financing or acquisition of all or a portion of our business to another company; and With your consent or at your direction, including if we notify you through the Service that the information you provide will be shared in a particular manner and you provide such information.

We may also share aggregated or anonymized information that does not directly identify you.

Note that if you choose to include information about you in your Traces, such information will be shared with other users of the Service who receive your Traces as described in this privacy policy. Also, please note that if you or other users choose to share information about a Trace through a third party, such as Facebook, Twitter or an email client, any further collection and sharing of that information by such third party or its users will be governed by that third party’s privacy policy, and we cannot control what any third party does with any information that is shared with third parties.

International Users

Ripple is based in the United States and the information we collect is governed by U.S. law. By accessing or using the Service or otherwise providing information to us, you consent to the processing and transfer of information in and to the U.S. and other countries. Information shared in accordance with this privacy policy may be disclosed to overseas recipients located in the United States, Canada, the European Union, Australia and New Zealand and other countries. This may include disclosures to overseas recipients outside of the European Economic Area, including countries that do not have laws that protect personal information in the same manner as countries within the European Economic Area.

Ripple participates in the U.S.-EU Safe Harbor and U.S.-Swiss Safe Harbor programs, and it adheres to the U.S.-EU Safe Harbor and U.S.-Swiss Safe Harbor Privacy Principles regarding the collection, use, and retention of personal information from European Union member countries and Switzerland. Ripple has certified that it adheres to the Safe Harbor Privacy Principles of notice, choice, onward transfer, security, data integrity, access, and enforcement. For more information about the Safe Harbor program, visit the Department of Commerce’s Safe Harbor page. If you have concerns about our compliance with the Safe Harbor program, you should contact us at legal@traces.io. If you are unable to resolve your concern or dispute with us, you may submit complaints to JAMS for mediation pursuant to the JAMS International Mediation Rules.

Analytics Services

We may allow third parties to provide analytics services to us. These entities may collect information about your use of the Service, device information, location information, Traces, time spent on Traces, and conversion information. This information may be used by us and others to, among other things, analyze and track data, determine the popularity of certain content and better understand our users activity.

Security

Ripple takes reasonable measures to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction.

Your Choices

Account Information

If you wish to delete your account, follow the instructions on the App Store or device. Note that we may retain certain information as required by law or for legitimate business purposes as may be necessary to fulfill the purposes identified in the privacy policy. We may also retain cached or archived copies of anonymised information about you for a certain period of time.

Cookies

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your web browser to remove or reject browser cookies.
Removing or rejecting browser cookies does not necessarily affect third party flash cookies used in connection with our website.

Push Notifications and Alerts

With your consent, we may send push notifications or alerts to your mobile device. You can deactivate these messages at any time by changing the notification settings on your mobile device.

Contact Information

You can restrict Ripple’s collection of contacts by declining the permissions request when registering for the App or by changing your phone’s privacy settings. On iPhone, go to Settings > Privacy > Contacts and switch the App to “Off.”

Promotional Communications

If you have given your email address via our website, you may receive promotional communications from Traces. To opt out, follow the instructions in those communications. If you opt out, we may still send you non-promotional communications, such as those about your account or our ongoing business relations.

Geolocation Information

When you first launch the App, you will be asked to consent to our use of location information. We require this location information in order for the Service to function as designed.

If you consent to our collection of location information, you may subsequently stop the collection of this location information at any time by pausing location tracking from within the application’s settings menu, or by changing the location preferences on your mobile device. However, if you stop the collection of this location information, you will not receive the benefit of the Service.

If you consent to our collection of location information and you do not subsequently stop the collection of this location information, the Service will continue to collect this location information.

If you consent to our collection of location information, subsequently stop the collection of this location information and later consent to the collection of this location information, the Service will resume the collection of location information.

You may also stop our collection of location information by following the standard uninstall process to remove the App from your device.

Your California Privacy Rights

California law permits residents of California to request certain details about how their information is shared with third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please contact us at support@traces.io. However, please note that under the law, services such as the Service that permit California residents to opt into or opt out of this type of sharing are not required to provide such information upon receiving a request, but rather may respond by notifying the user of his or her right to prevent the disclosure. To opt out of having information about you shared with third parties for direct marketing purposes, please email us at support@traces.io.

Contact Us

If you have any questions or concerns about this privacy policy or any privacy issues, please email our Privacy Manager at legal@traces.io. Our Privacy Manager is responsible for coordinating the investigation of any concerns or complaints made to Ripple about privacy issues and resolving the matter with a complainant. If you email our Privacy Manager at the email specified above, we will respond to concerns and complaints within a reasonable time after receipt.