RIDEN privacy notice

1. Scope and current status

RIDEN is a product operated by GZS Incorporated. This notice applies to RIDEN’s planned private staging environment and its Google sign-in process. The staging environment is intended only for specifically approved testers while the product and its controls are evaluated.

The Google Auth Platform identity is configured with an External testing audience. No OAuth client, test users, or working sign-in button are active as of the effective date above.

2. Information collected when testing begins

When an approved tester chooses Google sign-in, Google Identity Services will return an ID token to the tester’s browser. RIDEN will send that token to its own server for verification. After successful verification, RIDEN will use:

• Google’s stable account identifier, called the sub claim, to bind the same Google identity to the same RIDEN account.
• The Google account email address and its verified status to apply the private staging admission rules and identify the tester’s RIDEN account.
• RIDEN account, project membership, and session records needed to provide an isolated private workspace.

RIDEN’s current server implementation does not store the raw Google ID token in its application database. It stores the verified Google subject identifier and email address needed for account binding and admission. The Google sign-in flow does not request a Google API access token.

3. How information is used

RIDEN uses the information above to authenticate approved testers, enforce the staging allowlist, create or locate the tester’s isolated RIDEN account, maintain the tester’s session, prevent incorrect account linking, investigate access problems, and protect the staging environment.

RIDEN does not use Google account information for advertising, credit decisions, or the sale of personal information. A matching email address alone is not used to merge a Google identity with another RIDEN account.

4. Sessions and security

After a successful sign-in, RIDEN creates a random session token. The browser receives the token in a cookie marked HttpOnly and SameSite=Strict; the staging HTTPS deployment will also mark it Secure. RIDEN stores only a SHA-256 digest of the session token in its database.

RIDEN’s server checks the Google token signature, issuer, intended audience, and expiration. It also requires a stable Google subject identifier, a verified email address, and a match to the private staging allowlist. These controls still require live acceptance testing at the final staging origin before the sign-in flow is approved for use.

5. Sharing and Google access

Google processes the sign-in interaction under Google’s own terms and privacy practices. RIDEN’s hosting, database, and security infrastructure providers may process limited information as needed to operate and protect the staging service. RIDEN does not authorize those providers to use Google account information for their own advertising.

RIDEN does not access a tester’s Gmail messages, Google Drive files, contacts, calendars, or model-provider accounts. The sign-in process authenticates the tester to RIDEN only.

6. Retention and deletion

RIDEN sessions expire after no more than seven days and are revoked on logout. Removing a tester from the admission allowlist prevents new Google token exchanges after the server configuration reloads; an operator must also revoke any existing session to end access immediately.

The Google subject identifier, verified email, RIDEN account, and private staging records remain until an authorized operator removes them or they are no longer needed for the controlled test, subject to legitimate security, legal, and record-integrity needs. RIDEN does not yet provide a self-service deletion screen. A tester may request access to or deletion of their staging account by emailing intelligence@riden.tech. The operator will verify the request before acting on account data.

7. Your choices

Participation in private staging is optional. A tester may decline Google sign-in, sign out to revoke the current RIDEN session, request removal from the tester allowlist, or request deletion of their staging account. RIDEN will keep password registration and password login disabled in the Google-only private staging environment.

8. Changes and contact

RIDEN will revise this notice before live testing if the deployed data flow, infrastructure providers, retention practice, or user controls differ from the description above. Material changes will be reflected by a new effective date on this page.

Questions, privacy requests, and support requests may be sent to intelligence@riden.tech. Developer and security coordination may be sent to reflection@riden.tech.