Privacy Policy

Ruta is a place to think through what is calling you, with an AI that listens and asks. This policy explains what we collect when you use Ruta — at app.ruta.so and in our apps — why we use it, who helps us, how long we keep it, and what you can do about it.

Ruta is provided by Andrey Gavrilenko, based in Portugal, who is the controller of your personal data. You can reach us about anything in this policy at privacy@ruta.so.

What we collect

• Your sign-in. Your email address, your name and profile picture if your sign-in provider shares them, and how you sign in: email and password, Google, or Apple. Passwords are handled by Firebase Authentication and never reach us.
• What you write. The questions you bring, your journeys and asks with Ruta, and the titles you give them.
• What Ruta writes for you. Ruta's replies, reports and readings, and the picture of you it builds from your journeys.
• Texts and people you add. Any text you upload, the readings Ruta builds of the people in it, and the names, tags and portraits you give them.
• What you share. The links, connections and rooms you create, and who you share them with.
• Recordings, if you dictate. Your recording is sent for transcription and is not kept. Only the text you then choose to send becomes part of your journey.
• Purchases. If you subscribe, your plan, its status and a reference to the payment from Apple or Stripe. We never see your card details.
• Technical information. Your language setting, which app and version you use, and logs of requests to our servers, used to keep Ruta working and secure.
• Counts of use. How many times things happen in the app — a page opened, a feature used — added up per day across everybody. They are sent without your sign-in or anything else that says who, so they are not linked to you.
• Crash reports, from the iPhone and iPad app. When the app crashes or stops responding, a report of what failed — the device model, the system version and the part of the app's code involved, never what you wrote — goes to Firebase Crashlytics. It is not linked to your account.

Why we use it

• To provide Ruta to you — your account, your journeys, readings, sharing and subscription. This is necessary for our agreement with you (Article 6(1)(b) GDPR).
• With your explicit consent, for what is sensitive. What you write can reveal your health, beliefs, relationships or sexuality. We process it only with your explicit consent (Article 9(2)(a) GDPR), which you give before you begin. You can withdraw it at any time by deleting your journeys or your account.
• To keep Ruta secure and working — preventing abuse, fixing faults and keeping backups. This is our legitimate interest (Article 6(1)(f) GDPR).
• To meet legal obligations, such as keeping records of payments (Article 6(1)(c) GDPR).

We don't sell your data, we don't show you advertising, and we don't track you across other apps or websites.

Ruta is an AI

Ruta's replies, readings and reports are written by an AI model, Google Gemini, which we use through Google Cloud's Vertex AI. What you write, upload or dictate is sent to Google to produce them. Google processes it on our behalf, and under Google Cloud's terms it may not use your content to train its models. We don't use your content to train AI models either.

Readings of you and of other people are interpretations an AI makes from what was written. They can be wrong, and they are not facts about anyone.

Who helps us

• Google Cloud (Google LLC and Google Ireland Limited): hosting, storage, backups and logs; the Gemini model through Vertex AI; and Speech-to-Text for dictation.
• Firebase Authentication (Google): signing in, and the emails that verify an address or reset a password.
• Firebase Crashlytics (Google): crash reports from the iPhone and iPad app.
• Apple: Sign in with Apple, and purchases made in our iPhone and iPad app.
• Stripe: payments made on the web.
• Google Analytics (Google): on our website ruta.so, and only if you accept it, counts of how visitors find and use the site.

Each of them uses your data only to provide their service to us, under data protection terms. We share it with nobody else unless the law requires it. People you share with see only what you choose to share with them.

Where your data is kept

Our servers are in the United States, on Google Cloud, which encrypts data at rest. When your data leaves the European Economic Area or the United Kingdom, it is protected by the European Commission's Standard Contractual Clauses and by our providers' certification under the EU–U.S. Data Privacy Framework.

How long we keep it

• Your account and journeys: until you delete them.
• Texts you upload, and the people read from them: until you delete them.
• Your whole account, once you ask us to delete it: 30 more days, in which you can change your mind. Then everything is erased.
• Backups: 30 days. If we ever restore one, we erase again anything you had deleted since it was made.
• Server logs: 30 days.
• Website analytics on ruta.so, if you accepted them: 2 months.
• A copy of your data: made when you ask for it, and not kept afterwards.
• Crash reports: 90 days.
• Payment records: as long as the law requires.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form, and you can withdraw your consent at any time. Where the app lets you delete something yourself, you can do it there; for anything else, write to privacy@ruta.so. We answer within one month.

You can also complain to a data protection authority: in Portugal, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or the authority where you live.

Cookies and your browser

The website stores only what it needs to work: cookies that keep you signed in and protect signing in, one that remembers your language, the sign-in that Firebase keeps in your browser, and the counts of use above until they are sent. It uses no analytics or advertising cookies, and nothing that follows you across other sites.

Our website, ruta.so, asks first. If you accept, Google Analytics sets cookies to count visits and to learn which pages help people find Ruta; if you decline, it sets none. You can change your answer at any time with Cookie settings at the foot of every page. What you type into the question box on ruta.so is never sent to Google: it goes only to the web app, when you begin.

Age

Ruta is for people aged 16 and over. If you believe someone younger has given us their data, write to privacy@ruta.so and we will delete it.

Security

Everything travels encrypted, access to our systems is limited to what running Ruta needs, and backups are kept in a store that our own servers can add to but cannot read or delete.

Changes

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect. The date at the top says when it last changed.

Contact

Andrey Gavrilenko — privacy@ruta.so