What Ruxpin records

Ruxpin keeps a record of what you do in the app, so we can see where it is letting readers down. It never records what you write or read. This guide lists exactly what is kept, and when it goes.

What it records

That a recording started, that the microphone was off, that an entry landed, that Rux was asked something, that a capture failed while offline, that a spoken note reached transcription and whether words came back, that Rux looked something up and whether it found anything, that a record card was shared and which kind, that a Rux Note was made, shared or deleted, which door opened the Make menu and what was chosen from it. Alongside each action it keeps a few plain facts about it: whether an entry got filed to a source and whether you spoke, wrote or uploaded it, how many attempts a capture took, how many captures were still waiting on your phone after a send, which app version you're on, and whether the app is the one from the App Store or a build we are working on, so our own testing does not count as readers.

When one of our own notes appears on your Home screen, it records that you were shown it, once however many mornings it greets you, and whether you opened or dismissed it. What identifies the note is its own name from the changelog, never anything of yours.

It also records which screens you open and which controls you tap. Two rules keep that from becoming a record of your reading:

• Screens are recorded as shapes, not places. Opening an entry records /entry/[id], the kind of screen, never which entry. The server refuses anything that still has an id in it, so the app can't send the specific one by accident.
• Controls are recorded by fixed name. A tap saves something like library.star, a name written into the source code, never the label on your screen.

What it never records

Not a word of any entry, not a source or book title, not what you typed into search, not the question you asked Rux, not the words Rux searched your record for. The events that may be recorded, and the exact fields each one is allowed to carry, are a fixed list in the app's source; anything outside it is thrown away before storage, so a screen can't start leaking your words by accident.

When something breaks, a diagnostic report goes to the service we use to watch for it: the shape of the failure, where in the code it happened, and your account id, never your words. The one kind of error that can quote an entry back has its text withheld before it's sent.

How long it is kept

These events are tied to your account, and deleting it takes them with everything else, on the same 30-day clock. They also expire on their own: each event is deleted 90 days after it reaches us, whether or not you delete your account. What outlives them is a daily tally, counting how many recordings started across everyone that day and how many entries landed, with no account attached to it and no way back to a person.

The website and its forms

The website records the same two things: pages opened, buttons clicked. If you're browsing signed out, nothing identifies you: those are grouped only by a marker in your browser tab's memory, never written to your device and gone when you close the tab. If you're signed in, they're attributed to your account the same way the app's are, and deleting your account takes them too.

Forms are different. Give us your email on the website, for the waitlist or the app link, and we keep it along with which site referred you and any campaign tags in the link.

Your entries, sources, and the rest of your record are a separate matter, covered in Your data & deleting.