Your data & deleting

4 min read

Short version: your words are yours, audio is never kept, and deleting means deleting.

What Ruxpin keeps

Your entries (both your verbatim words and the cleaned version), your sources, and the analysis built from them. That's the record. It's what the Library, Rux, and the Reader portrait are made of. That work uses one AI provider, Google's Gemini API, only after your OK: AI processing and your OK says what is sent and what never is.

Rux also keeps one short note about you as a reader, your reader file, rewritten weekly from your own themes and your conversations. Read it, and the themes behind it, at Profile → Reader file; deleting your account removes both, or ask us to clear them on their own.

What Ruxpin doesn't keep

Your audio. A recording exists only long enough to be transcribed. The file is deleted right after every transcription attempt, success or failure. What persists is the text.

Usage events

Ruxpin records what you do in the app: that a recording started, that an entry landed, that Rux was asked something, that a capture failed while offline, that a spoken note reached transcription and whether words came back, that Rux looked something up and whether it found anything, that a record card was shared and which kind. All of it so we can see where the app is letting readers down. Alongside each action it keeps a few plain facts about it: whether an entry got filed to a source, how many attempts a capture took, which app version you're on.

When one of our own notes appears on your Home screen, it records that you were shown it, once however many mornings it greets you, and whether you opened or dismissed it. What identifies the note is its own name from the changelog, never anything of yours.

It also records which screens you open and which controls you tap. Two rules keep that from becoming a record of your reading:

Screens are recorded as shapes, not places. Opening a thought records /entry/[id], the kind of screen, never which entry. The server refuses anything that still has an id in it, so the app can't send the specific one by accident.
Controls are recorded by fixed name. A tap saves something like library.star, a name written into the source code, never the label on your screen.

It never records what you wrote or read. Not a word of any thought, not a source or book title, not what you typed into search, not the question you asked Rux, not the words Rux searched your record for. The events that may be recorded, and the exact fields each one is allowed to carry, are a fixed list in the app's source; anything outside it is thrown away before storage, so a screen can't start leaking your words by accident.

When something breaks, a diagnostic report goes to the service we use to watch for it: the shape of the failure, where in the code it happened, and your account id, never your words. The one kind of error that can quote a thought back has its text withheld before it's sent.

These events are tied to your account, and deleting it takes them with everything else, on the same 30-day clock. They also expire on their own: each event is deleted 90 days after it reaches us, whether or not you delete your account. What outlives them is a daily tally, counting how many recordings started across everyone that day and how many entries landed, with no account attached to it and no way back to a person.

The website records the same two things: pages opened, buttons clicked. If you're browsing signed out, nothing identifies you: those are grouped only by a marker in your browser tab's memory, never written to your device and gone when you close the tab. If you're signed in, they're attributed to your account the same way the app's are, and deleting your account takes them too.

Deleting an entry or a source

Open an entry → Edit → Delete this entry. Open a source and scroll to the foot of the page → Delete this source, which takes its entries with it. Deleted items leave your record immediately and are purged from our systems within 30 days.

Deleting your account

Profile → Delete account erases the whole record: entries, sources, portrait, everything. The app confirms before it acts. Your data disappears from the app immediately and is permanently purged within 30 days; the same email can't quietly resurrect the old record.