Privacy Policy

Who we are

Rutivio is operated by Rutivio App ("we", "us", "our"). Rutivio App is the data controllerresponsible for the personal data described in this policy. You can contact us at privacy@rutivio.app.

What this policy covers

This Privacy Policy explains how Rutivio App handles your personal information when you use the app, including routine names, completion history, goals, and account data if you choose to sign in.

Data we collect

• Routine data: routine names, emoji, schedule, goals, start dates, and completion history.
• Account data: if you sign in, we store your email address and a user identifier provided by the authentication service.
• Usage data: anonymous analytics about feature usage and app performance, only with your consent.
• Preference data: color palette choices, consent choices, and weekly digest reminder settings stored locally on your device.

How we use your data & legal basis

We use your data to provide the core habit-tracking experience, calculate streaks and stats, sync across devices when signed in, and improve the app. We do not sell your personal information. Where GDPR or similar laws apply, our legal bases are:

• Performance of a contract — to provide the app and, for Premium subscribers, to deliver the subscription.
• Consent — for optional analytics and personalized advertising, revocable at any time via the consent banner.
• Legitimate interests — to secure the service, prevent abuse, and improve the product.
• Legal obligation — to comply with tax, accounting, and other applicable law (primarily via our payment processor).

Cookies and tracking

Rutivio uses a cookie/ads consent banner to let you choose which categories of tracking you allow. Necessary cookies and local storage are always on for the app to function. Analytics and personalized ads are opt-in. We respect the Global Privacy Control (GPC) signal: if your browser sends it, ads stay disabled by default.

Data storage and security

Routine data is stored locally in your browser by default. If you sign in, it is synced to a secure backend database with Row-Level Security, meaning each user can only access their own data. We use encryption in transit and at rest via the backend platform. No system is perfectly secure, so we recommend using a strong password and keeping your device secure.

Subprocessors and integrations

We share personal data with the following categories of recipients, each of which only receives the minimum data needed to perform its function:

• Paddle.com Market Limited — our reseller and Merchant of Record for all paid subscriptions. Paddle receives your name, email, billing address, and payment details to process payments, handle taxes, issue invoices, manage subscriptions, and process refunds and chargebacks.
• Backend platform — hosting, authentication, database, and storage for account and routine data.
• AI provider — powers optional coaching and routine generation features when you use them.
• Advertising partners — only when you have consented to personalized ads.
• Professional advisers and authorities — where required by law.

Retention and deletion

We keep your data for as long as you use the app. You can delete individual routines, clear local data from your browser, or delete your account by contacting us. When you delete data, it is removed from active storage and permanently purged from backups according to the backend provider's retention schedule.

Your privacy rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data. You can manage most of this directly in the app; for anything else, contact us using the email below.

Contact and incidents

If you have questions about this policy, want to report a security issue, or need to make a privacy request, please email us.