Privacy policy

This policy explains how Boostup International Pty Ltd, trading as ruind (“ruind”, “we”, “us”) handles your personal information when you use ruind. We collect as little as we can to run the service. We don’t sell your information, we don’t show ads in ruind, and there are no advertising trackers or pixels in the app. We do advertise ruind on other sites, and we tell an ad platform when a sign-up or purchase came from one of its ads (see “Advertising” below).

What we collect

• Your email address, when you add one. It’s how you sign in (we send you a link; there’s no password) and how we contact you about your account.
• Your stories. The actions and lines you choose or type, the responses written for you, and the story details that go with them (such as names you choose and story progress). These are stored so you can come back to them.
• Account and usage records: when you signed up, when you confirmed you’re 18 or over, how many turns you’ve used, and your purchases and subscription status.
• Device and connection information: your IP address and browser type, recorded with your sign-in sessions, and a protected device identifier (see below).
• How you use ruind: which pages you visit, which buttons you tap, where you came from, and your rough location and device type (see “Product analytics” below).
• The ad you came from, if you arrived by tapping one of our ads (see “Advertising” below).
• Payment information is collected by Stripe, not by us. We receive your Stripe customer reference, what you bought and whether payment succeeded, but never your full card number.

Device checks

To stop the free allowance being claimed again and again, your browser computes a device identifier when you first start. We only store a keyed, one-way hash of it, together with a signed cookie, and use it only to limit repeat sign-ups. It never signs you in. We keep this hash after you delete your account, so deleting and re-creating an account doesn’t renew free turns. Before you add an email, your browser also solves a short automated check when you send a message. It runs entirely on our own servers and your device.

Product analytics

To learn which stories people enjoy and where ruind is confusing, we record how the app is used with PostHog: page visits, taps, the page you came from, and your approximate location and device type, worked out from your IP address. We never record your stories, the actions you choose, or anything you type, and we don’t record your screen. PostHog stores nothing on your device.

We also use Google Analytics to count visits and see where visitors come from. It records the pages you visit, the site or ad that sent you, and your approximate location, browser and device, and it sets cookies to recognise your browser on later visits (see “Cookies” below). We don’t send it your email, your stories, or anything you type. Google keeps this data for the period we set in our account, at most 14 months.

Advertising

We advertise ruind on social networks and other sites, such as Reddit. When you tap one of our ads, the platform that showed it usually adds a click identifier to the link, and we save it with your account along with the campaign tags in the link. If you then add your email to sign up, buy turns or subscribe, our server tells that platform it happened, so we can see which ads work. That report includes the click identifier, what you paid (for a purchase), an order or sign-up reference, your IP address and browser type, and a one-way hash of your email address and account ID. It never includes your stories, anything you type, or your card details, and we don’t tell advertising platforms anything about how you use the app.

We only report sign-ups and purchases to the platform whose ad you came from, and only if you came from one of our ads. This happens between our server and that platform: nothing is added to the app, and nothing is stored on your device. Each platform uses this information under its own privacy policy. To opt out, email us and we’ll stop reporting your sign-up and purchases.

Cookies

ruind needs two cookies to work: a session cookie that keeps you signed in, and the device cookie above. Google Analytics also sets its own cookies (named _ga and _ga_…) to count returning visitors; they last up to two years. We don’t use advertising cookies. You can block or delete Google Analytics cookies in your browser settings, or use Google’s opt-out browser add-on, and ruind will keep working.

Why we use your information

• To provide ruind: generating your story, saving it, and signing you in.
• To take payments and keep track of your turns and subscription.
• To keep ruind safe and fair: preventing abuse, repeat free sign-ups and fraud, and enforcing our terms.
• To send you emails about your account, such as sign-in links and receipts.
• To measure which of our ads bring people to ruind.
• To meet legal obligations, such as tax and accounting records.

If you are in the UK, our legal bases are: performing our contract with you (running ruind and taking payment); our legitimate interests in keeping ruind secure, preventing abuse and measuring our advertising; legal obligations; and, for your stories, your explicit consent, which you give by choosing to write them with us. You can withdraw that consent at any time by deleting the story or your account.

Who helps us run ruind

We share information only with the service providers we need, and only for these purposes:

• AI model providers. To write each response, the story so far and your latest action are sent to an AI model provider, currently through OpenRouter, which routes the request to a model host. Your email and payment details are not sent.
• Stripe, which processes payments.
• PostHog, which stores our product analytics in the United States (see above).
• Google Analytics, which measures visits to ruind (see “Product analytics” above).
• Advertising platforms where we run ads, such as Reddit, which receive a report when someone who came from one of their ads signs up or makes a purchase (see “Advertising” above).
• Amazon Web Services, which sends our emails.
• Our hosting provider, which runs our servers and database.
• Google Fonts, which serves the fonts ruind uses. Your browser requests them from Google, which sees your IP address.

We may also share information when the law requires it, to protect people from harm, or as part of a sale or restructure of our business, in which case this policy continues to apply to it.

Where your information goes

We are based in Australia. Our providers process information in other countries, including the United States. When we send information overseas, we take reasonable steps to make sure it is protected to the standard required by Australian law and, for readers in the UK, by UK data protection law, including contractual safeguards where they’re required.

How long we keep it

• Your account, stories and usage records, including the ad you came from, are kept until you delete them or your account.
• If you never add an email, your temporary account and its stories are deleted automatically after 30 days without use.
• When you delete your account, your stories and account details are deleted from our database straight away. Copies may remain in backups for a limited time until they are overwritten.
• We keep purchase records as long as tax and accounting law requires, and the device hash as described above. If you ask us to delete your information, we delete your product analytics too.

Your choices and rights

You can delete any story, or your whole account, from the app. You can also ask us to give you a copy of your information, correct it, or delete it. If you are in the UK, you also have the right to object to or restrict how we use your information and to receive it in a portable format.

To make a request, email [email protected] from the address on your account. We’ll reply within 30 days.

If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the UK, the Information Commissioner’s Office (ico.org.uk).

Security

Connections to ruind are encrypted, sign-in uses one-time links rather than passwords, and access to our systems is restricted. No service is perfectly secure, but we’ll tell you and the regulator if a breach is likely to cause you serious harm.

Adults only

ruind is for people aged 18 and over. We don’t knowingly collect information from anyone younger, and we delete accounts we learn belong to someone under 18.

Changes and contact

We’ll update this policy when our practices change; the date at the top shows the latest version. If a change is significant, we’ll tell you by email or in the app. Questions about privacy go to [email protected]. See also our terms of service.