rumi.Back to Rumi

Updated 10 October 2026

Privacy policy

Rumi helps you make sense of your daily health and routines. This policy explains what information we handle when you use the Rumi app, including early access versions, this website, the waitlist and partner applications.

Rumi is responsible for the information described here. For privacy questions or requests, contact hello@rumihq.com. Our terms of service explain the conditions for using Rumi.

Information you give us

Account information. We use your name, email address, account identifiers and sign-in information to create and secure your account. Clerk provides authentication. If you sign in with Google or Apple, we receive the identity information that provider shares with your permission. This may include a profile picture or an Apple private relay email address. Rumi does not receive your Google or Apple password.

Conversations and personal context. We process messages, photos and files you send, voice transcripts, feedback, and the goals, preferences and health observations you choose to share. This can include meals, exercise, sleep, symptoms, body measurements and other sensitive health information. We store conversation history, recorded activities and useful summaries or memories so Rumi can provide continuity across conversations.

Device and service information. We process information needed to operate the service, such as your time zone, app and device details, notification tokens, connection status, request timings and error or security records. Your device may also keep a local copy of your conversation history and account session.

Apple Health and wearable connections

Connecting a health or wearable service is optional. With your permission, Rumi imports the data you authorize from Apple Health or a supported wearable account. Depending on the source, this can include steps, sleep, workouts, active energy, heart rate, resting heart rate, heart rate variability, blood oxygen, weight and recovery measurements.

Apple Health information is uploaded through our Open Wearables integration to support syncing and personalized responses. It is not limited to on-device processing. Syncing may continue in the background while the connection and device permissions remain enabled. We use health data to provide the features you choose, not for advertising or sale.

You can change Apple Health permissions in the Health app or your device settings, and disconnect supported services in Rumi or through the provider. Stopping a connection prevents future access through that connection; it does not automatically erase information already imported. Contact us to request deletion.

Google sign-in and Google Calendar

Signing in with Google gives Rumi basic identity information, such as your Google account identifier, name, email address and profile picture. We use it to authenticate you and link you to your Rumi account. Signing in alone does not grant access to your Google Calendar, Gmail or Drive.

Connecting Google Calendar is a separate, optional permission. Depending on the access you approve, Rumi can read your calendar list, availability and event details, and create, change or delete events to carry out your scheduling requests. Event information may include titles, times, descriptions, locations and participants. We store connection identifiers and encrypted access credentials to maintain the connection. Calendar information relevant to a request may be processed by our AI providers and retained in conversation history, summaries or action records.

We use Google data to provide the account and calendar features you request. Rumi’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Human access to Google data is limited to your specific consent, necessary security or legal purposes, or permitted aggregated internal operations.

You can disconnect Calendar in Rumi or revoke access in your Google Account connections. Disconnecting does not delete events already created in Google Calendar or information already included in your Rumi history. You can manage those events in Google Calendar and contact us about deleting Rumi’s retained information.

How we use information

We use information to authenticate you, sync the services you connect, answer questions, record activities, remember relevant context, create the files or analyses you request, and carry out authorized actions. When enabled, reminders and proactive check-ins use your saved context and permitted sources. We also use information to provide support, fix failures, prevent abuse and maintain the service.

Microphone, photo, health and notification access depend on the features you use and the permissions you grant. You can change device permissions in iOS settings. Notification content may appear on your lock screen depending on your device settings.

AI processing and service providers

Rumi uses external AI services to produce responses and analyze information. Relevant messages, images, files, remembered context and connected health or calendar information may be sent to those services for a request. Audio you submit for transcription is sent to a speech-to-text provider; the resulting text can become part of your conversation. These features are not processed solely on your device.

Providers supporting Rumi include:

We share information with these services for the functions they provide. Processing can occur outside your country. Providers may retain operational or security records under their service terms; this policy does not promise that every provider immediately deletes every request. We may also disclose information when legally required or necessary to investigate abuse or protect people and the service, subject to applicable restrictions on health and Google data.

Website, waitlist and partner applications

When you join the waitlist, we record your email, signup time, form source, campaign tags if present, and the consent wording version. Partner applications include the business and contact details you choose to submit. Please do not include medical records, customer records, payment details or passwords in these forms.

We use these records to acknowledge your interest, send beta invitations and launch updates, and follow up on partner applications. Joining the waitlist does not create an app account. Vercel hosts the website and provides BotID spam protection; a separate Neon Postgres database stores signup records; Resend processes contact lists, emails and delivery events; and Cloudflare forwards messages sent to our contact address.

The waitlist stores a short-lived, keyed hash of your IP address to limit repeated submissions, rather than the raw IP address. Hosting and email providers may maintain their own operational logs.

We use Vercel Web Analytics for public page visits and completed form submissions. Reports include referral sources, country, device and browser information. This analytics service does not use cookies. We do not send email addresses, application details, conversations or health data as website analytics events. We remove query strings and fragments from tracked URLs and exclude unsubscribe pages. Authentication and security services may use storage or cookies needed for their functions.

Retention, security and your choices

We retain account information, conversation history, memories, activity records and saved files while they are needed to provide Rumi and respond to your requests. Some records may need to remain for security, legal obligations or resolving disputes, and copies in backups may persist until those backups are replaced. Disconnecting an integration, signing out or uninstalling the app does not by itself delete server records.

To request access to, correction of, or deletion of your account and personal information, email hello@rumihq.com from the address associated with your account. We may need to verify that the request is yours. Asking Rumi to forget something in conversation is not the same as an account deletion request and may not remove the original conversation or connected-service records.

You can stop waitlist and launch emails through the unsubscribe link or by contacting us. We retain a minimal suppression record to avoid restarting emails accidentally. We do not sell personal information. Depending on where you live, you may have additional rights to object to processing, restrict it, withdraw consent, receive a portable copy of your information or contact a privacy regulator.

We use safeguards such as encrypted connections, access controls and protected credentials. No service can guarantee absolute security. Avoid sending information that is unnecessary for the help you want from Rumi.

Children and policy changes

Rumi is not directed at children. If you believe a child has provided personal information without appropriate permission, contact us so we can investigate and address it.

We may update this policy as Rumi changes. The date above shows the latest version. Where required, we will provide notice or request additional consent before using information for a materially different purpose.