Privacy Policy

The data controller is Hernán Ricardo Feliú Arenas, tax ID 16.801.738-3, based at Avenida Independencia 69, Casa 47, Limache, Chile.

For anything about your data — a copy of it, a correction, deleting your account — write to privacidad@rukio.app. We answer within 30 days.

This policy follows Chile's Law 21,719 on personal data protection.

Your account: name, email and profile photo, through Supabase Auth. If you sign in with Google we receive your name, email and public photo; nothing else from your Google account.

Your household: household name, who's in it, each person's access level, birthdays, photos, how you relate to each other ("your daughter", "the cat") and your settings.

Money: expenses, income, spending limits per category, savings goals and who owes whom.

Day to day: to-dos, shopping lists, plans and outings, menus and recipes, wishlists and gift reservations.

Health (only if you use Care, and only if you authorize it separately): medicines and their times, medical checkups, allergies, conditions and the documents you upload.

What you tell Ruka: the conversation messages, so she remembers what you were talking about.

App usage: which sections you open, what actions you take and in what language. Not the content of what you log.

Every piece of data has a concrete purpose and a legal basis behind it:

• Running the app (your account, your household, what you log): performance of the contract between you and us. Without this data there's no service.
• Ruka answering you: your household context travels to Anthropic to generate the reply. Also part of the service you asked for.
• Health data: only with your express consent, asked separately when you open Care and withdrawable any time.
• Reminding you about a dose, a checkup or a birthday: you set these up, and each kind can be turned off on its own.
• Understanding how the app is used to improve it: legitimate interest, using usage data without the content of what you log.
• Complying with the law where it applies.

We don't sell, rent or trade your data with anyone. We don't advertise with it or build profiles for third parties.

The Care section stores health data, which the law treats as sensitive: it requires specific permission — the one for creating an account isn't enough.

So the first time you open Care we ask for a separate authorization that explains what gets stored and what for. Until you give it, nothing health-related is stored or shown, and Ruka can't log it either.

The authorization is yours, not your household's: each person gives their own. You can withdraw it any time from your profile. Withdrawing stops future use; if you also want what's already logged deleted, ask and we'll delete it.

Rukio is built for homes with children, so minors can be in a household two ways: with a profile an adult manages (a baby, a young child) or with their own account if the adult decides so.

Either way, whoever adds them has to declare they're under 18, and that records that an adult responsible for them authorized processing their data.

A minor with an account starts out seeing and logging only their own things, and can't run the household. The adult can widen that if they want.

If you believe we added a minor without their guardian's authorization, write to privacidad@rukio.app and we'll delete it.

Rukio is meant to be shared at home, so most of what you log is visible to the rest of the household. How much depends on each person's access:

• Runs the household: sees everything shared, manages members, invites and changes access.
• Sees and logs all household money: uses every section, sees shared expenses and income.
• Sees and logs only their own: their own expenses, not other people's and not household income.
• Doesn't use the app: a profile someone else manages (a baby, a pet). No access.

Three things no access level can see:

• What you mark private: a private expense, goal or document is yours alone, even from whoever runs the household.
• Gifts: who reserved what, and who drew whom in secret santa, is hidden from the recipient. You can also put a PIN on the section.
• Another person's private data never enters what Ruka reads to answer you.

If you share a wishlist or a plan with a link, anyone with that link sees that content without an account. You can turn it off any time.

Only the providers that make Rukio work. Each gets the minimum for its job:

Supabase: your account, the database, and the photos and documents you upload. Anthropic: your household context and your messages, so Ruka can answer. Not used to train their models. Groq: the audio you record when dictating, only while it transcribes it. ElevenLabs: the text of one message, only when you ask Ruka to read it aloud. Resend: your email, to send invitations and account messages. Vercel: hosts the app and handles each request. PostHog: which sections and actions you use. Not the content of what you log. Sentry: errors. Configured not to send personal data, and the recording of the seconds before an error has all text and images masked.

None of them may use your data for their own purposes.

Plainly: the database and servers are in the United States (Oregon), and the providers above process there too.

That's an international data transfer. Law 21,719 allows it when the recipient offers sufficient guarantees, and those come from the data processing agreements that are part of each provider's terms.

We chose that region because the app feels faster when the server and the database sit together. If we ever move the database, we'll update this policy.

• While you have an account: everything you logged stays, because that's the point of the app.
• If you delete your account: we delete your data right away. Backups are overwritten within 30 days.
• If you delete a household: it goes with everything in it, for everyone in it.
• Conversations with Ruka: until you delete them. Only the last 10 turns travel to the model with each message.
• Ruka cost metering: how many messages and how many words, without the content. 24 months.
• Errors: 90 days.
• Unaccepted invitations: expire after 7 days.

• Everything travels encrypted (HTTPS/TLS) and the database is encrypted at rest.
• Passwords are handled by Supabase Auth; we never see them.
• Photos and documents live in a private bucket: each time one is shown, the server checks you belong to the household and generates a link that expires in a minute. There are no public URLs.
• Before reading or writing anything, the server checks which household you belong to. The client never decides which household a query is for.
• Access to production data is restricted.

None of this makes a system infallible. If you see something odd or think someone accessed what they shouldn't, write to privacidad@rukio.app.

If a breach happens that could affect you, we'll notify you and Chile's Personal Data Protection Agency without delay, telling you what happened and what to do.

Ruka never carries out something that changes your data on her own. When she wants to log an expense, move money into a goal or add someone, she shows you exactly what she'd do and waits for your "Yes".

That means we don't make automated decisions that produce effects on you: the decision is always yours, and you have the right to keep it that way.

Ruka doesn't give medical advice either. She remembers doses and times; she doesn't recommend treatments.

Over your personal data you can:

• Access: ask for a copy of everything we hold about you.
• Rectify: correct anything wrong, from settings or by asking us.
• Erase: ask us to delete your account and your data.
• Object: ask us to stop using it for a specific purpose.
• Port: ask for your data in a file you can take elsewhere.
• Block: ask us to suspend use while a complaint is resolved.
• Withdraw consent: any time, without affecting what was done before.

Exercise them by writing to privacidad@rukio.app. We don't charge for this and we answer within 30 days.

If you're not satisfied with our answer, you can complain to Chile's Personal Data Protection Agency.

If we change something substantial — what we store, what for, or who we share it with — we'll tell you in the app or by email 30 days before it takes effect.

If the change touches health data, we'll ask for your authorization again: we don't treat it as inherited.

Minor changes (fixing wording, updating a contact detail) are published with the date updated above.