Privacy Policy
Last updated 2026-10-08
Ruvio gives AI bots a private computer to work on for you. This page says what we collect, why we collect it, who receives it, how long we keep it and what you can do about it. If anything is unclear, write to [email protected].
The short version
- We collect what we need to run your account and your bots, and nothing for advertising.
- To answer you, your bots send your text and files to third-party AI model providers.
- This website sets no cookies and loads no advertising scripts. We count visits with Cloudflare's cookieless Web Analytics.
- You can delete your account yourself, any time, in Settings. You can also email us.
- Ruvio is a private beta for people over 18.
Who we are
Ruvio ("we", "us") runs the website at ruvio.site, the product at chat.ruvio.site and the related services. You can reach us at [email protected].
What we collect
When you sign in
You sign in with Google. We ask Google only for the basic sign-in scopes: openid, email and profile. We receive and store your name, your email address, a link to your profile picture and Google's identifier for your account. Signing in does not give us access to your Gmail, Calendar or Drive. We never see your Google password.
When you join
We keep the short answers you give when you start: your goal and how you heard about Ruvio. If you use an invite code, we record that it was used and by whom.
Your content
We store your messages to your bots and their replies, the steps a bot took, the approval requests we showed you and your answers, your bot settings, memory notes, skills and routines, and the files you upload or your bots create.
Your private computer
Each person gets one private computer: a small virtual machine on our server. It holds the files your bots work on and the browser they use. If you sign in to a website in that browser, for example when you take over the browser to log in, that login session stays in the browser profile on your computer. We do not keep the passwords for those sites in our database.
Usage
For each piece of work a bot does, we record which AI model was used, how many tokens were used and when. We use this to apply your allowance and to keep the service running. We also store your plan and allowance.
Technical data
When you visit, our servers receive your IP address and normal request details such as the page requested. Cloudflare, which carries our traffic, sees them first. We use the IP address to limit abuse and to keep the service safe. Servers also keep operational logs for troubleshooting. These logs are meant for errors and timing, not for the content of your messages.
Cookies and similar storage
This landing site (ruvio.site) sets no cookies and loads no advertising or tracking scripts. All its fonts and images come from our own server. The one exception is Cloudflare Web Analytics, described below.
Cloudflare Web Analytics runs on both ruvio.site and chat.ruvio.site. It does not use cookies and does not follow you across other sites. It gives us totals such as page views, load times and the country of visits, so we can see how many people use Ruvio and fix slow pages.
The product at chat.ruvio.site uses only what it needs to work:
| Name | What it is for | How long |
|---|---|---|
__Host-maas_session | Keeps you signed in. Secure, HttpOnly, SameSite=Lax. | Up to 7 days, or until you sign out |
__Host-maas_oauth | Protects the Google sign-in step. | Up to 10 minutes |
| Local storage in your browser | Your theme choice and a few display preferences. They stay on your device. | Until you clear them |
Why we use your data
- To create your account and let you in (this is needed to provide Ruvio to you).
- To run your bots, show you their work and save the results.
- To count usage and apply your allowance.
- To keep Ruvio secure, prevent abuse and fix problems.
- To answer your emails and requests.
- To meet legal duties.
We use your consent where the law asks for it, and our legitimate interest in running a safe service for the rest. You can withdraw consent at any time (see "Your rights").
Who receives your data
We do not sell your personal data. These are the parties that receive some of it:
- Third-party AI model providers. To answer you, the text of your messages, your bot's instructions and memory, and the content of any file or web page a bot reads while working on your task are sent to third-party AI model providers. We send it through our own gateway, which holds the provider key. Your computer never sees that key. Each provider handles the data under its own terms.
- Google. It handles your sign-in, under Google's own privacy policy.
- Cloudflare. It carries our web traffic (DNS, TLS and a tunnel to our server) and forwards email sent to our company address. It also measures aggregate visits with its cookieless Web Analytics.
- Resend. When we reply to you by email from our company address, the message is sent through Resend.
- Websites and apps your bots use. When a bot browses a site or sends something in another app for you, that site or app receives what the bot sends, as part of the task you gave it. See our Terms.
- Authorities, when the law requires us to share data.
Your data is stored on server hardware that we operate. The AI providers and Cloudflare may process data outside Indonesia.
How long we keep it
- Your account, bots, conversations and files: until you delete them or delete your account.
- Sign-in sessions: they expire after 7 days.
- Waitlist and invite records: as long as your account exists.
- Emails to us: as long as we need them to deal with your request.
When you delete your account
In Settings, choose "Delete account" and type DELETE. We then stop your bots, sign you out and delete your account, your bots and teams, conversations, uploads, results, sessions, usage records and your private computer. This work continues in the background and is retried until it finishes. We keep a short deletion record that holds a one-way hashed ID and a status. It does not hold your name or email address.
After deletion you can sign in with the same Google account again. You start as a new person with nothing carried over, and you need an invite again, like anyone else.
We make occasional backups of our database, for example before an upgrade. Data you deleted can remain in an older backup until we clear that backup. We clear old backups from time to time.
How we protect it
Each user gets a separate private computer, bots need your approval before they send anything on your behalf, API keys are stored hashed, traffic uses TLS and access is by invitation. Read the details on our Security page. No system is perfectly safe, and Ruvio is still in beta.
Your rights
You can ask us to:
- give you access to the personal data we hold about you;
- correct data that is wrong;
- delete your data (you can also do this yourself in Settings);
- limit or stop how we use your data, or withdraw a consent you gave;
- give you your data in a form you can reuse (you can also download your files in the app).
These rights come from Indonesia's Personal Data Protection Law (Undang-Undang No. 27 of 2022, "UU PDP"). We also honour GDPR-style rights on request, wherever you live. Write to [email protected] from the email address on your account. We may ask you to confirm it is really you. We aim to answer within 30 days. If you are not happy with our answer, you can complain to the Indonesian data protection authority or to the authority where you live.
Children
Ruvio is not for anyone under 18. We do not knowingly collect data from children. If you think a child has an account, tell us and we will delete it.
Changes to this page
When we change this policy we update the date at the top. If a change matters, we will tell signed-in users in the app.
Contact
Questions, requests or complaints about your data: [email protected]