Privacy Policy

The short version

Everything Rudder records about your actual use (which apps you opened, how you responded to a check-in, how its adaptive settings have changed over time) stays in a local database on your phone. There is no Rudder account or app-use-history backend, and nothing to sign in to. You can also choose to export and share your local data. Separately, Rudder uses crash reporting: technical diagnostics, including crash and error reports, are automatically sent to our crash-reporting provider (Firebase Crashlytics, part of Google) so we can find and fix the problem. The rest of this page explains exactly what that is and isn't.

Information Rudder collects

To do its job, Rudder records, locally on your device only:

• Which of the apps you chose to manage were opened, and when.
• How you responded to each check-in (continued, went back, requested temporary access) and roughly how long you spent in the app afterward.
• Your chosen settings, suggestions, accepted changes, support history and reviews, so Rudder can explain and evaluate the support you chose.
• The goals and optional notes you enter, accepted support choices, review answers, and optional product feedback.
• A local installation identifier, recording-coverage information and timing needed to interpret your history.

Optional text fields store what you choose to enter; avoid including personal information you do not want in your local history or an export.

Rudder does not automatically collect your name, email, contacts, messages, photos, location, browsing history, or the on-screen content of any app, including the apps it manages.

How the Accessibility permission is used

Rudder uses Android's Accessibility Service permission to detect app changes, show check-ins and measure visits to your selected apps. Concretely, that means:

• It observes foreground window changes and a rough tap-timing signal to distinguish an actual reopen from a transient window event. It does not read the tapped target or its content.
• It observes window identifiers, window types, picture-in-picture mode and active/focused state to recognize expansion of the same window as a continuation of a visit. These are window metadata, not window contents or text.
• It does not read the text or contents of any screen, in Rudder or in any other app.
• It does not log keystrokes, take screenshots, or record audio or video.
• It does not simulate taps, gestures, or any other input. It only observes, and only shows its own check-in screen.
• App/window-change events and rough tap timing can come from apps you have not selected. Rudder uses those signals to recognize departures and temporary interruptions; it does not build a usage-history record for unselected apps.

Where your data lives

Everything about your actual use of Rudder, listed above, is stored in a local database on your device, created and managed by the app itself. Uninstalling Rudder, or completing Settings → "Erase and start over", removes this local history. Removing an app from management stops managing it but does not erase all of its earlier history. Nothing about your usage is backed up to a server Rudder controls, because no such server exists. Technical crash reports leave your device as described below. Rudder does not automatically upload its local database. Android app backup and device-transfer backup of that history are disabled.

Exports you choose to share

The optional data export contains a snapshot of your local database and a manifest with your local installation identifier, export time, app version, record counts and selected app identifiers/modes. It includes usage history, goals, support and review history, and feedback. The ZIP is not password-protected, so a recipient can read its contents. Exporting is not required to use Rudder or answer a review. You choose whether to share it and with whom. Deleting data in Rudder does not delete exported files or copies already shared; delete those files separately and contact any recipient about their copy.

Crash and diagnostic reporting

Rudder uses Firebase Crashlytics (part of Google) so that if it crashes or hits an unexpected error, we can find and fix it, the kind of information that's very hard to get from "it broke" descriptions alone. Crash reporting is enabled automatically, separately from the Accessibility permission and the suggestions setting. Diagnostics can be sent when the app starts or restarts, as well as after a crash, a reported error or an app-not-responding event. They can include:

• The technical details of the crash itself: what code was running, the error, and the stack trace.
• Device/app and diagnostic information such as device model, Android and app versions, event time, and device memory/storage state.
• Crashlytics, Firebase installation and session identifiers used to associate diagnostic events. These are not a Rudder login or an advertising ID.

Rudder does not deliberately attach its usage database, managed-app list, goals, review answers or feedback as custom diagnostic data. Technical exception messages can contain values involved in an error. Google Analytics is not included. Crashlytics uses supporting Firebase installation/session services. See Firebase privacy information for its diagnostic data and retention practices. Firebase states that it retains crash traces and associated identifiers for 90 days before beginning removal from live and backup systems. Diagnostics may be processed outside your country, including outside the EEA.

What we don't do

• No advertising, and no ad-tracking SDKs of any kind.
• We do not sell or rent your app-use history or provide it to advertising services. You can choose to share an export. Technical diagnostics go to Google as described above.
• No Rudder account is required. Diagnostic installation identifiers still exist as described above.

Deleting your data

Unless you have exported and shared a copy, your usage data lives only on your device, so you're always in control of it directly: complete "Erase and start over" in Settings to erase the local history, or uninstall the app. Erasing local data does not erase reports already sent to Firebase or turn off automatic crash reporting. For requests about diagnostic reports or copies you shared with us, see how to request deletion.

Website visits and contacting us

This website and email are separate from the app's local history. Website delivery involves connection information such as your IP address and browser details. If you email us, you share your address, message and any attachments with us and our email provider so we can respond. Please avoid sending sensitive information unless it is needed for your request.

Your privacy requests

Depending on your location and the processing involved, you may have rights to access, correct or erase personal data, restrict or object to processing, receive a portable copy, withdraw consent where processing relies on consent, and complain to a data protection authority. Contact privacy@getrudder.app to make a request. See the deletion page for the distinction between local history, shared copies and diagnostic reports.

Children's privacy

Rudder is not directed at children and does not knowingly collect information from anyone under 13.

Changes to this policy

If what Rudder collects changes, we'll update this page and its "last updated" date. This is an early-stage app under active development; check back if it's been a while.

Rudder's business model isn't finalized yet. If we introduce advertising or additional data collection in the future to support the app, we'll rewrite the relevant sections of this policy with the real specifics before that change takes effect (not just a vague mention), update our Play Console Data Safety disclosure to match, and ask for your consent first wherever the law requires it, rather than treating a policy update alone as sufficient notice.

Contact

Questions about this policy or your data: privacy@getrudder.app.