Privacy policy

The short version

Rufy exists to read your financial email, so the honest summary is that it reads your financial email. Here is what that means in practice, before the detail:

• We keep the messages you send us, the receipts you photograph, and the ledger we build from them.
• Your mailbox is yours alone. Sharing a household with someone shares the accounts and the transactions — never the messages, the receipt photographs, or your chats with Rufy.
• We do not sell your data, and we do not use it to advertise to you.
• Automated reading is done by Anthropic's Claude on our behalf. Under our agreement with them, your content is not used to train their models.
• You can export everything and delete everything, and deleting means deleted.

Who we are

Rufy is operated by Salkantai SAS, registered at Constituyente 1967, apto. 702, Montevideo, Uruguay. We are the data controller for the information described here.

For anything in this policy, write to support@askrufy.com. A person reads that address.

What we collect

Four kinds of thing, and nothing else:

• Account details. Your email address, a password, optionally a name for your household, and the currency you keep your books in. We ask for the currency rather than guessing it from your location.
• Email you send us. Either messages you forward, or — if you connect a mailbox — the messages that match what Rufy is looking for. We keep the message exactly as it arrived, because every conclusion we draw is a reading of those bytes and a parser we fix later has to be able to re-read them.
• Receipts you photograph. The image and what we read off it, including the line items.
• What we derive. Transactions, accounts, payees, income sources, categories, the questions Rufy could not answer on its own, and your chats with it.

What we use it for

To run the service you asked for: turning the mail you send into a ledger you can read, telling you what changed, and answering what you ask it. That is the whole of it.

We also keep ordinary technical records — error logs, request timing — for keeping the service up and diagnosing it when it is not. These are kept separate from your ledger and are not used to profile you.

Where the law asks for a basis: processing your financial mail is necessary to perform the contract you entered into when you signed up. The technical records rest on our legitimate interest in a service that works.

How the automated reading works

Most messages are read by a template Rufy has already learned for that sender, entirely on our own infrastructure, with no model involved.

When a message has a shape Rufy has not seen before, its contents are sent to Anthropic to be read by Claude, and Rufy learns a template from the answer so the next one costs nothing. The request travels through Vercel AI Gateway, which routes it and does not retain the contents.

Under our agreements with those providers, your content is not used to train their models.

Rufy never guesses at your expense. When it cannot resolve something — an amount it cannot parse, an account it does not recognise — it asks you rather than writing a plausible number into your ledger.

What a household shares

This is the part people get wrong about shared finance apps, so it is enforced in the database rather than in our code: the rule is a property of the schema, and a query that forgot it would return nothing rather than too much.

Sharing a household shares accounts and the transactions on them. It does not share your mailbox, your receipt photographs, or your conversations with Rufy. A shared card's alert becomes a transaction everyone in the household can see; the message announcing it stays with the person whose mailbox it arrived in.

Chats are personal by default. People ask Rufy things they would not ask in front of the household — what they cannot afford, what they keep overspending on — and a shared-by-default log would be a privacy failure rather than a setting to tune later.

Who else touches it

We use a small number of providers, each for one job:

• Anthropic — reads messages whose shape Rufy has not learned yet.
• Vercel — routes those requests through its AI Gateway, and serves this website.
• Railway — runs the application and the database behind it.
• Resend — delivers the mail Rufy sends you.
• Your own mail provider (Gmail, Outlook, iCloud and the like), if you connect a mailbox rather than forwarding. You grant that access yourself and can withdraw it from their settings at any time, independently of us.

How long we keep it

Your ledger and the messages behind it stay until you delete them. We do not expire your financial history on a timer — a year-old transaction is the point of keeping a ledger.

Deleting your account removes your messages, receipts, chats and ledger. The deletion cascades from your record through everything attached to it, so there is no orphaned copy left behind by design.

Our database host keeps backups for a limited period. Deleted data ages out of those as well, rather than quietly outliving the deletion in them.

How it is protected

Passwords are hashed with Argon2id and are never stored in a form anyone can read, including us. Session tokens are stored only as a SHA-256 digest, so a database dump yields no usable sessions.

Every query runs under PostgreSQL row-level security, inside a transaction that first declares which household and which member it is acting for. The database, not merely the application, decides which rows exist for that request. The application's own database role owns nothing and cannot bypass those policies.

Traffic between you and Rufy travels over HTTPS.

No system is beyond compromise. If one that affects you happens, we will tell you and tell you what we know, rather than wait until we have a tidier story.

What you can ask us to do

Whatever the law where you live calls them, these are the things we will actually do:

• Show you what we hold about you.
• Export it in a form you can use elsewhere.
• Correct anything that is wrong.
• Delete it — all of it, not merely deactivate it.
• Stop processing it while we settle a disagreement about any of the above.

Cookies

This site sets two, and both are small:

• NEXT_LOCALE — the language you chose, so the site opens in it next time.
• rufy.consent — your answer to the cookie banner, so we stop asking.
• Signing in to the app itself sets a session cookie. Without it there is no way to stay signed in.

Children

Rufy is not built for, or directed at, anyone under 18. If we learn we are holding a child's data, we delete it.

Changes to this policy

When we change it in a way that matters, we will say so in the product rather than quietly editing this page and updating the date. The date at the top always tells you when it last moved.

Getting in touch

Questions, requests and complaints: support@askrufy.com.

You may also complain to a data protection authority. In Uruguay that is the Unidad Reguladora y de Control de Datos Personales (URCDP); elsewhere it is whichever authority covers where you live.