Privacy policy

What we process

• Your messages and the images you attach, and the agents’ replies. They are kept so an agent can follow the conversation and so your chats appear in the sidebar. Without an account they are deleted automatically 3 days after the last message; with one, 18 months after it, and at most 50 chats per agent are kept. They are deleted right away when you delete a chat or your account. When you confirm an account, the chats on that device move to it.
• Voice notes. They are converted to text so you can send them; the audio itself is not stored.
• Images an agent creates for you, kept with the chat they belong to, and deleted with it.
• How many messages, images and voice notes you used today, to apply the free daily limits. These counters hold no content.
• Replies you report with the flag button, with the agent’s name, kept for up to 90 days so we can review them. To review one, we may read the conversation it came from, while that conversation is still kept.
• If you create an account: your email, your phone number, which channel confirmed it (WhatsApp or SMS) and your password, stored only as a salted hash. They are kept until you delete the account, and used only to sign you in and to allow one account per number. Codes are sent by email, or by WhatsApp or SMS from Rubrion’s own number.
• If you publish an agent to the directory (rubry.ai/agents, accounts only): its name, address, icon (if you add one), summary, description, tags, source repository and, if you give one, its public endpoint. To fill the form in, your browser reads the repository’s public details straight from its forge (GitHub, GitLab or Codeberg); we keep only what you publish. An unpublished draft stays in your browser. They are public on its page, can be indexed by search engines and are kept until you remove the agent or delete your account, or until we take it down for breaking the Hub’s rules (a published key, harmful content, code that isn’t open). Your email and phone are never shown with it.
• If you buy prepaid credit: Paddle (paddle.com), our reseller, sells it to you and processes the payment, so your card or Pix details go to Paddle, never to us. We keep which account bought which pack, Paddle’s transaction id and the credit added or refunded, as long as accounting law requires, even after the account is deleted. Unused credit is lost when you delete your account.

How we tell visitors apart, without knowing who you are

Chats and daily limits are tied to a pseudonymous code computed from your network address and the date, with a secret key. It changes every day, and the address itself is never stored. We cannot link it to a person.

Without an account, limits also count per device: a random code in a cookie and in the browser’s storage, so clearing one of them doesn’t reset them. Chats are tied to it, for 3 days after the last message.

Your session is a cookie that lasts 2 hours, after a quick human check by Cloudflare Turnstile, and only works on the device that passed it.

Cookies and storage on your device

• Session cookie (2 hours), so you don’t repeat the human check.
• Device code (1 year), in a cookie and in local storage, for the daily limits.
• Account cookie (30 days), if you sign in.
• Connected agents (if you add one): its name, address and key, in an encrypted cookie only your browser holds, for up to 30 days.
• Your preferences in the browser’s local storage: language, theme and whether the sidebar is collapsed.

We use no advertising or tracking cookies, and no analytics or ads SDKs in the apps.

Who else processes your data

• Cloudflare hosts Rubry, runs the AI models of Rubry’s own agents (Workers AI) and the human check (Turnstile), as our service provider.
• Brad, a Rubrion agent, answers when you pick it.
• If you connect your own agent, your messages go to the address you entered; what happens there is up to whoever runs that agent.

We do not sell your data, share it for advertising, or use it to train AI models.

Your choices and rights

Delete any chat from the sidebar, remove connected agents in “Connect your agent”, remove published agents at rubry.ai/agents/publish, or clear the site’s data in your browser (or uninstall the app). See how to delete your data.

Under Brazil’s LGPD and similar laws you may ask us about your data, ask for a copy or ask us to delete it. Write to hello@rubrion.ai. Because we keep no identity, we may need the date and approximate time of the chat to find it.

Children

Rubry is not directed at children under 13, and we do not knowingly process their data.

Security

Everything travels over HTTPS. Keys you give us for connected agents are sealed with AES-GCM and live only in your browser’s cookie.

Changes and contact

We will update this page when Rubry changes how it handles data; the date at the top shows the latest version. Questions: hello@rubrion.ai.