Privacy Policy

What Rumi does with what you type

Rumi runs a language model on your phone. The model file sits in the app's own storage and the answer is computed on your device, so the text of your conversation is not sent anywhere to be answered.

That is a narrower promise than the one Rumi used to make on its store listing, and the narrower one is the true one. The app's own network code says so in a comment: the strongest statement it supports is not that Rumi makes no network requests, but that Rumi can only ever perform an unauthenticated, bodyless, queryless HTTPS GET of a fixed file from a fixed host. Rumi does use the network. It uses it for three things, and this page names all three.

The three times Rumi uses the network

Signing in. Rumi requires an account and you cannot get past the sign-in screen without one. Accounts are handled by Firebase Authentication and Google Sign-In, both Google services, so Google receives your email address, your display name if you have one, and the ordinary connection details of a sign-in. Rumi carries Firebase Authentication and nothing else from Firebase: no analytics, no crash reporting, no messaging.

Downloading a model. The weights come from Hugging Face. Six hosts are allowed: huggingface.co, cdn-lfs.huggingface.co, cdn-lfs-us-1.hf.co, us.aws.cdn.hf.co, cas-bridge.xethub.hf.co and transfer.xethub.hf.co. The request carries no account identifier and no cookie, but Hugging Face necessarily sees your IP address and which model you chose to download.

Advertising. Rumi shows ads from Google AdMob on the free tier. Requests are marked as non-personalised, but AdMob still receives your device's advertising identifier, its IP address and information about the app.

How that boundary is enforced, and what it does not cover

Rumi routes network access through a single chokepoint that is shut by default. A request is refused unless it is a plain HTTPS GET, with no body, no query string, no cookies and no custom headers, to a host on a short fixed list. The build fails if any other shape of request is written into the app.

We should be equally plain about the limit of that. This mechanism governs requests made from the app's own Dart code. Sign-in does not pass through it, because Firebase makes its calls from Android's own code where the chokepoint cannot see them. That is written down in the source rather than glossed over, and it is why this page names sign-in as network use instead of treating it as an exception.

What is stored, and where

Your conversations, your notes and the model file are stored as files in the app's private directory on your phone. They are not synced, not backed up by us, and not sent to any server.

A small number of local flags, such as whether you have read the capability card, are kept in the app's ordinary preferences.

Rumi has no server of its own. There is no Rumi database and no account record beyond the one Firebase holds.

Deleting your account and your data

Settings has a Delete account control. It deletes your Firebase account, which is the only account Rumi has.

Your conversations and downloaded models are on your phone, so deleting the account does not remove them and does not need to. Uninstalling the app removes them.

For anything else, email [email protected].

Children

Rumi is intended for users 13 and older. It is not directed at children under 13, and it has no age check beyond that statement.