Cookie Notice

1. Scope

This Cookie Notice explains how StatGazer LLC uses cookies and similar browser-storage technologies on the RUMA public website and the authenticated account pages at ruma.rent. It does not apply to third-party websites, or to separate services that publish their own notices.

2. Cookies and storage RUMA uses

RUMA uses one first-party cookie — an authentication cookie set after you sign in:

The cookie holds a signed session token — a reference to your server-side session and your account ID, with an expiry. It does not contain your password. It is set HttpOnly (page scripts cannot read it) and, in production, Secure and SameSite=Lax.

RUMA also keeps a small amount of functional information in your browser’s local storage — your chosen interface language and whether you have dismissed certain first-run tips — and holds an anti-CSRF security token in memory only for the duration of a page visit. These are first-party, do not identify you across sites, and are not used for tracking.

RUMA does not use advertising cookies, cross-site tracking cookies, session-replay technologies, or third-party trackers on RUMA pages — and that is not changing. RUMA has announced first-party product analytics, which is not yet active: today no analytics identifier is stored and no analytics events are collected. When it activates — region by region, only as applicable law permits, and with consent asked first where required — analytics will use first-party local storage only (a random analytics identifier and first-party campaign attribution), never third-party cookies, and always subject to the analytics preference below.

3. Your analytics preference (GPC, DNT, opt-out)

RUMA treats three signals as one analytics preference, honored from the day analytics activates:

• Global Privacy Control — a browser sending Sec-GPC: 1 is treated as opted out of product analytics.
• Do Not Track — a browser sending DNT: 1 is treated the same way.
• Manual opt-out — an explicit RUMA analytics opt-out, available when analytics activates.

Opting out means: product-analytics collection stops; the local analytics identifier and stored first-party campaign attribution are removed; no analytics pseudonym is generated for new events; and the identifier is not silently recreated while the preference holds. If analytics events were already delivered to the analytics processor, RUMA carries a deletion obligation through to it — see the Privacy Notice.

The preference governs product analytics only. The strictly necessary storage above (the authentication cookie, your language choice, the in-memory security token) and the security, fraud-prevention and reliability logging that keep the Service running are not affected by it.

4. Why RUMA does not show a consent banner

The authentication cookie is strictly necessary to provide the signed-in service you request: without it, RUMA cannot keep you authenticated or maintain your account session.

Because RUMA does not currently use non-essential cookies or similar technologies on RUMA pages, we do not display a cookie consent banner today. The announced first-party analytics (section 2) is non-essential: it will activate only region by region as applicable law permits, consent will be asked first where an applicable rule requires it, and the analytics preference above — including Global Privacy Control and Do Not Track — will be honored everywhere. This Notice will be versioned again when activation begins.

5. Payment provider

When you choose to purchase a RUMA subscription, you may be redirected to a checkout page and billing portal hosted by our payment provider, Stripe. Stripe may use cookies and similar technologies on its own pages for security, fraud prevention, authentication, and other purposes described in Stripe’s own notices. RUMA does not control the cookies Stripe sets on Stripe-hosted pages. The providers that process data to run the Service are listed on our Subprocessors page.

6. Managing the authentication cookie

You can browse RUMA’s public pages without the authentication cookie. Blocking or deleting it will prevent you from staying signed in and using authenticated account features; deleting it signs you out. You can manage cookies and local storage through your browser settings at any time.

7. Changes and contact

If our use of cookies or similar technologies changes, we will update this Notice and its version history. Privacy questions: privacy@ruma.rent. Operator: StatGazer LLC, a New York limited liability company, 418 Broadway, STE R, Albany, NY 12207, USA.