Cookie Notice

1. Scope

This Cookie Notice explains how StatGazer LLC uses cookies and similar browser-storage technologies on the RUMA public website and the authenticated account pages at ruma.rent. It does not apply to third-party websites, or to separate services that publish their own notices.

2. Cookies and storage RUMA uses

RUMA uses one first-party cookie — an authentication cookie set after you sign in:

The cookie holds a signed session token — a reference to your server-side session and your account ID, with an expiry. It does not contain your password. It is set HttpOnly (page scripts cannot read it) and, in production, Secure and SameSite=Lax.

RUMA also keeps a small amount of functional information in your browser’s local storage — your chosen interface language and whether you have dismissed certain first-run tips — and holds an anti-CSRF security token in memory only for the duration of a page visit. These are first-party, do not identify you across sites, and are not used for tracking.

RUMA Assistant is active on RUMA's public marketing pages. Before a chat starts, the only Assistant browser storage is a first-party localStorage boolean written if you dismiss a desktop teaser, so the teaser does not keep appearing. It contains no timestamp, account, session, or analytics identifier and remains until you clear site data. Conversation storage starts only if you select Start chat. It uses first-party, tab-scoped sessionStorage to keep a random, opaque Assistant session reference and the recent conversation state needed to continue that chat. This is functional storage for the chat you requested — not advertising, tracking, or product analytics. The browser clears it when that tab/session ends according to the browser’s behavior; you can clear it earlier in browser settings, which ends the saved chat state.

RUMA does not use advertising cookies, cross-site tracking cookies, session-replay technologies, or third-party trackers on RUMA pages — and that is not changing. RUMA has announced first-party product analytics, which is not yet active: today no analytics identifier is stored and no analytics events are collected. When it activates — region by region, only as applicable law permits, and with consent asked first where required — analytics will use first-party local storage only (a random analytics identifier and first-party campaign attribution), never third-party cookies, and always subject to the analytics preference below.

3. Your analytics preference (GPC, DNT, opt-out)

RUMA treats three signals as one analytics preference, honored from the day analytics activates:

• Global Privacy Control — a browser sending Sec-GPC: 1 is treated as opted out of product analytics.
• Do Not Track — a browser sending DNT: 1 is treated the same way.
• Manual opt-out — an explicit RUMA analytics opt-out, available when analytics activates.

Opting out means: product-analytics collection stops; the local analytics identifier and stored first-party campaign attribution are removed; no analytics pseudonym is generated for new events; and the identifier is not silently recreated while the preference holds. If analytics events were already delivered to the analytics processor, RUMA carries a deletion obligation through to it — see the Privacy Notice.

The preference governs product analytics only. The strictly necessary or requested functional storage above (the authentication cookie, your language choice, the in-memory security token, and, for the active Assistant, its content-free teaser-dismissal boolean and, after you select Start chat, its tab-scoped sessionStorage) and the security, fraud-prevention and reliability logging that keep the Service running are not affected by it.

4. Why RUMA does not show a consent banner

The authentication cookie is strictly necessary to provide the signed-in service you request: without it, RUMA cannot keep you authenticated or maintain your account session.

Because RUMA does not currently use non-essential cookies or similar technologies on RUMA pages, we do not display a sitewide cookie consent banner today. RUMA Assistant is active; its content-free teaser-dismissal boolean prevents repeat prompts, while functional conversationsessionStorage starts only after you select Start chat and is needed to provide the chat you requested. The Assistant’s separate pre-chat notice and Start chat action cover its recording and data processing; this is not a sitewide tracking banner.

The announced first-party analytics described above is non-essential: it will activate only region by region as applicable law permits, consent will be asked first where an applicable rule requires it, and the analytics preference above — including Global Privacy Control and Do Not Track — will be honored everywhere. This Notice will be versioned again when analytics activation begins.

5. Payment provider

When you choose to purchase a RUMA subscription, you may be redirected to a checkout page and billing portal hosted by our payment provider, Stripe. Stripe may use cookies and similar technologies on its own pages for security, fraud prevention, authentication, and other purposes described in Stripe’s own notices. RUMA does not control the cookies Stripe sets on Stripe-hosted pages. The providers that process data to run the Service are listed on our Subprocessors page.

6. Managing browser storage and the authentication cookie

You can browse RUMA’s public pages without the authentication cookie. Blocking or deleting it will prevent you from staying signed in and using authenticated account features; deleting it signs you out. You can manage cookies, local storage, and session storage through your browser settings at any time. Clearing the Assistant’s session storage ends the conversation state saved in that tab; it does not close a RUMA account.

7. Changes and contact

If our use of cookies or similar technologies changes, we will update this Notice and its version history. Privacy questions: privacy@ruma.rent. Operator: StatGazer LLC, a New York limited liability company, 418 Broadway, STE R, Albany, NY 12207, USA.