Cookie Notice

1. Scope

This Cookie Notice explains how StatGazer LLC uses cookies and similar browser-storage technologies on the RUMA public website and the authenticated account pages at ruma.rent. It does not apply to third-party websites, or to separate services that publish their own notices.

2. Cookies and storage RUMA uses

RUMA uses one first-party cookie — an authentication cookie set after you sign in:

The cookie holds a signed session token — a reference to your server-side session and your account ID, with an expiry. It does not contain your password. It is set HttpOnly (page scripts cannot read it) and, in production, Secure and SameSite=Lax.

RUMA also keeps a small amount of functional information in your browser’s local storage — your chosen interface language and whether you have dismissed certain first-run tips — and holds an anti-CSRF security token in memory only for the duration of a page visit. These are first-party, do not identify you across sites, and are not used for tracking.

RUMA Assistant is disabled for public use during its announced Workers AI/Qwen provider migration. Public production currently writes no Assistant teaser or conversation storage. Controlled, access-restricted staging validation may write test-only browser and conversation state. If the owner later activates the public Assistant, dismissing a desktop teaser will write one first-party localStorage boolean with no timestamp, account, session, or analytics identifier; it will remain until you clear site data. Conversation storage will start only if you select Start chat after the chat identifies itself as AI and gives its privacy notice. It will use first-party, tab-scoped sessionStorage for a random, opaque Assistant session reference and the recent state needed to continue that requested chat. This is functional storage, not advertising, tracking, or product analytics, and can be cleared in browser settings.

RUMA does not use advertising cookies, cross-site tracking cookies, session-replay technologies, or third-party trackers on RUMA pages — and that is not changing. RUMA has announced first-party product analytics, which is not yet active: today no analytics identifier is stored and no analytics events are collected. When it activates — region by region, only as applicable law permits, and with consent asked first where required — analytics will use first-party local storage only (a random analytics identifier and first-party campaign attribution), never third-party cookies, and always subject to the analytics preference below.

3. Your analytics preference (GPC, DNT, opt-out)

RUMA treats three signals as one analytics preference, honored from the day analytics activates:

• Global Privacy Control — a browser sending Sec-GPC: 1 is treated as opted out of product analytics.
• Do Not Track — a browser sending DNT: 1 is treated the same way.
• Manual opt-out — an explicit RUMA analytics opt-out, available when analytics activates.

Opting out means: product-analytics collection stops; the local analytics identifier and stored first-party campaign attribution are removed; no analytics pseudonym is generated for new events; and the identifier is not silently recreated while the preference holds. If analytics events were already delivered to the analytics processor, RUMA carries a deletion obligation through to it — see the Privacy Notice.

The preference governs product analytics only. The strictly necessary or requested functional storage above (the authentication cookie, your language choice, the in-memory security token, and any Assistant functional storage created only after a future reactivation as described above) and the security, fraud-prevention and reliability logging that keep the Service running are not affected by it.

4. Why RUMA does not show a consent banner

The authentication cookie is strictly necessary to provide the signed-in service you request: without it, RUMA cannot keep you authenticated or maintain your account session.

Because RUMA does not currently use non-essential cookies or similar technologies on RUMA pages, we do not display a sitewide cookie consent banner today. The Assistant is disabled and writes no Assistant browser storage. If it is reactivated, its content-free teaser preference and requested, tab-scoped conversation storage will work only as disclosed above; the separate pre-chat notice and Start chataction will precede chat recording and provider processing.

The announced first-party analytics described above is non-essential: it will activate only region by region as applicable law permits, consent will be asked first where an applicable rule requires it, and the analytics preference above — including Global Privacy Control and Do Not Track — will be honored everywhere. This Notice will be versioned again when analytics activation begins.

5. Payment provider

When you choose to purchase a RUMA subscription, you may be redirected to a checkout page and billing portal hosted by our payment provider, Stripe. Stripe may use cookies and similar technologies on its own pages for security, fraud prevention, authentication, and other purposes described in Stripe’s own notices. RUMA does not control the cookies Stripe sets on Stripe-hosted pages. The providers that process data to run the Service are listed on our Subprocessors page.

6. Managing browser storage and the authentication cookie

You can browse RUMA’s public pages without the authentication cookie. Blocking or deleting it will prevent you from staying signed in and using authenticated account features; deleting it signs you out. You can manage cookies, local storage, and session storage through your browser settings at any time. The disabled Assistant creates no current conversation state; if it is reactivated, clearing its session storage will end only the state saved in that tab and will not close a RUMA account.

7. Changes and contact

If our use of cookies or similar technologies changes, we will update this Notice and its version history. Privacy questions: privacy@ruma.rent. Operator: StatGazer LLC, a New York limited liability company, 418 Broadway, STE R, Albany, NY 12207, USA.