Cookie Notice

1. Scope

This Cookie Notice explains how StatGazer LLC uses cookies and similar browser-storage technologies on the RUMA public website and the authenticated account pages at ruma.rent. It does not apply to third-party websites, or to separate services that publish their own notices.

2. Cookies and storage RUMA uses

RUMA uses one first-party cookie — an authentication cookie set after you sign in:

The cookie holds a signed session token — a reference to your server-side session and your account ID, with an expiry. It does not contain your password. It is set HttpOnly (page scripts cannot read it) and, in production, Secure and SameSite=Lax.

RUMA also keeps a small amount of functional information in your browser’s local storage — your chosen interface language and whether you have dismissed certain first-run tips — and holds an anti-CSRF security token in memory only for the duration of a page visit. These are first-party, do not identify you across sites, and are not used for tracking.

RUMA Assistant storage. When the Assistant is available, dismissing a desktop teaser will write one first-party localStorage boolean with no timestamp, account, session, or analytics identifier; it will remain until you clear site data. Conversation storage will start only if you select Start chat after the chat identifies itself as AI and gives its privacy notice. It will use first-party, tab-scoped sessionStorage for a random, opaque Assistant session reference and the recent state needed to continue that requested chat. This is functional storage, not advertising, tracking, or product analytics, and can be cleared in browser settings.

RUMA does not use advertising cookies, cross-site tracking cookies, session-replay technologies, or third-party trackers on RUMA pages — and that is not changing. RUMA has announced first-party product analytics, which is not yet active: today no analytics identifier is stored and no analytics events are collected. When it activates — region by region, only as applicable law permits, and with consent asked first where required — analytics will use first-party local storage only (a random analytics identifier and first-party campaign attribution), never third-party cookies, and always subject to the analytics preference below.

3. Your analytics preference (GPC, DNT, opt-out)

RUMA treats three signals as one analytics preference, honored from the day analytics activates:

• Global Privacy Control — a browser sending Sec-GPC: 1 is treated as opted out of product analytics.
• Do Not Track — a browser sending DNT: 1 is treated the same way.
• Manual opt-out — an explicit RUMA analytics opt-out, available when analytics activates.

Opting out means: product-analytics collection stops; the local analytics identifier and stored first-party campaign attribution are removed; no analytics pseudonym is generated for new events; and the identifier is not silently recreated while the preference holds. If analytics events were already delivered to the analytics processor, RUMA carries a deletion obligation through to it — see the Privacy Notice.

The preference governs product analytics only. The strictly necessary or requested functional storage above (the authentication cookie, your language choice, the in-memory security token, and any Assistant functional storage created only after a future reactivation as described above) and the security, fraud-prevention and reliability logging that keep the Service running are not affected by it.

4. Why RUMA does not show a consent banner

The authentication cookie is strictly necessary to provide the signed-in service you request: without it, RUMA cannot keep you authenticated or maintain your account session.

Because RUMA does not currently use non-essential cookies or similar technologies on RUMA pages, we do not display a sitewide cookie consent banner today. The Assistant uses the content-free teaser preference and requested, tab-scoped conversation storage disclosed above. Its separate pre-chat notice andStart chat action precede chat recording and provider processing.

The announced first-party analytics described above is non-essential: it will activate only region by region as applicable law permits, consent will be asked first where an applicable rule requires it, and the analytics preference above — including Global Privacy Control and Do Not Track — will be honored everywhere. This Notice will be versioned again when analytics activation begins.

5. Payment provider

When you choose to purchase a RUMA subscription, you may be redirected to a checkout page and billing portal hosted by our payment provider, Stripe. Stripe may use cookies and similar technologies on its own pages for security, fraud prevention, authentication, and other purposes described in Stripe’s own notices. RUMA does not control the cookies Stripe sets on Stripe-hosted pages. The providers that process data to run the Service are listed on our Subprocessors page.

6. Managing browser storage and the authentication cookie

You can browse RUMA’s public pages without the authentication cookie. Blocking or deleting it will prevent you from staying signed in and using authenticated account features; deleting it signs you out. You can manage cookies, local storage, and session storage through your browser settings at any time. Clearing Assistant session storage ends only the state saved in that tab and does not close a RUMA account. Server-side conversation records follow the retention and deletion rules in the Privacy Notice.

7. Changes and contact

If our use of cookies or similar technologies changes, we will update this Notice and its version history. Privacy questions: privacy@ruma.rent. Operator: StatGazer LLC, a New York limited liability company, 418 Broadway, STE R, Albany, NY 12207, USA.