Privacy

RUMAE is a Personal Financial Operating System for a household. It records accounts, transactions, budgets, commitments, pay cycles, goals and plans that you enter, and it produces analysis, forecasts, suggestions and coaching from that information.

RUMAE does not connect to your bank. It cannot transfer, move, borrow or spend money. All information in RUMAE is information you or another member of your household put there.

• Account credentials handled by our authentication provider: email address and a hashed password. RUMAE never stores your password.
• Profile information: display name and locale.
• Household information: household name, base currency, timezone, membership and role.
• Financial records you enter: accounts, balances, transactions, categories, budgets, commitments and pay cycles.
• Derived records the product generates from the above: classifications, forecasts, opportunities, goals, goal health, behaviour signals, decisions and coaching items.

Solely to operate the product for you: to show your household’s position, run the payday journey, produce forecasts and scenarios, track goals, evidence behaviour patterns and offer coaching suggestions. RUMAE does not sell information and does not use your financial records for advertising.

Financial records belong to the household, not to an individual member. Any active member of a household can read that household’s shared financial records, subject to their role (OWNER, ADMIN, MEMBER or VIEWER).

Records that RUMAE treats as member-private — including private goals, behaviour signals and coaching items scoped to one member — remain visible only to that member. Ending a membership removes access to the household’s records.

Data is held in a managed PostgreSQL database. Every table enforces row-level security, so a request can only read rows belonging to a household the signed-in user is an active member of. All writes go through server-side routines that re-check membership and role. Privileged database credentials are never present in the browser.

Requires review: Sub-processor disclosure, international transfer basis and the lawful basis statement require owner and legal confirmation before public launch. This section states the product behaviour that can be verified in the RUMAE codebase. Final legal wording requires owner and legal review before public launch.

Closing your account permanently deletes your authentication identity and ends your access. Your retained profile is de-identified and tombstoned, active memberships end and active local entitlements are revoked. RUMAE does not automatically cancel or change a Stripe subscription or customer record.

Shared household records remain for legitimate surviving members. Historical customer-private records and required append-only financial, membership, invitation, entitlement and operational evidence may also be retained so lifecycle history remains auditable. Account closure therefore does not mean universal physical erasure of every historical record.

When signed in you can download your personal account summary. An active household OWNER can also download the complete permitted household JSON export. The export excludes other members’ private records, invitation secrets, authentication internals and commercial records. Account closure is started from the same Account and data page and is blocked if it would strand a household without an OWNER.

Requires review: The statutory rights list, response deadline and supervisory-authority complaint route require owner and legal confirmation before public launch.

Privacy, data access and deletion requests: privacy@rumae.example.

Requires review: This contact address is a placeholder. The production mailbox must be established and confirmed by the owner before public launch.