Privacy Policy

Last updated: February 2026

What we collect

When you register an account, we store:

• Your SSH public key and its fingerprint (used for authentication)
• An optional username you choose

When you push sessions or plans, we store:

• Session data — compressed conversation transcripts
• Plan data — markdown documents with version history
• Metadata: titles, privacy settings, expiration dates, timestamps

Secret redaction

All secret redaction happens client-side — the CLI and macOS app strip secrets (API keys, tokens, passwords) from session data before uploading it to the server. The server stores exactly what it receives; it does not apply its own redaction. You are responsible for reviewing your redaction rules and avoiding sharing sessions that contain sensitive information.

How data is stored

• All data is stored in a database on the server
• Session transcripts are compressed to reduce storage
• Plan versions are stored with version history on the server
• The database is backed up to an encrypted cloud storage provider (Backblaze B2) for disaster recovery

Data retention

Sessions and plans can have expiration dates set at push time. Expired content is automatically deleted by a periodic cleanup process. Content without an expiration date is retained until you delete it.

Data deletion

You have full control over your data:

• Individual items — delete any session or plan at any time via the CLI
• Entire account — run rn account destroy to irrevocably delete your account and all associated data (sessions, plans, keys, username)

Third-party services

We do not use any third-party services. Fonts are self-hosted. We do not use analytics, tracking pixels, or advertising services. Your browser makes no requests to external domains when viewing this site.

Cookies and local storage

We do not set any cookies. Your theme preference (light/dark) and reaction mute state are stored in your browser's localStorage and are never sent to the server.

Server logs

Standard request logs (IP address, HTTP method, path, status code, response time) are recorded for operational purposes. These logs are not used for user tracking and are rotated periodically.

Contact

Questions about this policy? Email contact@rockstar.ninja.