privacy

Last updated: February 2026

1. What we collect

We collect your email address for authentication, your encrypted R2 credentials for connecting to your storage, and basic account metadata (subscription status, account creation date).

2. What we don't collect

We do not store your files. Your files live in your own Cloudflare R2 bucket. We do not use analytics trackers, advertising cookies, or third-party tracking scripts.

3. How we use your data

Your email is used to send login codes and important account notifications. Your R2 credentials are encrypted at rest and used only to connect to your storage on your behalf.

4. Third parties

We use Resend for transactional email and Stripe for payment processing. We do not sell or share your data with anyone else.

5. Data storage

Account data is stored on Cloudflare D1. R2 secret keys are encrypted with AES-256-GCM before storage. Sessions expire after 30 days.

6. Data deletion

You can delete your account and all associated data from the settings page at any time. This removes your email, credentials, sessions, and subscription data. Files in your R2 bucket are not affected.

7. Changes

We may update this policy. Material changes will be communicated via email or an in-app notice.

For questions, contact us at support@rooty.org.