Privacy policy

The short version

Rulebound collects the minimum it needs to run a reading and writing product: your account email, the things you create, and anonymous-by-default usage telemetry. We count visits ourselves, on our own servers, without cookies and without following you between sites. We don't sell your data, we don't profile you for advertising, and your private drafts stay private. The one advertising-related thing we do — counting whether our own ads led to a signup — happens only if you say yes to it.

What we collect

• Account details — your email address and a password (stored by our authentication provider, Supabase; we never see the password itself).
• Things you create — rule books, chapters, rules, reviews, reading progress, bookmarks, notes, trails, packs, and similar content. Private items are only visible to you; published books are public by your choice.
• Newsletter subscription — your email, if you subscribe. Every email includes a one-click unsubscribe link.
• Support messages — what you send through the contact form, so we can reply.
• Usage telemetry — performance and error data (via Azure Application Insights) so we can find and fix problems. This is operational data, not an advertising profile.
• Visit counts — which pages were viewed and which link brought you, kept on our own servers without cookies. See “Visit measurement” below.

AI features

When you use an AI-assisted feature (drafting a book, Lens, repro review, cover art), the content you provide for that feature is sent to Anthropic's API to generate the result. We only send what the feature needs, and we don't use your content to train models.

Cookies

We use first-party cookies for one thing: keeping you signed in. The only third-party cookie we ever set is Google's ad-measurement cookie described below — and only with your consent.

Advertising measurement

We run ads on Google to help people find Rulebound, and we'd like to know whether they work. If you accept the consent banner, a Google tag counts conversions — for example, that a visit from an ad led to an account being created. We have ad personalization disabled: this is arithmetic about our ads, not a profile of you.

If you decline (or never answer), the tag stays in its no-cookies mode and nothing is stored on your device for advertising. You can change your mind by clearing this site's data in your browser, which brings the banner back.

Visit measurement

We count visits ourselves so we can tell which pages are working — for example, whether people who arrive on a landing page go on to create an account. This runs on our own servers and stays in our own database: no cookie, nothing stored on your device, no third party involved, and no consent banner needed for it.

What we record for a page view is the page's address, the site you came from (the domain only), any campaign tags on the link, and whether the screen was phone-sized. To tell one visit's pages apart from another's we store a scrambled code made from your IP address, your browser's user-agent, and today's date — we can't reverse it into your IP address, and it changes every day, so it can't follow you.

Where your data lives

Content and account data are stored with Supabase (hosted in Canada); the application runs on Microsoft Azure. Both providers act as data processors on our behalf.

Your choices

• You can edit or delete your content at any time.
• You can unsubscribe from the newsletter with one click.
• To delete your account and its data, contact usand we'll take care of it.

Questions

Anything unclear, or a request we haven't covered? Get in touch. If this policy changes materially, we'll note it on the Updates page.