Privacy Policy

Collected Data

Data Usage

Mobile Apps (iOS and Android)

The Rubu mobile apps (iOS; Android later) use the same account as the web. Data processed in the app: your account data (email, name), organization and calendar data, and the events, categories, and locations you create.

Push Notifications and Device Data

Push notifications are delivered through Google Firebase Cloud Messaging (FCM) and the Apple Push Notification service (APNs). For this purpose we store a device push token together with device model, OS version, app version, locale, and timezone, linked to your account and organization. This data is used solely to deliver notifications to you. The device token is deactivated when you log out.

Notification Preferences

Event notifications and reminders are sent only for Pro organizations; you can turn notification types off in Settings > Notifications and in iOS settings. Quiet hours are supported. Marketing or announcement notifications are sent only with your separate explicit opt-in, are off by default, and can be revoked at any time in Settings > Notifications.

Email Notifications

Emails are not sent for events. Emails are sent only for essential actions such as password reset and invitations.

Data Stored on Your Device

The mobile app keeps a local cache of your calendar data on the device for speed and offline use. Session tokens are stored in the iOS Keychain. The cache is removed when you log out or delete the app.

Advertising and Tracking

The mobile app contains no advertising and no third-party tracking or analytics SDKs. Your data is not sold and no cross-app tracking is performed (App Tracking Transparency is not used).

Data Security

All data is stored encrypted and transmitted over secure connections (HTTPS). Cross-organization data access is not possible. Each organization operates in isolation.

Data Sharing

Your data is not shared with third parties for marketing purposes. It may only be shared with authorities in case of legal obligation.

Service Providers

To deliver the service we rely on: Railway for hosting, Google Firebase and Apple (APNs) for push notifications, an email service provider for password reset and invitation emails, and (only if you connect them) Google Meet and Zoom for online meetings. These providers process data only to provide the service.

Online Meetings and Connected Accounts (Google, Zoom)

If you use online meetings, you connect your own Google or Zoom account to Rubu. From Google we request only the "manage Meet meetings created by Rubu" permission (meetings.space.created) and your account email address; from Zoom, permission to create/delete meetings and your account email address. These permissions are used only to create a meeting link for an event at your request and to delete the Zoom meeting when the event or meeting is removed. Access and refresh tokens are stored encrypted (AES-256-GCM) on our servers; we do not read your calendar, email, contacts, meeting recordings or participant information. The meeting link is shown only to signed-in members of that calendar; it never appears on public pages or in the calendar subscription feed. This data is not used for advertising, is not sold and is not shared with third parties. You can disconnect at any time under Settings > Connected accounts; disconnecting deletes the tokens and revokes access at the provider. Deleting your account also deletes the connections. Rubu's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

Rubu uses essential cookies for session management. No third-party cookies for advertising or tracking are used.

Data Retention

Your account data is retained as long as your account is active. When your account is deleted, your data is permanently removed within a reasonable time.

Account Deletion

You can delete your account in the mobile app under Settings > Account > Delete account, or via the web; deletion is immediate and permanent. Organization owners can delete the organization from the same area.

Your Rights

• Request access to your data
• Request correction of your data
• Request deletion of your data
• Object to data processing