Privacy policy
Rumi ยท Updated 12 November 2026
Rumi is run by Snor Ltd ("we"). It helps you learn Indonesian by reading stories and looking up words. This page says what we keep about you, why, and how to get rid of it.
The short version
- We keep your email address, sign-in details, and your learning: the words you look up, your lists, quiz results and settings.
- If you choose Google or Apple sign-in, we receive your provider account ID and verified email address, including an Apple private relay address if you choose Hide My Email. We do not receive your Google or Apple password.
- No ads. No tracking across other apps or sites. We do not sell your data.
- You can delete your account, and everything personal in it, inside the app: Settings, then Close your account.
What we collect
- Account: your email address, your password if you use one (kept only as a one-way hash), or your Google or Apple account ID, and the date you joined.
- Profile: a display name and an avatar, if you choose them.
- Your learning: the words you look up, your Learning and Learned lists, custom lists, quiz answers and scores, stories you have finished, your reading positions, and your settings (such as haptics and appearance).
- Sign-in: a cookie that keeps you signed in for 30 days. On our server it is stored only as a hash.
- Technical: your IP address, used briefly to slow down repeated sign-in attempts. Our hosting provider may also record ordinary request logs.
- Waiting list: if you join it on our website before you have an account, your email address and any answers you choose to give (your phone type, your level, how often you study and why you are learning). We use them to tell you when Rumi launches and to choose early testers, and keep them until you ask us to remove them.
- Bug reports: only if you send one. It opens your own email app with your app version, phone model and system version filled in, and we then see your email address and whatever you write.
How we use it
To run Rumi: sign you in, show your lists, schedule reviews, keep your progress, protect the service from abuse, and fix bugs. We do not use your data for advertising or build advertising profiles.
Where the law asks for a legal basis: we use your data to give you the service you signed up for, and to keep it secure.
Who else handles it
- An AI provider (currently OpenAI). When you look up a new word, only that word is sent, to write its word card. Your email and everything else about you stay with us.
- Railway hosts the app and its database.
- Zoho ZeptoMail delivers the emails we send: the code that confirms your email address when you sign up, and the link when you ask to reset your password.
- Cloudflare stores private database backups, and serves the story pictures.
- Apple and Google run the app stores and, if you choose their sign-in buttons, authenticate your account under their own privacy policies.
A word card says nothing about who asked for it. We keep word cards and spelling corrections so the next person who looks up the same word gets it at once, and they stay after an account is closed.
Our providers may handle data in other countries, including the United States.
On your phone
Rumi keeps copies of your lists and stories on your device so it works without a connection. Signing out clears temporary account downloads and keeps your reading state and pending saves for the same account's next sign-in. Another account cannot use them. Closing your account removes its device records; uninstalling or clearing application data also removes device copies, including any changes that have not reached the server.
How long we keep it
For as long as your account exists. Closing it deletes your account, lists, study history, settings and usage records straight away. We keep a daily backup of the database for 30 days, so a closed account is gone from every backup within 30 days.
Sign-in challenges expire after ten minutes, email confirmation codes after thirty minutes, and password reset links after an hour, and are removed during authentication or routine maintenance. We do not keep Google or Apple access or refresh tokens in the database. Apple authorization is revoked when you close an Apple account in the app.
Your choices
You can see and change your lists, display name, avatar and settings in the app, and delete your account in Settings.
Depending on where you live, you may also have the right to ask for a copy of your data, to have it corrected or deleted, to object to how it is used, or to complain to your data protection authority. Email us and we will answer within a month.
Security
Rumi talks to our servers over HTTPS. Passwords and sign-in tokens are stored hashed, and repeated wrong passwords are blocked for a while. No service is perfectly secure, but we take care with yours.
Children
Rumi is not meant for children under 13 and we do not knowingly collect their data. If you think a child has an account, email us and we will delete it.
Changes
If this policy changes in a way that matters, we will update the date at the top and tell you in the app.
Contact
Snor Ltd, a company registered in England and Wales (company number 17458266), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
Questions, or a request about your data: support@learnwithrumi.com