Privacy Policy

Last updated: July 19, 2026

Your Privacy Matters

Your coaching sessions are confidential. We do not sell your personal data or session content, and we never use it for advertising. To operate Rumi, we share the minimum necessary data with the service providers listed below — solely so they can provide their service to us.

What We Collect

  • Account information (email, name, phone number) for authentication
  • Session transcripts and coaching data to provide personalized follow-ups
  • Usage data (session frequency, feature usage) to improve the product
  • Phone number (if provided) for SMS-based sign-in, session reminders, and account alerts

What We Don't Do

  • We do not sell your data
  • We do not use your session content for advertising
  • We do not share identifiable data with other users
  • We do not sell, rent, or share your phone number for marketing purposes
  • We do not read your sessions — human access is limited to support you request and the narrow safety exception described below

Who Can See Your Conversations

In the normal operation of Rumi, no one at Rumi reads your sessions. Your conversations are processed by automated systems — the AI that coaches you, and the systems that generate your session summaries and follow-ups. If you connect a human coach, you control which of your AI-session summaries and themes they can see. Sessions you hold with that coach directly — including recorded Zoom calls, where enabled — are part of your work together and are available to you and that coach. Our support team may access specific content only when you ask for help and give explicit permission.

There is one deliberate exception: safety. If our systems or a session summary indicate that someone may be at serious risk of harm — to themselves or to others, such as a risk of suicide — our safety guidelines permit trained personnel to review the relevant summary and act on it. That can mean surfacing crisis resources or, in urgent cases where permitted or required by law, contacting emergency services. Access under this exception is limited to what is necessary to help, and it exists for one reason: to protect people.

Service Providers That Process Your Data

To power your coaching sessions, we share the minimum necessary data with a small set of service providers (“subprocessors”) under agreements that prohibit them from using your data for anything other than providing their service to Rumi:

  • OpenAI — processes your voice audio and conversation content in real time to generate your coach's responses during voice and text sessions. Not used to train OpenAI's models.
  • LiveKit — provides the real-time audio infrastructure that carries your voice between your device and our coaching service.
  • Google Cloud / Gemini — hosts our backend and serves as a fallback real-time voice model, under the same no-training protections.
  • AWS Bedrock (Anthropic Claude) — generates session summaries and, where a coach enables it, draft notes from session transcripts; processed transiently and not used for model training.
  • Supabase — stores your account, session history, and preferences, encrypted at rest.
  • Stripe — processes payments; Rumi never sees your full card details.
  • PostHog — product analytics. Receives a stable, pseudonymous user identifier and in-app usage events (which features you use, not your conversation content) so we can understand product usage and improve Rumi. Not used for advertising.
  • Resend — delivers transactional email such as session invitations and coach notifications; processes the recipient's email address and the contents of those messages.

We do not sell your data, and no subprocessor may use it for advertising or to train generalized AI models.

SMS & Phone Data

If you sign up with a phone number or opt in to SMS notifications, we collect and use your phone number for the following purposes:

  • Sending one-time verification codes (2FA) for account security
  • Delivering session reminders and coaching check-ins
  • Responding to customer care messages you send to our number

Your phone number is stored securely and is never shared with third parties for their marketing purposes. You can opt out of SMS at any time by replying STOP to any message. Message and data rates may apply. See our SMS Messaging Terms for full details.

Third-Party Integrations (Google Calendar & Zoom)

If your coach connects their Google Calendar or Zoom account, Rumi accesses only the data needed to schedule sessions and bring your session recordings into your coaching workspace. These connections are optional and can be disconnected at any time.

Google Calendar

  • We use the Google Calendar API (the calendar.app.created scope) solely to create, update, and cancel calendar events for coaching sessions your coach schedules, and to read attendee RSVP status for those events. Events live on a dedicated app-created calendar; this scope cannot read or modify your primary calendar.
  • We store only the calendar event identifier and OAuth tokens (encrypted at rest). We do not read, store, or index any other events on your calendar.

Zoom

  • We use Zoom to create scheduled meetings for your sessions and, when your coach enables it, to ingest a session's cloud recording — audio and transcript — via Zoom's recording notifications.
  • Recording audio is held in private, access-controlled storage and transcripts as text, visible only to you and your coach. We never sell recordings or transcripts or share them with other users.
  • When your coach enables AI draft notes for a recording, that session's transcript is sent to our AI provider (AWS Bedrock, running Anthropic Claude models) solely to generate draft notes for your coach. It is processed transiently for that purpose and is not used to train any AI or machine-learning models.
  • Recordings and transcripts are retained until you or your coach delete them, your coach disconnects Zoom, the app is removed from Zoom, or your account is closed. Disconnecting Zoom in Settings, or removing Rumi from the Zoom Marketplace, deletes the stored tokens and the ingested recordings and transcripts.

Rumi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google or Zoom data for advertising, and we do not use it to train generalized AI or machine-learning models.

Data Security

Your data is encrypted in transit and at rest. We use enterprise-grade infrastructure on Google Cloud Platform with industry-standard security practices.

Your Data Rights

You have the right to access, correct, export, and delete your personal data, and to withdraw consent for optional integrations at any time. To exercise any of these rights, email support@rumi.team.

For connected integrations (Google Calendar and Zoom), disconnecting them in Settings → Integrations immediately revokes Rumi's access and deletes the associated tokens and recordings.

Data Deletion

You can request deletion of your account and all associated data at any time by contacting us at support@rumi.team.

Contact

Questions about this policy? Email us at support@rumi.team.