Privacy Policy
This policy explains how Ruse processes information to authenticate users, place AI entertainment calls, prevent abuse, fulfill purchases, and provide the media features enabled for each call.
1. Information we collect
Account information
Ruse uses Supabase authentication. New accounts sign in with Google. Accounts created under the earlier phone-login system may continue using a one-time SMS code, but phone login no longer creates new accounts.
Recipient and setup information
When you prepare a call, we process the recipient’s phone number, first name, selected scenario, optional context, and whether recording was enabled. The canonical phone number is stored so you can see and retry recent calls; optional context remains encrypted at rest. The same normalized number is used for rolling frequency limits and opt-out matching.
Call and media information
We process call status, timestamps, duration, provider identifiers, termination reason, transcript events, private live whispers, and queued exact sentences. When the call’s policy and your recording selection permit stored recording, Ruse temporarily receives a Twilio recording and moves it into private Cloudflare R2 storage. The database stores the private object key and waveform data rather than a public recording URL.
Payments, referrals, and technical data
We store credit balances, credit-ledger entries, referral codes and qualifying referral counts, identifiers and details for completed Stripe purchases, pack, amount, currency, status, and timestamps. Stripe processes card and billing details and retains incomplete payment attempts. We also process IP address, a signed device identifier, browser headers, security events, API logs, and rate-limit data. Device and IP values used for free-credit eligibility are stored as keyed hashes.
2. How we use information
- authenticate accounts and determine eligibility for one lifetime free standard prank;
- prepare, place, monitor, transcribe, and end requested calls;
- provide private call history, transcripts, and permitted recordings;
- reserve, settle, return, and sell internal call credits;
- operate the referral program;
- enforce per-target frequency limits, the opt-out list, rate limits, and safety rules;
- detect fraud, diagnose errors, secure the service, and comply with valid legal obligations.
Ruse does not sell personal information, use it for behavioral advertising, or provide public call sharing in the current product.
3. Service providers
Ruse shares only the data needed for each provider to perform its role: Supabase for Google authentication, legacy phone login, and private Postgres hosting; Twilio for legacy SMS login, phone calls, media streaming, and temporary recording capture; ElevenLabs for speech recognition, turn-taking, and synthetic voice; OpenAI for text reasoning; Cloudflare R2 for permitted private recordings; and Stripe for checkout and payment fulfillment.
4. Retention
Account and credit records are retained while the account remains active and as needed for financial, fraud-prevention, and legal obligations. Call metadata, transcripts, security records, and opted-out phone numbers are retained according to the service’s configured policies and legitimate safety needs. Stored recordings expire after the configured recording-retention period unless a legal hold requires longer retention. Twilio’s copy is deleted after verified R2 ingestion where supported.
5. Security
Ruse uses encrypted transport, server-only provider credentials, encrypted call context, authenticated recording URLs with short expirations, authorization checks, webhook-signature verification, rate limits, and a private database schema. No system is perfectly secure, but we work to reduce access and retention to what the service needs.
6. Cookies and local browser storage
Ruse uses the authentication and session storage needed by Supabase and an HttpOnly signed device cookie to enforce lifetime free-credit eligibility. Payment details for optional credit packs are handled by Stripe and are not stored in browser drafts. We do not currently use advertising trackers.
7. Children
Ruse is only for adults aged 18 or older. Users may not target minors. If you believe a minor’s information has been processed, contact us so we can investigate and delete it where appropriate.
8. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information. You may also withdraw consent where consent is the processing basis. To exercise a right, email support@ruse.lol. We may need to verify your identity.
Any recipient can use “Block my number” in the public footer to prevent future Ruse calls. The normalized phone number is retained on the opt-out list.
9. International processing and policy changes
Providers may process data in the United States and other countries where they operate. Applicable transfer safeguards are used where required. We may update this policy when the product, providers, or law changes; the updated date appears above.
10. Contact
Privacy questions and data-rights requests can be sent to support@ruse.lol.