Effective date: June 4, 2026 · Last updated: October 27, 2026
Rouva ("we", "us", or "our") operates the Rouva service at rouva.io and app.rouva.io. This Privacy Policy explains what data we collect, how we use it, and your rights with respect to that data.
By creating an account or using the Rouva service, you agree to the collection and use of information described in this policy.
Account data — When you sign up, we collect your name and email address. When you change your name or email address, we keep a record of the previous and new values, for security and support, until your account is deleted.
User preferences — We store account settings including whether intelligent routing is enabled and any per-provider routing overrides you configure. These are used solely to operate the Service.
Third-party API keys — You may optionally store provider API keys with us (Anthropic, OpenAI, Google Gemini, DeepSeek, Mistral, Moonshot AI, xAI, Alibaba Cloud, Z.ai and MiniMax). These are encrypted at rest using AES-256 and are never logged or exposed in plaintext.
Rouva gateway API keys — When you generate a Rouva gateway key (prefixed rva_), we store a one-way SHA-256 hash of that key for authentication. The raw key is shown to you once at creation and is not recoverable by us.
Usage data — We log metadata about each request routed through the Rouva gateway: token counts, model used, cost, savings, task type and how it was classified (including the classifier's confidence score), quality score, AI judge metadata, message pruning statistics, and request identifiers (including the provider's request ID, for troubleshooting). We do not log the full content of your conversations; the only prompt or response content we retain is described under "Duplicate-request cache" and "Conversation summaries" below.
Classifier cache — To improve routing speed, we temporarily cache a SHA-256 hash of your prompt and its classification result. Entries expire after 24 hours and are deleted by a daily cleanup job, normally within about a day of expiring. No prompt text is stored — only the hash and the resulting task type.
Duplicate-request cache — To avoid charging you twice when a client retries the same request, we keep the most recent response to an identical request (keyed by a one-way hash of the request). It is only reused for 60 seconds; expired entries are often deleted shortly afterwards, and otherwise by a daily cleanup job, normally within about a day of expiring.
Conversation summaries — For long conversations, older turns may be condensed into a short summary before forwarding, to reduce token costs. The summary is generated with your own Anthropic API key (or, for workspace members, the workspace owner's key) and cached for 24 hours, keyed by a one-way hash of the summarized messages. Expired summaries are deleted by a daily cleanup job, normally within about a day of expiring.
Workspaces — If you are invited to and join a workspace, the workspace owner can see your name, email address, join date, month-to-date spend and number of requests, the models you have used, and any spend cap and model allowlist they have assigned to you. Your requests are sent using the workspace owner's provider API keys, so they are processed under the owner's provider accounts. When you approach or reach a spend cap, both you and the owner may be notified by email (sent through Resend, see Section 4), and if the owner has connected Slack or a budget webhook, your name, email address, spend and percentage of cap are posted to the owner's Slack workspace or sent to the owner's webhook endpoint. When an owner invites someone, we store the invitee's email address to send and track the invitation.
Slack webhook — If you connect Slack for budget alerts, we store the Slack incoming-webhook URL you provide. Because the URL grants permission to post to your Slack channel, it is encrypted at rest (AES-256) and kept until you remove it in settings or delete your account.
Budget webhook — If you connect a webhook endpoint for budget alerts, we store its URL and the secret Rouva uses to sign each delivery. Both are encrypted at rest (AES-256) and kept until you remove the webhook in settings or delete your account.
OpenTelemetry export — If you set up an OpenTelemetry export, we store the endpoint URL and the headers you provide (typically an API key for your tracing service), encrypted at rest (AES-256), and kept until you remove the export on the Integrations page or delete your account.
Alert settings — If you configure budget alerts, we store your alert threshold, provider, and the notification email address you specify (which may differ from your account email).
Cookie consent records — When you respond to the cookie consent banner, we record your choice ("essential only" or "accept all"), the timestamp, your IP address, and your browser's user-agent string. This record exists solely to demonstrate that consent was obtained, as required by applicable privacy law. It is not used for profiling or shared with third parties.
Payment data — We do not currently collect payment information. If billing is introduced, it will be handled by a PCI-compliant third-party processor.
Communications and feedback — If you contact us by email or send a bug report or feedback through the dashboard, we retain those messages to respond to you and improve the Service. A report also includes the page you were on, your browser and operating system, the time, and your account email and workspace role, so we can follow up.
We do not sell your personal data or use it to train AI models.
Your account data and usage records are stored in a Supabase-managed PostgreSQL database hosted on AWS infrastructure in the United States. Supabase's data processing practices are described at supabase.com/privacy.
API keys are stored as AES-256 encrypted ciphertext. The decryption key is held in a separate environment variable and is never written to the database.
We share data with the following third parties only to the extent necessary to provide the service:
/api/gateway/run endpoint with tool handlers, Rouva calls the HTTPS endpoints you register and sends them the name and arguments of each tool call the model makes. Those arguments are generated from your prompts and may contain any data in them. These endpoints are chosen and operated by you (or a party you choose), and their own terms and practices apply.We do not share your data with advertisers, data brokers, or any other third parties beyond those listed above.
We use essential cookies for authentication session management (via Supabase Auth). We do not use advertising cookies or tracking pixels.
If you click Accept all on the cookie consent banner, we additionally load Google Analytics to understand how visitors use our website (pages visited, session duration, referral source, device type). Your consent preference is stored in your browser's localStorage under the key rouva_cookie_pref. You can withdraw consent at any time by clearing your browser's site data for rouva.io — the banner will appear again and analytics will not load until you accept.
Account data and usage records are retained for as long as your account is active. If you delete your account, your personal data and stored API keys will be permanently deleted within 30 days. Anonymized aggregate usage statistics may be retained indefinitely.
Google Analytics data is retained per Google's default retention settings (2 months for user-level event data). Cookie consent records (your choice, timestamp, IP address, and user-agent) are retained for 3 years to demonstrate compliance.
Depending on your jurisdiction, you may have the following rights:
To exercise any of these rights, email us at privacy@rouva.io. We will respond within 30 days.
We implement industry-standard security measures including TLS in transit, AES-256 encryption for sensitive credentials, and row-level security on our database. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
Rouva is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@rouva.io.
We may update this Privacy Policy from time to time. We will notify registered users by email when material changes are made. The "Last updated" date at the top of this page indicates when the policy was last revised.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights regarding your personal information.
Categories of personal information we collect:
We do not sell or share your personal information. We do not sell, rent, trade, or share your personal information with third parties for cross-context behavioral advertising or any commercial purpose beyond operating the Service.
Your CCPA rights include:
To exercise your California privacy rights, submit a request to privacy@rouva.io with the subject line "California Privacy Request." We will respond within 45 days as required by law. We may need to verify your identity before processing your request.
If you have questions about this Privacy Policy or your data, contact us at: