Effective date: June 4, 2026 · Last updated: June 4, 2026
Rouva ("we", "us", or "our") operates the Rouva service at rouva.io and app.rouva.io. This Privacy Policy explains what data we collect, how we use it, and your rights with respect to that data.
By creating an account or using the Rouva service, you agree to the collection and use of information described in this policy.
Account data — When you sign up, we collect your name and email address.
User preferences — We store account settings including your selected baseline model and whether intelligent routing is enabled. These are used solely to operate the Service.
Third-party API keys — You may optionally store provider API keys (Anthropic, OpenAI) with us. These are encrypted at rest using AES-256 and are never logged or exposed in plaintext.
Rouva gateway API keys — When you generate a Rouva gateway key (prefixed rva_), we store a one-way SHA-256 hash of that key for authentication. The raw key is shown to you once at creation and is not recoverable by us.
Usage data — We log metadata about each request routed through the Rouva gateway: token counts, model used, cost, savings, task type, quality score, AI judge metadata, and message pruning statistics. We do not store the full content of your prompts or responses.
Classifier cache — To improve routing speed, we temporarily cache a SHA-256 hash of your prompt and its classification result for up to 24 hours. No prompt text is stored — only the hash and the resulting task type.
Alert settings — If you configure budget alerts, we store your alert threshold, provider, and the notification email address you specify (which may differ from your account email).
Payment data — We do not currently collect payment information. If billing is introduced, it will be handled by a PCI-compliant third-party processor.
Communications — If you contact us by email, we retain those communications to respond to you.
We do not sell your personal data or use it to train AI models.
Your account data and usage records are stored in a Supabase-managed PostgreSQL database hosted on AWS infrastructure in the United States. Supabase's data processing practices are described at supabase.com/privacy.
API keys are stored as AES-256 encrypted ciphertext. The decryption key is held in a separate environment variable and is never written to the database.
We share data with the following third parties only to the extent necessary to provide the service:
We do not share your data with advertisers, data brokers, or any other third parties.
We use only essential cookies for authentication session management (via Supabase Auth). We do not use advertising cookies, tracking pixels, or third-party analytics.
Account data and usage records are retained for as long as your account is active. If you delete your account, your personal data and stored API keys will be permanently deleted within 30 days. Anonymized aggregate usage statistics may be retained indefinitely.
Depending on your jurisdiction, you may have the following rights:
To exercise any of these rights, email us at privacy@rouva.io. We will respond within 30 days.
We implement industry-standard security measures including TLS in transit, AES-256 encryption for sensitive credentials, and row-level security on our database. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
Rouva is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@rouva.io.
We may update this Privacy Policy from time to time. We will notify registered users by email when material changes are made. The effective date at the top of this page indicates when the policy was last revised.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights regarding your personal information.
Categories of personal information we collect:
We do not sell or share your personal information. We do not sell, rent, trade, or share your personal information with third parties for cross-context behavioral advertising or any commercial purpose beyond operating the Service.
Your CCPA rights include:
To exercise your California privacy rights, submit a request to privacy@rouva.io with the subject line "California Privacy Request." We will respond within 45 days as required by law. We may need to verify your identity before processing your request.
If you have questions about this Privacy Policy or your data, contact us at: