Runi is built on one boundary: your machine decides what leaves it. Ignore rules and secret redaction run on your own computer before anything is shared, an ignored file is never even named, and each person chooses how much of their prompts, their agent’s work and its reasoning reaches the team. This policy explains what we do process, why, and your rights under the UK GDPR, the EU GDPR and similar laws. It covers this website, the sign-in pages at platform.tryruni.com, and the Runi product (the desktop app, its local daemon and the hosted service, together the “Service”).
Who we are
Runi (“we”, “us”) is the controller for the personal data described in this policy, except workspace content, where your organisation is the controller and we are its processor. Data protection contact: [email protected].
What we process
- Waitlist data: the email address you give the waitlist form. We use it to invite your team to Runi when your spot comes up, and for nothing else.
- Website data: our hosting providers keep ordinary server logs (IP address, user agent, requested page) for security and operations. This website runs no analytics and loads no third-party fonts or scripts.
- Account data: your email address, name, optional job title and picture, sign-in method and sign-in metadata.
- Billing data: your billing name and email, country, any tax or VAT identifier, the plan and number of seats on your subscription, and invoice history. Card details are entered directly with Stripe; we never see or store them, and receive only the card brand, its last four digits and the outcome of a charge.
- Workspace content: what the daemons of your team’s members share after local redaction. That is the sessions their agents run (which agent, which repository and branch, which files were touched, and, as far as each member’s own settings allow, what was asked, what was run and what the agent replied), the cards, decisions, discoveries and blockers recorded from them, notes, handoffs, and the repository names they reference. Your organisation is the controller; we process it on your behalf. A data processing agreement is available when paid plans open.
- Invitation data: the email addresses you invite, used only to deliver and redeem the invitation.
What we deliberately do not collect: your repositories or their history, files your agents did not touch, secrets matched by the redaction patterns, files your ignore rules exclude, your agents’ reasoning unless you choose to share it, and full card numbers.
What each member controls
Every member sets, on their own computer, how much of their sessions the team sees: their prompts in full, as a one-line summary, or not at all; whether session detail (files changed, commands run, agent replies) is shared or kept on their computer; and whether their agent’s reasoning is shared in full, as a length only, or not at all, which is the default. What a member keeps local never reaches us.
Why we process it (legal bases)
- Contract: operating accounts and workspaces, synchronising workspace content, sending invitations, taking payment for a subscription you started, and contacting you about it.
- Legal obligation: keeping invoices and tax records for the period the law requires.
- Legitimate interest: securing the Service and the website, and preventing abuse.
- Consent: joining the waitlist, or connecting an optional integration such as the Runi GitHub App. You can withdraw consent at any time.
Cookies
This website sets no cookies and runs no analytics or advertising trackers, which is why there is no cookie banner. Stripe sets the cookies it needs for fraud prevention when a checkout page is opened, under its own policy. Signing in stores your session in your browser, on platform.tryruni.com only.
Who touches it
- Supabase: hosting, authentication, database and realtime for the Service and the waitlist, in the United States (US East, Northern Virginia).
- Resend: account, invitation and service email.
- Stripe: payments, subscriptions and invoices; Stripe is an independent controller for the payment data it collects.
- Cloudflare: hosting for the sign-in pages at platform.tryruni.com.
- Our web host, in Frankfurt, Germany: hosting for this website.
- GitHub: if your organisation installs the Runi GitHub App, it reads repository names and pull-request metadata and posts comments on pull requests. It is given no access to your code.
We do not send your content to any AI model provider. Where Runi uses a model, for example to write a brief, it runs through the agent command-line tool you already use, on your own computer, under your own agreement with that provider. We do not sell personal data, and we do not use your content to train models.
International transfers
Account, workspace and waitlist data are stored in the United States. Where personal data leaves the UK or the EEA, including for that storage, the transfer rests on an adequacy decision where one applies, or on the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum.
Retention
- Activity events are deleted after 90 days, finished sessions after 30 days, and notes between people after a year.
- Cards, decisions and other records stay until you delete them or the workspace; finished cards are archived and then removed on the schedule your workspace chooses.
- When a workspace is deleted, its content is deleted with it. When you delete your account, your account data is deleted, except what the law requires us to keep.
- Invoices and the billing records behind them are kept for as long as tax law requires, which can outlive the account.
- Waitlist addresses are kept until Runi opens and we have told you, or until you ask us to remove yours; one line to [email protected] does it.
Security
Every workspace table is protected by row-level security scoped to membership, checked by an adversarial test suite, and access ends the moment membership does. Data is encrypted in transit. Secrets are never shipped to the client, and redaction happens before anything leaves your computer: defence in depth, not a promise that every possible secret format is caught. No internet service can guarantee perfect security. More, and how to report a vulnerability, is on our security page.
Your rights
You can ask to access, correct, delete, restrict or port your personal data, object to processing, and withdraw consent where processing rests on it. You can also complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority where you live or work. For workspace content we will pass your request to your organisation, the controller. Write to [email protected]; we answer within one month.
Children
Neither the website nor the Service is intended for anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
Other sites
This site links to services we do not control, such as GitHub, Stripe and the coding agents Runi works with. Their privacy policies, not this one, govern what they do.
Changes
Material changes to this policy are announced on this page, and in the app, before they take effect.