Last updated: 17 July 2026
This policy explains how the Rhumi mobile app ("Rhumi", "we", "us") collects, uses, and protects your personal data, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The data controller responsible for your personal data is Mubin, based in the United Kingdom. You can contact us about privacy at privacy@rhumi.app.
We only collect what the app needs to work. We do not use any advertising, analytics, or cross-app tracking technologies, and we do not sell your data.
| Data | Purpose | Lawful basis (UK GDPR) |
|---|---|---|
| Account email & password (stored only as a secure hash), or your Apple ID if you use Sign in with Apple | Create and secure your account; sign you in | Performance of a contract (Art. 6(1)(b)) |
| Your reflections/journal entries, saved verses, mood check-ins, and preferences (intentions, reminder time) | Provide the app and back up / sync your content across your devices | Performance of a contract (Art. 6(1)(b)) |
| Content you type into the AI companion ("Reflect" / "Ask") chat | Generate a response to your message | Performance of a contract (Art. 6(1)(b)); see §4 |
| Data that reveals religious beliefs (e.g. your reflections and spiritual check-ins) | Provide the core purpose of the app | Your explicit consent (Art. 9(2)(a)), given when you create an account |
| Reports you submit about an AI response | Review and improve safety of the AI | Legitimate interests (Art. 6(1)(f)) — app safety |
We do not collect your location, contacts, photos, advertising identifier, or any device tracking identifier. Notifications are scheduled locally on your device.
Most of your content is stored on your device. If you are signed in, your reflections, saved verses, moods, and preferences are also stored on our servers so they sync across your devices and survive a phone change. Our servers are hosted on Amazon Web Services in the EU (Ireland / eu-west-1) region.
When you use the chat, the text of your message (and a short window of recent chat context) is sent to our server and then to our AI provider, Anthropic PBC, to generate a reply. This means content you type into the chat is processed by a third party. We do not send your other data (journal entries you haven't shared into the chat, moods, saved verses) to the AI. The app never invents scripture — verses are shown from a fixed, vetted library.
Messages that suggest a crisis or risk of harm are handled by a fixed, human-written safety response and are not used to generate AI content.
We share data only with providers that process it on our behalf, under contract:
Where a provider is outside the UK/EEA (e.g. Anthropic in the United States), the transfer is protected by appropriate safeguards such as the International Data Transfer Agreement or Standard Contractual Clauses.
We keep your account and content for as long as your account exists. When you delete your account (see below), we permanently delete your personal data from our servers. Content stored only on your device is removed when you delete the app or sign out and clear it.
Under UK GDPR you have the right to access, correct, delete, restrict, or object to our use of your data, to data portability, and to withdraw consent at any time (which won't affect processing already carried out). You can:
You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.
Data is encrypted in transit (HTTPS/TLS). Account credentials are stored in the device's secure keychain and, on our servers, only as a salted hash. Access to our database is restricted and the database is not publicly reachable.
Rhumi is not directed at children. You must be at least 13 years old to create an account. If you believe a child has provided us data, contact us and we will delete it.
We may update this policy; we'll change the "last updated" date above and, for significant changes, notify you in the app.