Privacy

Last updated 6 November 2026 · back to rerute · Terms · Support

The short version

rerute works without a ReRute account. Your journal stays on your device unless you separately choose account sync. A web purchase uses a separate billing session and does not send journal entries or setup answers to Stripe or ReRute's billing tables. On iOS 14 and 15, Apple purchase receipts pass through ReRute's API only so it can ask Apple to verify access; the receipt is not stored or linked to your ReRute account.

There are no analytics, tracking scripts, advertising pixels or advertising cookies anywhere in the app. When web billing is enabled, the website uses one strictly necessary first-party HttpOnly cookie to remember web purchase access. The installed app contacts our API for optional account functions. Support, legal, and clearly labelled third-party reading links open only when you choose them.

Without an account

Your entries, your plan, and your timer live in local storage on your device under keys beginning rr.. They are never transmitted. Clearing the app's local data (or its site data in a browser) deletes them, and we cannot recover them — that is the trade for us never having had them.

rerute.com

Once rerute 1.1 is on the App Store, rerute runs in the iPhone app and rerute.com no longer runs it. A journal kept in a browser before then stays in that browser's local storage until you clear the site's data; we hold a copy only if you turned on backup. rerute.com lets you download it as CSV or JSON, or back it up to an account (with the explicit consent described below) so the iPhone app can bring it in when you sign in there with the same email and turn on backup. The site backs up only when you ask it to, and afterwards the browser can sign out or remove its own copy. You can also delete your account from rerute.com.

Web purchases

If you buy web access, Stripe processes your checkout, payment method, billing details, purchase and subscription records under its own privacy terms. ReRute does not receive or store your full card or bank details. Stripe sends us purchase events needed to provide access. Our API stores a Stripe customer identifier, the purchased access type, current subscription status and period, purchase/refund state, and an HMAC of the purchase email for access restore. It also stores a hash of an opaque browser-session token, short-lived restore-code hashes, and webhook event identifiers. These records are separate from your journal and optional sync account. The browser token is held in an HttpOnly cookie scoped to the billing API; deleting browser site data removes that browser's token, and you can restore a purchase with its email address. The browser also keeps the last verified access state in local storage so a paid local journal can open offline. Annual access is limited by its recorded paid-through date. A refund or other change to lifetime access is checked the next time the browser connects.

Resend delivers the neutral restore code if you request one. The email address itself is sent to Stripe for checkout and to Resend for code delivery; ReRute stores only a keyed digest of it in billing records. We keep web purchase records while needed to provide and administer access, handle disputes, and meet accounting or legal duties. Some transaction records may remain with Stripe or ReRute after access ends where required by law. Contact support to ask about a billing record or exercise a data-rights request.

With an account

If you create one, we store the following on our server:

Your entries are the sensitive part, and we treat them that way: they are never used for analytics, never shared, never sold, never used to train anything, and never read by us except where you explicitly ask for help with a specific problem.

Emails we send contain no sensitive words. A sign-in email reads "rerute — your code is 493 201" and nothing more, so a code arriving on a shared or visible screen reveals nothing about what the app is for.

Setup and App Store purchases

Your optional setup answers stay on your device. With backup turned on, they sync to your account together with your avatar, your Code course progress, whether you have seen the "what's new" screen, and the Rope's held counts, so another device picks up where you left off; without backup none of these are sent to us. If you choose to add the suggested rule to your plan, it becomes part of your ledger and follows your backup choice. Clearing setup answers does not delete your journal or plan.

Where the iOS app offers paid access, Apple handles payment and purchase history under Apple's privacy terms. ReRute does not receive your card or bank details. The app uses Apple's StoreKit framework on your device to verify and restore purchases. On iOS 16 and later, StoreKit verifies purchases on device. On iOS 14 and 15, the app sends its Apple-signed receipt to ReRute's API over HTTPS; the API forwards it to Apple for verification and returns only the access type and annual expiry. The API does not store or log the receipt or transaction identifiers, and does not associate them with your ReRute email account or journal. The device keeps the last verified access state in the iOS Keychain so paid access can still open offline. Apple handles purchase, payment and subscription history under Apple's privacy terms. Deleting a ReRute account does not delete Apple's purchase records or cancel an Apple subscription.

Operational request logs

When your device makes a request to rerute's website or API, our hosting providers keep standard request and security logs. These may include an IP address, request time, requested path, response status, and basic browser or device information. We use them only to deliver, secure, and troubleshoot the service. We do not combine these logs with your ledger or use them for analytics, advertising, profiling, or tracking.

Who else processes your data

Apart from Vercel Web Analytics on the marketing pages (above), we do not use an analytics provider, an ad network, a session recorder, a chat widget or a CRM. Nothing you log in rerute ever reaches an analytics provider.

Notifications and marketing

rerute sends no notifications, ever — it has no notification infrastructure at all. We will not add you to a mailing list. The only emails are codes you request for sign-in or web purchase restore, or a reply from support.

How long we keep things

Your synced entries stay until you delete your account. You can do that yourself inside rerute; the account and server copy are erased immediately. Sign-in and purchase-restore codes expire in ten minutes. Account sessions expire after 180 days of not being used. Billing browser sessions expire after one year; billing purchase records may be retained as described above. Standard request and security logs are kept only for the operational retention periods configured by our hosting providers, then expire under those providers' retention controls.

Your rights

If you are in the EU or UK, the GDPR gives you the right to access, correct, delete, restrict, object to and port your data, and to complain to your data protection authority. In practice:

• Access and portability — export everything as CSV or JSON from inside the app at any time. No request needed.
• Deletion — open Account in the app (or Help + your data on rerute.com and sign in for deletion), choose Delete account, and confirm. We immediately erase the account, everything synced to the server, and every signed-in session, then rerute's data on the device or browser you are using (export first if you want a copy). Copies on other devices stay until you clear them.
• Correction — urge entries can be edited in the app. For any correction the interface does not offer, contact support@rerute.com. You can also delete the complete server copy at any time using Delete account.

Our legal basis is contract (running the service you signed up for) and legitimate interest (keeping it secure). Because entries about sexual behaviour can be special-category data, we rely on your explicit consent to store them on our server. Before enabling optional backup or sync, rerute asks you to affirm that consent with an unchecked checkbox. We record the notice version and server time when you accept it, and sync stays unavailable without a current consent record. Authentication for account management remains available without consent so you can still delete the account. You can decline and keep your journal locally. In paid versions, using ReRute's tools also requires a platform purchase; declining sync consent does not change that separate access choice. Withdraw sync consent by deleting your account; the server copy is erased, and so is rerute's data on the device you delete it from.

Where your data is

Our servers and processors may be outside your country, including in the United States. Transfers rely on the standard contractual clauses those providers publish.

Children

rerute is not for under-16s and we do not knowingly hold their data.

Security

Traffic is encrypted in transit. On the server, sign-in codes and session tokens and restore codes are stored as hashes, never in the clear. A signed-in device keeps its active account bearer token in local app storage; web billing uses a separate HttpOnly cookie whose hash is stored server-side. There are no passwords to steal. We are a small operation and cannot promise perfect security — but the architecture means the most sensitive thing about you, your history, may never have left your device at all.

Changes

If we change how we handle data we will update this page and say so in the app before the change applies.