Privacy Policy

1. Who we are and what this covers

The rho.md cloud service ("the Service") is operated by Digital Factory Australia Pty Ltd (ABN 16 694 991 243), trading as rho.md ("we", "us"). This policy covers the Service — accounts, publishing, sharing, sync, and reading on rho.md. The Rho MD desktop and mobile app is local-first: your documents live on your device, and none of them — nor your identity — is sent to us unless you sign in and use a cloud feature. The app itself — what you may do with the software — is covered by the Terms of Service, not this policy. Cloud accounts are for people aged 13 or over, or the higher minimum age where you live; we do not knowingly collect personal data from anyone younger, and if we learn that we have, we delete the account and its data.

Two requests are the exception, in that the app makes them without you asking: the update check (§2a) and, if left on, the Discover strip on the New Tab page, which asks rho.md for the titles of the few most recently published public documents. Neither carries your documents, your account, or any identifier. The Discover strip can be turned off in Settings › General; the update check's schedule is set in Settings › About (it can be reduced to manual-only) — see §2a for exactly what it sends.

2. What we collect

Account: your email address and chosen handle (via Supabase Auth) — the same whether you sign up in the app or at rho.md. If you sign in with a Google, GitHub or Apple account instead of a password, that provider tells us your email address and an identifier for your account there; Google and GitHub also send the name and profile picture on that account, and with Apple the email may be a private relay address that forwards to yours. We use these only to sign you in. To slow automated sign-ups at rho.md we count attempts per network address for up to a day; the count lives in memory only — it is never written to a database or a log, and it is gone when the server restarts. Content: documents you upload to the cloud and the metadata you attach — tags, categories, links, and any reader access lists you create for unlisted documents. Reading stats: approximate, privacy-preserving counts — we store a salted one-way hash of reader IP + date, never the IP itself. Reading while signed in: a browser can open a limited number of different documents per account per hour and per day. To enforce that, the server keeps in memory which documents your account opened in the current hour and day; it is not written to a database, not used for recommendations or statistics, not linked to the reading stats authors see, and is gone on restart. Interest signals: see §3. Payment: handled entirely by Stripe as Merchant of Record; we never see or store your card details. Copies of the app installed from Apple's App Store subscribe through Apple's in-app purchase instead: Apple takes the payment and tells us the plan you bought, whether it is active, when it renews or ends, and a transaction identifier, which we link to your account to unlock that plan — we never see your payment details there either. Support: emails you send to our support addresses. Crash reports: only if you agree when the app asks after a crash — one carries the app version, operating system, install channel and the crash excerpt from the log. The app redacts file paths, document names and email addresses before showing you the exact text for approval; nothing is sent until you press Send, and a report carries no account and no identifier. Feedback: the feedback form (rho.md/feedback, also linked from the app) sends only the words you type, plus an email address if you choose to fill in the optional email field. We use that address only to reply to you about that feedback — it is not added to any mailing list, used for marketing, or shared — and we delete it on request. Leave it blank and the feedback stays anonymous.

2a. The app's update check — what it sends

By default, once a day, the desktop app asks rho.md whether a newer version exists. The request is a plain web address, and these four values are the whole of it: the version you are running (e.g. 1.3.0), your operating system (linux, windows or darwin), your processor architecture (e.g. x86_64), and the package format you installed (e.g. AppImage or deb — so a deb install is offered a deb). There is no account, no cookie, no installation id, no device fingerprint, and no request body (sync, which needs an account, is a different matter — see section 5). Our web server is configured to keep no access log for this address, so your IP is not recorded either. The reply is either "you are current" or the address and signature of the new build.

We do count these checks — in aggregate only. The server keeps one counter per app version × operating system × day, so we can tell how many installs are alive and which versions are still out there. Since 30 August 2026 we also count how many distinct devices check in each day: the server turns the network address into a one-way daily code (a salted hash whose input includes the date), and keeps only that code, solely so the same device is not counted twice in one day. The code cannot be reversed to your IP, and because it changes every day by construction, the stored record cannot connect one day's device to the next — it is a tally mark, not a tracker. Beyond those daily totals and codes, nothing is stored: no individual request, no IP address, and no durable identifier is ever written down, and the no-access-log promise above stands unchanged. Counting is the only thing the update check feeds.

You control how often it happens, in Settings › About: Daily (the default), On start (only when Rho MD launches), or Never— which schedules nothing at all, while leaving the "Check now" button working whenever you want it. We deliberately offer no mode that takes that button away: the only thing it would add is making the app harder to update on purpose. We do ask you to keep some automatic checking on — Rho MD renders Markdown you may have obtained from anywhere, and if we ship a security fix, an install that never asks is one we cannot reach.

What the check does not do is act on its own: downloading and installing a new version always asks you first, unless you turn on "Install updates automatically" in Settings › About. Copies installed from the Snap Store, the Microsoft Store or Apple's App Store skip all of this — those stores handle updates, and the app makes no check of its own there.

2b. Why we are allowed to hold it

Where the GDPR or a similar law applies, these are our legal bases. To do what you asked (performance of a contract): your account, storing and delivering your documents, publishing, sync, and billing. Legitimate interests: keeping the Service secure and free of abuse, aggregate reading statistics, and the gravity field that connects writing with readers — each weighed against your interests, and each with a control (you can edit or mute gravity, and turn off the Discover strip). Legal obligation: records we are required to keep, such as payment and tax records and copyright takedown records.

2c. Download buttons — what they count

When you click a download button on rho.md, the link passes through our server once so we can count it, then sends you straight on to the file on our CDN. The only thing in that request is which package you chose (say, windows-setup or linux-appimage). We keep one counter per package × day — daily totals only: no individual click, no IP address, no cookie, no identifier, and the no-access-log promise above stands unchanged. Counting how many times each package was downloaded is the only thing this feeds.

3. Gravity — interest matching, in the open

To connect writing with readers, the Service computes a "gravity field" from what you have chosen to share with the cloud: the names of your public tags and constellations, an optional self-description, and your reading activity on rho.md. It never reads the content of documents on your device. Reading activity is folded into decaying aggregates (roughly a 30-day half-life) and the underlying raw events are deleted after processing. Your gravity field is not a hidden profile: you can see it, edit it, and mute any topic from your console at any time.

4. Charts and social data

What you chart (save) is private to you. Authors see only anonymous aggregate numbers; nobody's saves or reader counts are ever shown publicly.

5. Sync data

If you use paid sync, your sync data (including metadata about unpublished documents) is encrypted at rest and transferred over TLS, and lives in private storage that is never connected to any public or discovery feature. Sync data is used for one purpose only — keeping your devices in sync — and is never shared with third parties.

Sync data also includes app data that syncs on its own while you are signed in to sync — today, Pomodoro: your activities (their names, daily goals and colours) and the time you spent on each. The record of which notes you created or edited each day stays on your device.

To tell your devices apart, each installation that signs in to sync creates a random identifier of its own. It is not a hardware or advertising identifier, it is sent only while you are signed in and syncing, and it is stored with your account so that you can see and remove your devices. It is deleted with your account.

5a. Rho AI (hosted mode)

When you use Rho AI, your conversation and any document content you hand it are relayed through rho.md to a third-party model provider (including but not limited to OpenAI, Anthropic and Google) to generate the reply. rho.md does not store that content; we keep only per-account usage counts (tokens and requests) for allowances and abuse prevention.

At rho.md/ai, your question — and the passages of published documents Rho AI reads to answer it — are relayed to the model provider in the same way. The conversation itself is kept only in your browser's local storage: we do not receive a copy and cannot restore it, and "New chat" or clearing site data deletes it. The searches Rho AI runs over published documents are not logged.

5b. Rho AI web search and web pages (app)

When Rho AI searches the web for you in the app, the search runs from your device: the query goes straight from the app to public search engines — currently Brave Search, Startpage (which returns Google results), Bing, DuckDuckGo and Ecosia — the same way it would from your own browser, and those services receive it, with your IP address, under their own privacy policies. Web pages Rho AI reads for you, including Reddit threads and posts on X, are loaded the same way; some are rendered in a hidden browser window inside the app, which keeps the app's own cookies, separate from your web browser. rho.md does not see these searches or pages.

When no search engine answers on your device, the query goes through rho.md to our search service, which asks a metasearch engine we host (SearXNG) or the Brave Search API. We do not log the query; we count searches per account for allowances.

5c. AI tools on your computer (app)

Rho MD can let AI tools that you run on the same computer — such as Codex or Claude Code with the Rho MD plugin — use the app: open and read documents, edit them and organise your library. Anything that deletes, publishes or sends asks you in the app first. This runs over a connection that exists only inside your computer (127.0.0.1); a program can use it only if it can read a key file kept in your own user folder, and nothing about it goes through rho.md. It is on by default and can be switched off in Settings › AI tools, which also lists the tools that have connected (the name each tool gives itself, and when it was first and last used) and lets you remove one. Each command a tool runs is written to the app's log file on your device. That list and that log stay on your device; a log excerpt leaves it only if you choose to send a crash report (§2). What a tool does with what it reads is covered by that tool's own terms and privacy policy, not ours.

5d. AI services that search rho.md

With the Rho MD plugin, AI services such as ChatGPT and Codex can search the documents published on rho.md and read them, through a connection at rho.md/api/mcp. Only published documents can be reached — never private or unlisted ones — and what comes back is what anyone can already see on rho.md: the text, title, author name and link. To answer, we receive the search words or the document asked for, the network address the request comes from (for ChatGPT, OpenAI's servers) and, from ChatGPT, an anonymous user code it adds so that limits apply per person. We do not log the searches. The address and code are kept only in the server's memory to enforce reading limits and are gone on restart; reads are counted in authors' reading stats the same privacy-preserving way as other reads (§2). What the AI service does with what it reads is covered by its own terms and privacy policy.

6. What we never do

We do not sell your data. We show no ads and use no advertising trackers. We do not feed private or unlisted content into any search index, recommendation surface, or public graph — this separation is structural, not just policy. Unlisted pages are served with noindex and no-referrer headers.

7. Cookies

Only authentication session cookies. No third-party advertising trackers. rho.md/ai also keeps your current conversation in your browser's local storage; it leaves your device only as part of the questions you send.

8. Service providers and data location

Supabase (database & auth, US East), Cloudflare (DNS, CDN, email routing, and R2 object storage), Resend (transactional email), Stripe (payments, as Merchant of Record), and Apple (in-app purchases in App Store copies, and Sign in with Apple). Each receives only what it needs to perform its function. Your cloud data is stored in the United States; we are an Australian company, and we handle your data under this policy wherever it is stored. For users in the EEA and the UK, those transfers rest on our providers' standard data processing terms, which incorporate the European Commission's Standard Contractual Clauses.

8a. Government and law-enforcement requests

We hand personal data to police, regulators, or courts only when we are legally compelled — a valid order, warrant, or statutory notice under a law that binds us — and then only the specific data that order covers, after checking that it was properly issued. A request that arrives as an email asking nicely is not an order, and we decline it. We will tell you when it happens, unless the law forbids us from telling you or someone is in immediate danger. Documents you have published are public already; nothing about a legal request is needed to read those.

9. Retention and deletion

Documents you delete or unpublish are removed from the Service; residual copies in our encrypted backups expire on a rolling basis. To delete your account and all associated cloud data, use Delete account… under Settings › Account in the app, or the account deletion page on rho.md, or email privacy@rho.md from your account address. Deletion is scheduled with a 30-day grace period during which you can cancel it; after that it is permanent. Details, including exactly what is removed and what is kept, are on the account deletion page. Your local documents are yours and are never touched.

9a. If something goes wrong

If a breach of our systems is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and the relevant European authority where the GDPR applies. We will tell you what happened and what it means for you, not just that something happened.

10. Your rights and how to complain

Depending on where you live, you may have rights to access, correct, export, or erase your personal data, and to object to or restrict some processing (including under the Australian Privacy Act, GDPR, and CCPA). Write to privacy@rho.md and we will respond within 30 days. Say what you want and from which account address; we do not charge for this.

If you are unhappy with how we handled it, you can take it to a regulator without asking us first: in Australia the Office of the Australian Information Commissioner, and in the EEA or the UK your national data protection authority.

11. Changes and contact

12 October 2026: new §5c — AI tools on your computer (such as Codex or Claude Code) can use the app over a connection that stays inside your computer; nothing about it goes through rho.md. New §5d — AI services such as ChatGPT and Codex can search and read the documents published on rho.md; what we receive to answer them, and that searches are not logged. 11 October 2026: §5 — app data that syncs on its own (today, Pomodoro: activities and the time spent on each); the record of which notes you edited stays on your device. 4 October 2026: §2 — what Google, GitHub and Apple tell us when you sign in with them, and that App Store copies subscribe through Apple's in-app purchase; §2a — App Store copies make no update check of their own; §8 adds Apple. 1 October 2026: §2 — the feedback form now has an optional email field, used only to reply to you about that feedback. 30 September 2026: new §5b — Rho AI in the app now runs web searches from your device, directly with public search engines, and reads some pages (Reddit, X) in a hidden in-app browser window; the search through rho.md is the fallback. 25 September 2026: §5 now describes the random identifier each installation creates when it signs in to sync; §9 — you can also delete your account on rho.md; §2a points to §5 for sync. 5 September 2026: §2a — the update check now also names the package format the app was installed as (AppImage, deb, …), so that each format can be offered a matching update; nothing else about the request or what is stored changed. 30 August 2026: §2a now discloses that update checks are additionally de-duplicated per day via a one-way daily-rotating hash of the network address (raw IP never stored, no cross-day linkage), to count distinct active devices. 8 August 2026: §5 updated — sync data is now additionally encrypted at rest by the application itself (on top of storage-level encryption); wording simplified. 7 August 2026: §2a now discloses that update checks are counted as anonymous daily aggregates (version × platform × day, nothing else); §2 adds crash reports (always previewed, always redacted, never automatic) and the anonymous feedback form. 6 August 2026 and earlier: see prior versions on request.

We will announce material changes to this policy on the site or by email. Questions: privacy@rho.md — Digital Factory Australia Pty Ltd, trading as rho.md.