Rulomi keeps your routines on your phone

Who we are

Rulomi is made by CraftedPxl, LLC. Questions about this policy or about your data can be sent to info@craftedpxl.com.

The Rulomi Android app

Network access. The app declares the INTERNET permission for three things: the optional AI planner described below; from 0.8.0, a routine's web request; and, from the release after 0.8.0, downloading the recipe library's list. The last two are described under their own headings. It has no other network features, and no advertising, analytics, or crash-reporting libraries.

What the app stores, and where. The app keeps the following in its private, sandboxed storage on your device, which other apps cannot read:

• The instructions you type and the routines built from them, including the name you give each routine and whether it is enabled or paused.
• A history of the most recent 100 runs, recording when a routine ran, whether it succeeded, was skipped because a condition did not hold, was blocked, or partially completed, and how many actions succeeded. Each record names its routine by title and ID. A run started by a notification names the app that sent it, never what it said.
• For each enabled routine, whether what it watches was true the last time the app looked, so an event fires when you enter that state rather than over and over.
• Your choices in Settings: whether the AI planner is on, which routine the Quick Settings tile runs, and which routines have a home-screen shortcut.
• A random install ID the app generates, used only by the AI planner to limit how often one installation can use it, and a few counters the app keeps to notice when Android delays or stops its scheduled runs.
• If you buy Rulomi Plus, the purchase token Google Play gives the app for that purchase, which it sends with AI planner requests as described below, and whether a payment for it is still pending. The token identifies the purchase, not you.
• For a routine that is waiting between steps, the values its remaining steps need — which can include the words of the notification that started it. This is kept only until that run ends or is cancelled, and never leaves the device.
• For a routine that puts settings back, after a time or when what started it ends, the settings it changed as they were when the run began: volumes, brightness, ringer mode, Do Not Disturb, screen timeout, and auto-rotate, with the routine's title and ID. They are kept only until they are put back, or until you pause, change, or delete the routine, and they never leave the device.
• From the release after 0.8.0, the last recipe list the app downloaded from rulomiapp.com, and when it last asked for one.

No backup, no transfer. The app opts out of Android auto-backup and device-to-device transfer, so this data never leaves the device through those channels either.

Deleting your data. Delete individual routines inside the app, clear the app's storage in Android settings, or uninstall the app. Each of these removes the data described above.

Permissions. The app asks for access only when a specific routine needs it, and checks that access before any action runs:

• Notifications, to show the messages you asked for and, for event-based routines, the persistent monitoring notification Android requires.
• Do Not Disturb access, only for routines that turn Do Not Disturb on or off, or change the ringer mode or the ring or notification volume, which Android treats as Do Not Disturb settings.
• Modify system settings, only for routines that change screen brightness or the screen timeout.
• Exact alarm scheduling, optional, so scheduled routines fire on time rather than within a window Android chooses.
• Bluetooth connection, only for routines that react to a Bluetooth device connecting or disconnecting, or that run only while one is connected. The app reads the names and addresses of devices you have already paired so you can pick one; it does not scan for or pair with devices.
• Notification access, only for routines that run when an app notifies you, check whether an app has a notification showing, or clear one app's notifications. You grant it on Android's own screen, after the app explains what it means; what Rulomi does with it is the section below.
• Calendar, from 0.8.0, only for routines that run when an event in your calendar starts or ends, or that run only while you are, or aren't, busy. Android asks you once. The app reads the events of the calendars your phone shows, from now to two days ahead, to match the routine, and lets them go; see the section below.
• Usage access, only for routines that run when an app opens or closes. You grant it on Android's own screen, after the app explains what it means. The app looks at which app is in front, on the phone, every couple of seconds while the screen is on and such a routine is enabled; apart from the app you pick for the routine, nothing about the apps you use is stored or sent.
• A foreground service of the specialUse type, to observe charging, battery, Wi-Fi, Bluetooth, and headphone connection events — and, for the routines that ask for them, the motion, proximity, and light sensors, the screen's rotation, and which app is in front — while a routine that needs them is enabled, and to keep a visible notification with a Pause control on screen while notification routines are enabled.

The motion, proximity, and light sensors and the screen's rotation need no Android permission at all, and Rulomi asks for none for them.

Apart from notification access, which shows the app the notifications other apps post, including the text of messages, and is described below, and usage access, which shows it which app is open, and calendar access, which shows it your events, none of these permissions gives the app access to your contacts, location, messages, files, camera, microphone, or other apps' data, and the app does not request any permission that would. So that you can pick an app for a notification routine, the app can list the apps installed on your phone; that list stays on the phone.

Why isn't it working? Each routine's page can check what might stop it from running. The check reads what the app already holds — the access you granted, whether event monitoring and the notification listener are running, the routine's next alarm and last state, and its run history — and asks Android one thing, which needs no permission: whether battery optimisation applies to Rulomi. It runs on the phone, sends nothing, and stores nothing new.

No third-party code that reports home. The app contains no advertising, analytics, or crash-reporting libraries. It includes Google's Play Billing library, which talks to the Play Store app on your device about a Rulomi Plus purchase and reports nothing to us. In 0.4.3 the library checks with Google Play each time you open the app, and like other Google Play libraries it may send Google its own diagnostic data, under the Google Privacy Policy. From 0.5.0, which sells Rulomi Plus, it does the same each time you return to the app. The app also includes Google's Play Integrity library, which asks Google Play services for the integrity token described under the AI planner.

Notification access

What it is for. A routine can run when an app posts a notification, can check whether an app has one showing, and can clear one app's notifications. That needs Android's notification access, which you grant on the system's own screen after Rulomi explains it in the app. It is the most far-reaching thing Rulomi asks for: with it, Android shows the app every notification your phone receives. It arrives in the release after 0.4.3, and nothing asks for it until you build a routine that needs it.

What happens to a notification. Its app, title and text are read on your phone, compared with your enabled notification routines, and let go. None of it is collected or transmitted: nothing about a notification goes to our server or to Anthropic — a plan or an edit carries your own words for the app and the phrase to look for, never a notification's contents — nothing about it is written to the app's Activity list except which app triggered the run, and nothing about it goes into a backup file. A matching routine can put the notification's words into its own reminder or spoken line, and that also happens on the phone.

The one thing written down. A routine that waits, or speaks, before a step that uses those words keeps the values its remaining steps need in the app's private storage for the life of that one pending run. It is cleared when the run ends or is cancelled, and it is never exported.

What it cannot do. Rulomi cannot reply to a notification or press its buttons, and it never clears every app's notifications — only those of the app you named, or of the app whose notification started the routine. You can withdraw notification access at any time in Android's Settings or from Rulomi's Settings, and the monitoring notification's Pause action stops notification routines along with the rest.

Your calendar

From 0.8.0 a routine can run when an event in your calendar starts or ends, or only while you are, or aren't, busy. With calendar access, the app reads the events of the calendars your phone shows, from now to two days ahead, compares each one's title, calendar and whether it shows you as busy with your routine, on the phone, and lets the title go. It keeps only the time of the next start or end it is waiting for and the calendars you ticked, which are numbers your phone gives them. No event's title, time, attendees or place is stored, written to the app's history (which says only that an event started), put in a backup file, or sent anywhere. The words you type for an event, like "Gym", are part of your description, and go to the AI planner only as that does.

Web requests

From 0.8.0 a routine can send a web request, for services such as Home Assistant, IFTTT or ntfy. You type the address on the phone, and the message, if any, is text you wrote. The request goes only to that address, only over https, and only when your routine runs; it never goes to us. It carries nothing the app reads on your phone: no notification's words, battery level, time, calendar event or anything else can be put into it. With it go only the address, your message, and a header saying it comes from Rulomi, with no install ID or other identifier. The app keeps only whether it was answered, and with what status, in its history, never the address or the message. The address never goes to the AI planner. What the service at that address does with your request is up to that service and its own terms.

Other apps. From 0.8.0 a routine can also send an Android intent for an app such as Tasker or MacroDroid. Any app on your phone can receive it, so it carries only the fixed text you wrote. And another app can start a routine you allow it to, using a key the app makes on your phone, shown on the routine's page, which is never sent anywhere or put in a backup file.

The recipe library

From the release after 0.8.0 the app has a library of ready-made routines. Their list comes inside the app, and so that new recipes can arrive without an app update, the app also asks rulomiapp.com for the current one: only when you open the library, and at most once a day. It is a plain HTTPS download of https://rulomiapp.com/recipes.json, the same file anyone can open in a browser. It sends no cookies, no install ID, no purchase token, and nothing about your routines, your phone or whether you own Rulomi Plus; besides standard request headers it carries only one naming the app and its version. Like any visit to this website it reaches Cloudflare, which serves the site, with your network address, as described under This website. The app keeps the last list that downloaded and checked correctly, and the time it last asked; if a download fails, it uses that list or the one inside the app. Every recipe is checked on your phone before it is shown, and adding one puts it on the review screen, paused, as a planned routine is.

Motion, proximity, light, and rotation

A routine can run when you shake the phone, turn it face down or face up, cover the sensor at the top of the screen, when the room gets dark or very bright, or when the screen turns landscape or portrait. These readings need no permission, and they never leave the device: they are read only while a routine that needs them is enabled, matched on the phone, and dropped. Nothing is stored about them beyond whether the trigger was true the last time the app looked, and nothing is sent anywhere.

Motion and light are read only while the screen is on. Android stops delivering them once the screen is off unless an app holds a wake lock, and Rulomi does not take one.

Routine backup files

From the release after 0.4.3, Settings → Your routines can export your routines to a file you pick in Android's own file picker, and import such a file back. Nothing in that exchange reaches us or any server: the app writes the file where you chose and reads the one you chose. It is the one way routines leave your device, and only when you ask for it.

From 0.8.0, a routine's web request address is part of the routine, so it is in the file too. Such an address can hold a key, so keep the file private. The key that lets another app start a routine is never in the file.

The file holds each routine as the app stores it: its name and description as you typed them, its trigger, conditions and schedule, its notification and spoken text, the words a notification routine looks for, the name and address of any Bluetooth device and the label and package name of any app it names, whether it is enabled, and when it was created. It also records the app version and the time of the export. It does not hold your run history, the random install ID, your AI planner choice, any Rulomi Plus state, or a waiting run's captured values. It is plain JSON and is not encrypted, so where it goes after you save it — a cloud drive, a chat, another phone — is your choice and that provider's terms, not ours.

The AI planner

What it is. When you build a routine, Rulomi can ask an AI model to interpret your description. Before it does this the first time, the app shows a consent dialog; if you decline, routines are interpreted on the device only. You can change your choice at any time under Settings → AI planner. From the release after 0.4.3, the on-device parser is tried first and only a description it cannot interpret is sent. Rulomi 0.4.3 sends every description while the planner is on, and uses the on-device parser only when the planner is unavailable or has reached its daily limit.

What is sent. The routine description you typed, a random install ID that the app generates (used only to limit how often one installation can use the planner), and the app version. When you ask the planner to change a saved routine, which versions after 0.4.3 can do, that routine as it stands is sent too: its name, trigger, conditions and schedule, the text of its actions, and the names you or your phone gave any app or Bluetooth device it uses, but never a device address or an app's package name. From 0.6.0, a button on one of its notifications is sent as its label and the words used for the routine it runs; which of your routines that is gets worked out on your phone, so the titles of your other routines are never sent. If you have bought Rulomi Plus, the Google Play purchase token for that purchase is sent as well; it identifies the purchase, not you, and it is what lets our server ask Google whether the purchase is valid and hasn't been refunded. From 0.5.0, a Play Integrity attestation token is also sent with each request. Google Play services issues it on your phone for that one request, and our server sends it back to Google to check that the request comes from a genuine copy of Rulomi installed from Google Play; it is never sent to Anthropic. Like any request over the internet, it also carries your network address and standard request headers. In 0.4.3 those include the Android version and device model; later versions name only the app and its version. Your other routines, run history, contacts, location, and other device identifiers are never sent.

Who processes it. The request goes over HTTPS to api.rulomiapp.com, a server run by CraftedPxl, LLC on Cloudflare, which forwards the description, and for a change the routine as it stands, to Anthropic's API and returns a plan for you to review. Our server does not store what you typed. Anthropic processes it under the Anthropic Commercial Terms and retains API inputs and outputs for up to 30 days by default. Cloudflare processes the request's technical details as described in the Cloudflare Privacy Policy. A Rulomi Plus purchase token is sent only to Google, to verify the purchase; it is never sent to Anthropic.

What we keep. A count of the AI plans your installation has used, keyed by the random install ID and deleted 400 days after its last plan, which is how the five free plans stay five; a second counter, kept for two days, keyed by a keyed hash of the network address the request came from, which limits how often one network can use the planner and lets us store the counter without storing the address; a running total of what the day's requests cost; and technical logs recording each request's status, timing, token counts and cost, and the result of any integrity check, which Cloudflare keeps for up to seven days. None of these contains what you typed or your address, and only the plan count is linked to your install ID. When a plan contains none of your words (no notification or spoken text, no app or device name, no phrase to look for, and one of a few stock titles), we also keep that plan for up to 30 days under a one-way hash of the description, so the same wording from anyone is answered without a new model call; it is linked to no install, and a change to a saved routine is never kept this way. For a Rulomi Plus buyer the plan count is keyed by a one-way hash of the purchase token instead, and it is kept for as long as the service runs, because Plus plans don't expire; Google's answer about whether the purchase is valid is cached for up to two days.

Deleting it. Turning the AI planner off stops any further sending. What was already sent is deleted by Anthropic under its standard retention, within 30 days. Clearing the app's storage or uninstalling removes the install ID, which makes the counters unlinkable to you.

This website

Hosting. rulomiapp.com is served by Cloudflare. Like any web host, Cloudflare processes the technical details of each request, such as your IP address, browser type, and the page requested, to deliver the page and to protect against abuse. Cloudflare's handling of that data is described in the Cloudflare Privacy Policy.

Analytics. The site uses Cloudflare Web Analytics, which Cloudflare adds to each page as a small script. For each page view it records the page, the page you came from, your browser, operating system and device type, your country, and how long the page took to load, and it shows us those as totals. It sets no cookies, stores nothing in your browser, and does not identify you or follow you to other sites; we see aggregate figures, never individual visitors.

Fonts. The Figtree and JetBrains Mono typefaces are served from rulomiapp.com itself, so loading a page sends no request to Google or any other font service.

No cookies, no trackers. The site sets no cookies and includes no advertising or social-media scripts, and no analytics other than the Cloudflare Web Analytics described above. The only thing stored in your browser is your light or dark theme preference, kept in local storage on your device and never sent to us.

Email. If you write to us, we keep your message and address for as long as needed to reply and to act on what you sent. We do not add you to any mailing list.

Children

Rulomi is not directed at children under 13. We never ask for anyone's name, email address, or age, and nothing the app sends lets us identify or contact a user of any age.

Your rights

We hold no data that identifies app users: the AI planner's counters are keyed by a random install ID, by a keyed hash of a network address, or by a hash of a Play purchase token, none of which we can link to a person. Google, as the seller, knows who bought Rulomi Plus; we only learn whether a purchase is valid. If you believe we hold something about you, write to us and we will look. You have full control of the data on your own device. If you have emailed us, you can ask us to delete that correspondence at any time by writing to info@craftedpxl.com.

Changes to this policy

If a future version of Rulomi changes what it stores or gains any network capability, this page will be updated before that version is distributed, with a new effective date at the top. The version of this policy that applies is the one published for the app version you are running.