Privacy Policy

What we collect

Your account email; the date and version of the terms you accepted when you created your account; your profile descriptions (including city and area, never an exact address); optional photos; and messages you send. We do not collect payment details; Rumi is free.

How you describe your gender is up to you, and you can change it or choose "Prefer not to say" at any time. If you write your own description, it stays private. Your browse filter is private too: other members never see it.

We no longer ask about religious practice. Answers given to earlier versions of the profile form are kept but are not shown to anyone and cannot be searched.

The waitlist

Joining the pre-launch waitlist stores what you enter on the form: your email, name, date of birth, the answers you pick (timeline, Louisville area, priorities, stay details, and how you heard about Rumi), and an optional phone or note. Earlier versions of the form also asked about gender, practice and community; those answers are kept but no longer asked. We use this only to plan the launch and to reach you about your spot. Nothing from the waitlist is shown publicly, and it is never shared. We email you once to confirm your address, then once when we open. Reply to any of our emails to be removed from the list at any time.

How we use it

To run the directory, to show you members whose descriptions fit what you are looking for, and to keep Rumi safe (moderation and reports).

Analytics

We record how the site is used: pages viewed, steps completed and profiles opened. These records are tied to a cookie in your browser and, when you are signed in, to your account. Steps you took before creating an account are linked to it once you sign up. If your browser sends Global Privacy Control or Do Not Track, we do not set the cookie. We use these records to see where people get stuck and to improve the service. We also use Vercel Web Analytics, which processes IP address and browser type to produce visit counts. Usage records are kept for 13 months. Deleting your account removes the link between your account and these records.

When you ask for a password reset, we keep a record of the request for two days to limit repeated requests: a keyed hash of the email and of the network address it came from, never the email or the address themselves. While you create your profile, your answers are kept in your browser so a refresh does not lose them, and they are removed when you publish or log out.

Public and private

Shown on your profile card: your handle, area, budget, move-in timing, the home you describe, your lifestyle tags. Private until you are connected: messaging. Private until you both agree: photos and any contact details. Your exact location and contact details are never public.

Storage and security

Data is stored with Supabase. Photos live in a private bucket and are served only through short-lived signed links; image location data (EXIF and GPS) is removed on upload.

Processors

Supabase (database, sign-in, storage), Resend (email), Vercel (hosting). We do not sell your data.

Your rights and deletion

You can ask us to delete your account and associated data, including photos and messages. The exact process and retention windows will be finalized with counsel.

Children

Rumi is not for anyone under 18.

Changes and contact

We will post changes here. Add your contact email.