Data Handling

This page exists as a product surface, not a legal afterthought — a straight answer to "what actually happens to my data," separate from the Privacy Policy's legal terms.

Your project content

Your projects are stored on our servers, on every tier including Free. That is deliberate: it means losing a laptop, clearing your browser, or switching machines is not a way to lose your book. Your browser holds only a working copy while you have a project open.

Storage is per workspace and access is scoped to it. A project can be opened only by members of its workspace and by people that workspace invites to that one project — someone invited to one project sees that project and nothing else in the workspace. Review comments are stored with the project they are about, visible to the same people, and never included in any export.

Two things follow from content being stored with us:

You can always take it out. Full source export, to plain Markdown and JSON, is available to every account at any time, including free and lapsed ones, at no cost.
You can always delete it. Deleting a project, a workspace, or your whole account is self-service, and the Privacy Policy sets out exactly how long each takes.

Any file processed by a server-side export job is deleted from that service within 24 hours of the job completing.

Account and authentication data

Sign-in is handled by Better Auth: email + password (with mandatory email verification) or Google OAuth. Optional TOTP two-factor authentication is available on every tier. Passwords are never stored in plain text.

Email we send

Account and security emails — verifying your address, password resets, a note when your password or two-factor setting changes, invitations, and deletion confirmations. Always sent, because they're how your account stays yours.
Getting started and your trial — a welcome, a tip if you haven't started a project, a heads-up three days before your Publisher trial ends, a note when it has ended (nothing is charged and your work stays), and one follow-up about a week and a half later. Every one has an unsubscribe link, and Settings → Email turns them off.
The newsletter — only if you ask for it: the box at sign-up (never pre-ticked), Settings → Email, or the form on our site, which emails you a link to confirm first.

Payment receipts and billing emails come from Polar, our payment provider.

Telemetry (opt-in, off by default)

Product telemetry is opt-in and disabled by default. When enabled, it covers only feature-usage counters and crash reports. Crash reports are automatically scrubbed of document content, file paths, and entity names before they're ever transmitted.

Product analytics

Separately from telemetry, we run aggregate, account-level product analytics (via PostHog) to understand things like signups, trial starts, first exports, and tier changes. This never includes your document content or entity names — it's counts and timestamps of actions, not what's in them. A signup also records which of our public pages' sign-up link was followed, if any, such as a blog post. A tier change caused by a cancellation records the reason picked in Polar's optional cancellation question, if any, but never the comment.

Marketing-site analytics

Separately again, and only on the public rulebindery.com pages you're reading right now — never inside the app once you're signed in — we use:

Cloudflare Web Analytics for aggregate traffic (page views, visits, referrers), measured directly from Cloudflare's own edge network. No cookies, no script runs in your browser for this.
Microsoft Clarity for session recordings and heatmaps, so we can see how visitors actually use pages like pricing. It's configured not to set cookies, so a return visit isn't linked to an earlier one, and Clarity automatically masks form inputs and other sensitive on-page content before it ever leaves your browser.

Neither tool has any access to your account, your projects, or anything behind sign-in.

Where things are stored

Database: Neon (serverless Postgres)
File and asset storage: Cloudflare R2
Payments: Polar.sh (merchant of record)
Email (account and security emails, getting-started tips and trial reminders, the newsletter if you subscribe): Resend
Product analytics: PostHog
Marketing-site analytics: Cloudflare Web Analytics, Microsoft Clarity
Newsletter form bot protection: Cloudflare Turnstile

Data in transit is encrypted with TLS 1.3; data at rest is encrypted with AES-256. Presigned URLs used for asset uploads/downloads expire within 15 minutes and are scoped to a single file.

Deleting your account

Account deletion is self-service: go to Settings → Delete account. You confirm with your password (if you have one) and a link we email you, and the deletion happens when you open that link. It removes your account and sign-in methods, and it deletes any workspace only you belong to, with its projects, documents, assets and stored files. All cloud-held data is purged within 30 days.

Two things need sorting out first, and the Settings page tells you if either applies: if you are the only owner of a workspace other people belong to, transfer ownership or remove the others; and if you have a paid subscription that is still set to renew, cancel it from Billing. Workspaces you share with others stay as they are, and so do projects you were invited to; you are simply removed from them.

Payment records stay with Polar, our payment provider, as tax law requires, and we keep one minimal record to prevent repeat free trials — see the Privacy Policy.

Deleting a project or a workspace

A workspace's owners and admins can delete its projects; only its owners can delete the workspace.

A project. Go to Project settings → Delete project and type the project's name. It disappears from your dashboard and moves to Recently deleted, where an owner or admin can restore it for 30 days. After that it is permanently deleted, along with its stored files. An owner or admin can also choose Delete now from Recently deleted to remove it immediately.

A workspace. Go to Settings → Delete workspace. You type the workspace's name, confirm with your password (if you have one), and open a link we email you. The workspace is then locked — editing is paused and new uploads are refused, but everyone can still open and export their work — and it is permanently deleted 14 days later, with all its projects, documents, entities, assets and stored files. Every member is emailed when it is scheduled, an owner can cancel at any time before the 14 days are up, and we send a reminder in the last 24 hours. While a workspace is scheduled for deletion it cannot take on new members. If the workspace has a paid subscription that is still set to renew, cancel it from Billing first.

Before you delete. Export what you want to keep — a Source Archive from the Export screen gives you everything as plain text. Deleting in the cloud does not erase copies on your own or your members' devices, or files you have already exported.

Backups. Encrypted backups of our database are kept for 30 days, so deleted data can remain in a backup for up to 30 days after it is removed from the live service. Backups are used only for disaster recovery, and deletions are re-applied if one is ever restored. We keep a minimal record of a workspace's deletion for 12 months (see the Privacy Policy).

Questions about how your data is handled: privacy@rulebindery.com.

Privacy Policy — the legal terms governing this data
AI Policy — our commitment on training and generative use