Privacy Policy
What personal information RedRubric collects, how it is used, and the choices available to you.
What personal information RedRubric collects, how it is used, and the choices available to you.
This Privacy Policy (this "Policy") explains what personal information RedRubric Inc. ("RedRubric," "we," "us," or "our") collects through redrubric.com and its related services (together, the "Service"), how we use it, and the choices available to you. This Policy is part of, and should be read alongside, our Terms of Service.
Account information. When you create an Account, we collect your name and email address, and either a password (stored as a one-way hash, never in plain text) or your Google account identifier if you sign in with Google.
Payment information. When you make a purchase, our payment processor, Stripe, Inc., collects your payment card details directly. RedRubric receives confirmation that a payment succeeded and a reference to the transaction; RedRubric does not receive or store your full card number.
Usage information (client analytics and session replay). We use PostHog, a product analytics tool, to collect information about how you use the Service in your browser, such as which pages you visit, which practice questions you attempt, general device and browser information, and session replay (a recording of on-screen activity, with the content of input fields masked). We also use Google Analytics, a Google LLC service, to measure aggregate site usage such as page views and traffic sources. This helps us understand which parts of the Service are useful and which need improvement.
These two kinds of collection are controlled differently, and a notice on your first visit explains both. Basic usage analytics runs by default when you visit, and the notice gives you a one-click way to turn it off; you can also change your choice at any time through the privacy choices link in the footer. Session replay is stricter: it stays off unless you explicitly turn it on, and declining analytics turns replay off as well. The page URLs we send to analytics are minimized to the path plus a small, allowed set of non-identifying parameters, such as campaign tags. We do not send authentication tokens, account identifiers in the URL, or the full query string. We do not send your name or email address to PostHog or to Google Analytics.
Server-side operational events. Separately from the browser analytics above, our servers record a small number of operational milestones tied to your account, such as a successful sign-up or a completed purchase. We process these under our legitimate interest in running and improving the Service. They contain no session recording or page-by-page activity, and they never include your name or email address, only account-level facts such as the plan involved or which country your request came from.
Communications. If you contact support@redrubric.com, we keep a record of that correspondence so we can respond to you and any follow-up questions.
We use the information described above to: operate and maintain your Account; process purchases and deliver the Content and features you have paid for; send transactional email, such as receipts, password resets, and account notifications; understand and improve the Service; detect and prevent fraud and misuse; and comply with legal obligations.
RedRubric relies on the following service providers to operate. Each provider processes a limited category of your information, only for the purpose described:
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe, Inc. | Payment processing | Payment details, billing information |
| MongoDB Atlas | Account and application data storage | Account information, purchase history, practice activity |
| Resend (with a Gmail-based fallback) | Transactional email delivery | Your email address, the content of the email sent to you |
| PostHog | Product analytics in your browser (on by default, one-click opt-out) and session replay (only after you explicitly turn it on), plus a small set of server-side account milestones | Usage and device information for browser analytics (no name or email address); account-level facts such as plan and country for server-side milestones |
| Google Analytics (Google LLC) | Aggregate site usage measurement in your browser (page views, traffic sources), subject to the same one-click opt-out as PostHog analytics | Usage and device information (no name or email address) |
| Vercel Blob | Public storage for static assets, such as audio and images, served over a public URL | Not user-specific data |
| Vercel | Application hosting | All Service traffic passes through Vercel's infrastructure |
| Optional sign-in (Google OAuth) | Your Google account identifier and profile information, only if you choose to sign in with Google |
We do not sell your personal information to third parties. We share information with these providers only as needed for them to perform the service they provide to us, and each is contractually or otherwise obligated to protect it.
The Service uses cookies for authentication, payment processing, and analytics. The categories of cookies in use, and your options for managing them, are described in our Cookie Policy at redrubric.com/cookies.
We retain your Account information for as long as your Account remains active, and for a reasonable period afterward to comply with legal, tax, and fraud-prevention obligations. If you would like your Account and associated data deleted, contact support@redrubric.com. We will process your request as soon as reasonably possible, subject to any information we are required to retain by law.
We use reasonable administrative, technical, and physical safeguards to protect your information, including encrypting passwords and relying on established infrastructure providers (Stripe, MongoDB Atlas, Vercel) for payment and data storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
The Service is not directed to children under 13, and you must be at least 13 years old to create an Account, as described in our Terms of Service. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13, we will delete it.
You may review and update your Account information from your Account settings. You may unsubscribe from marketing email using the link included in those emails; you will still receive transactional email related to your Account and purchases. You may request access to, correction of, or deletion of your personal information, or ask us a question about this Policy, by emailing support@redrubric.com.
Our service providers, including Stripe, MongoDB Atlas, and Vercel, may process and store information in the United States and Canada. By using the Service, you understand that your information may be processed outside the country in which you reside.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. If a change is material, we will make reasonable efforts to notify you.
Questions about this Privacy Policy, or requests regarding your personal information, can be sent to support@redrubric.com.