RUFINE · 10 October 2026
Privacy Policy
This policy explains how Rufine handles information when you use Rufine (Android package com.bugbug.rufine).
Information you provide
Your phone number verifies your account. We store your profile name, optional username, about text and profile photo, account settings, and device sessions. Your profile and activity are visible to others according to your privacy settings.
Messages, media and calls
The app encrypts message content, chat attachments and status content on your device for recipients. Our servers process encrypted content and delivery information, including sender and recipient identifiers, group membership and timestamps. Profile photos and group details are not end-to-end encrypted. Calls use WebRTC encryption; signaling and call history are processed by the service. Encryption does not hide account information, who communicates with whom, or call times from the service. Recipients can save or share content you send.
Contacts
Contact sync is optional. After you agree and grant contacts permission, Rufine reads phone numbers from your address book and sends international-format numbers to the server to find registered users. Matched users are saved in your Rufine contacts. Address-book names and other address-book fields are not uploaded by contact sync. You can add a contact manually without granting this permission.
Camera, microphone, files and location
Camera and microphone access is used when you take a photo, record a voice message or make a call. Files and photos you select can be shared in chats or status updates. Location permission is used when you choose to share your current location in a chat. Rufine does not request background location access. You can deny or revoke permissions in device settings; features requiring them may be unavailable. Tapping Open in maps sends the selected coordinates to OpenStreetMap in your browser; its own privacy policy then applies.
Technical information
The service processes account and installation identifiers, device platform and session names, IP addresses, authentication and security events, delivery receipts, notification preferences, and call metadata to operate the service and prevent abuse. The reviewed app contains no advertising or third-party analytics SDK. Network and server logs can contain request metadata.
Reporting content
When you choose Report on a message, the app may attach decrypted recent messages from the reported sender for the moderation team to review. A profile-only report includes your reason and account identifiers. Do not include unrelated sensitive information. Reports are used to investigate abuse and enforce the Terms of Service.
How information is used and disclosed
Information is used to authenticate users, deliver communications, match contacts, maintain settings, provide support and enforce safety rules. Recipients receive information you choose to share. Hosting, storage, SMS delivery and call relay providers process information necessary to provide these services. Your telephone number is disclosed to the configured SMS provider to send sign-in codes. Push tokens are used if push delivery is configured. We may disclose information where required by law or necessary to investigate abuse and protect people. We do not sell personal data.
Storage and security
Production app traffic uses HTTPS and secure WebSockets. Device encryption keys and authentication secrets use platform secure storage. Message history and downloaded content also exist on your device; protect your device and exported files. No service can guarantee absolute security. Service providers may process data outside your country; contact us for details of the service providers and processing locations that apply to your account.
Retention and deletion
Account information is kept while your account is active. Status updates expire after 24 hours and are removed by the background worker. Disappearing messages use the timer selected in the chat. Delete your account in Settings → Delete account or use the public Delete account page without installing the app. Deletion removes your profile details, sessions, contacts, settings, server-side messages you sent, statuses and owned media records; file removal is queued for retry if storage is unavailable. Other people may retain already downloaded messages, screenshots or exports. Abuse reports may be retained while a safety case is open and for up to 180 days after resolution; these are used for safety and legal obligations. Any data retained in infrastructure logs or backups is restricted to security, disaster recovery and legal obligations. Contact us for the applicable retention period. Deleted accounts must not be restored to active use from backups.
Your choices and rights
You can edit your profile, manage privacy settings, revoke device sessions, block or report users, revoke device permissions, and delete your account. Depending on your location, you may have rights to access, correct, erase, restrict or object to processing, request portability, withdraw consent, and complain to your local data protection authority. Contact us to make a request; proportionate verification may be required.
Children and safety
Rufine is not designed for children under 13 or anyone below the minimum age required in their country. Do not use the service if you do not meet that age. Report suspected child exploitation or other illegal content using Report on a user profile and the support contact. Do not forward illegal material.
Changes and contact
We will update this page when practices change and provide appropriate notice for material changes. Contact Rufine at connectbugbug@gmail.com for support, privacy requests and safety concerns.