1. What rulix calc processes
This policy covers calc.rulix.ch and the rulix calc iOS app. A workspace may include its title, expressions, results, formatting settings, language, theme, time zone, holiday region and selected rate source.
When you calculate without an account, without saving a shared copy and without enabling audience measurement, workspace content is evaluated on your device. The infrastructure still receives the ordinary technical data required for a network request, such as IP address, headers, user agent and request time.
- Derived or bucketed network-address keys are used to limit abuse of sign-in requests and anonymous saves.
- The calculation engine does not send your expressions to an external AI model or advertising service. The optional iOS assisted-building feature uses only the Apple Intelligence model present on the device.
2. Data kept on your device
On the web, local saving is optional and depends on Preferences consent. When enabled, the browser keeps the full workspace and its settings in localStorage. Consent choices, dashboard view preference and some temporary sharing identifiers may also be kept locally or for the browser session.
If you deliberately sign in to continue an anonymous calculation, that workspace is held on the same device for up to 20 minutes under a random identifier. Only the opaque identifier travels in the sign-in URL; the email never contains the calculation. The temporary workspace is deleted after a successful transfer, an explicit discard, or expiry cleanup.
On iOS, the calculation library and a rate cache may be kept in app storage. An export can also be placed temporarily on the pasteboard, in a share file or with the extension you choose. System backups may follow your Apple device settings.
The iOS smart capture feature recognizes text directly on the device using Apple APIs. Camera images and video frames are neither stored by rulix calc nor sent to the service. Only text shown in the preview and then confirmed is inserted; if it is added to a cloud sheet, it is subsequently synchronized like the rest of that sheet.
On compatible devices, “Build with Intelligence” can turn a natural-language request into a calculation draft using the Apple Intelligence model running on the device. The request, reference templates and generated draft are not sent to the rulix calc service. The Rulix engine then verifies the draft locally and the user must confirm insertion; if a cloud sheet is selected, the confirmed text is then synchronized like the rest of that sheet.
You can use “Forget saved copy” on the web, clear site data in the browser, or delete local calculations in the app. Those actions do not erase a cloud sheet or public copy created separately.
3. Optional account and cloud sheets
Sign-in is passwordless. To create or use an account, the service processes your email address and normalized email, an optional display name, verification and terms-acceptance timestamps, and session/security tokens stored as server-side hashes.
The service also keeps teams, roles, invitations, collaborators, permissions, edit locks and sheet data needed for cloud work. Managed sheets include current content and earlier revisions. Authorized team or sheet members can view or edit them according to their permission.
Resend delivers sign-in and invitation email. If web billing is used, Stripe processes payment and the service stores subscription identifiers, access level, seat count and any selected professional attestation. The iOS app has no in-app purchases.
5. Exchange rates and external data
For currency conversion, the app sends the selected rate provider and, optionally, a date to the server. The server then fetches publications from the Swiss fiscal authorities or the European Central Bank. Your expression and result are not sent to those providers.
The selected rate source and date may form part of a saved workspace. Public rate responses may be cached for availability.
7. Hosting and providers
Cloudflare hosts the application and D1/R2 storage. Resend provides transactional email; Stripe is involved only in web billing; Google is involved only when analytics is accepted. Public rate sources are contacted by the server.
Depending on their infrastructure and subprocessors, these providers may process data in Switzerland, the European Economic Area, the United Kingdom and the United States. A transfer outside Switzerland or the EEA relies, as applicable, on an adequacy decision, recognized contractual clauses or another safeguard allowed by applicable law. You may request details about the safeguards used through the contact below.
8. Retention and deletion
Local data remains until the user, browser or system removes it. A session expires after seven idle days and no later than 30 days. Sign-in links expire after 15 minutes and their records become eligible for purge 48 hours later. Expired or revoked sessions become eligible after seven days, and completed invitations after 90 days. Maintenance runs in bounded batches, so these are eligibility thresholds rather than guarantees of immediate physical erasure.
“Delete my account” reserves and locks the deletion, cancels associated Stripe subscriptions and customers, erases cloud sheets and revisions, revokes sessions and locks, removes memberships, then anonymizes email address, display name, invitations and sign-in links. The operation is designed to resume after interruption. A technical tombstone without content or direct identity may remain to prevent a revoked reference from being reused and to preserve necessary service integrity.
Deletion may require an owner to transfer a shared team first. It does not erase calculations kept only on the device or a separately created public copy that was not revoked. A cloud sheet moved to Trash is hidden immediately, restorable for 30 days and then deleted in batches. The service keeps the first revision and at most the 100 latest revisions of an active sheet. Stripe may retain particular transaction records where accounting law or another legal duty requires it.
9. Purposes, legal grounds and rights
Processing needed for accounts, synchronization, requested sharing and delivery of the calculator is based on providing the service you request. Security, abuse prevention and reliability rely on the legitimate interest in protecting the service and its users. Optional local storage and Analytics rely on your consent. Some billing data may be processed to meet legal obligations.
Depending on applicable law, you may request access, correction, erasure, restriction, objection or portability, and withdraw consent at any time without affecting earlier processing. You can refuse local saving and Analytics, export account sheets as JSON/TXT/CSV, manage members and delete a sheet in the interface.
The iOS Account screen can initiate complete account deletion directly. You can also exercise your rights through the contact below. You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where European law applies, to your local supervisory authority.
Sessions use secure cookies or native tokens, mutations are protected, sensitive tokens are hashed on the server and access is checked by sheet and team. No system offers absolute security, so protect sharing links as you would any link-accessible document.
10. Children, automated decisions and changes
rulix calc is a general-purpose tool and is not designed specifically for children. Where parental authorization is required to create an account or synchronize data, it must be obtained before those features are used. A guardian may contact us if they believe a child supplied data without valid authorization.
The calculator and assisted-building feature produce results or drafts for the user to verify. They do not make decisions that have legal or similarly significant effects on a person and do not perform advertising profiling.
This policy may change when features, providers or applicable rules change. The date above identifies the current version. A material change will be communicated appropriately in the service or through renewed acceptance when required.
Controller, contact and requests
These legal details and operating rules come from service configuration; the application never guesses or invents them.
- Data controller
- Damien Hottelier
- Privacy contact
- calc@rulix.ch
- Additional retention rules
- Local data remains until erased. A session expires after 7 idle days and no later than 30 days; sign-in links after 15 minutes and native codes after 5 minutes. A deleted cloud sheet remains restorable for 30 days. An unlisted public copy becomes eligible for removal after one year. Account deletion erases or anonymises direct identifiers and resumes automatically after interruption; only data strictly required for legal duties, security and technical cycles may remain.
- Account deletion and requests
- On the web, open the dashboard, then account settings, and choose “Permanently delete my account”; the same action is available in the iOS app. To request access, correction, objection, portability or deletion, email calc@rulix.ch.