Privacy policy
Last updated: 12 October 2026
This policy explains what data Roook processes when you use the Roook website (https://www.roook.dev) and the Roook web app. The service is run by Aayush Kumar, operating Roook. It describes only what the app does today.
Aayush Kumar is an individual based in India. Roook is not incorporated as a company, so "Roook" and "the operator" on this page mean Aayush Kumar.
Who is responsible
Aayush Kumar, operating Roook, decides how the data described here is used and answers every request about it. Contact: aayush@roook.dev.
What is collected
Sign-in uses Google through Supabase Auth. Supabase holds your account: your email address, name and the profile data Google provides.
- Runs: the owner (your user id, or a guest key), the repository kind and reference, the status, timestamps and the IBM Bob coins used.
- Each run's event log, with keys and tokens redacted. It includes the request text you type into the composer and the chat.
- Counterexamples found by runs.
- If you connect GitHub: a user record with your Supabase user id, email address, GitHub installation id and the time it was created.
- Guest quota records, per day, keyed by the guest cookie id and by your IP address.
- Rate-limit counters per IP address, kept in memory only.
- If you email aayush@roook.dev: your email address and what you write. It stays in the Roook mailbox and is not copied to the Roook server.
Where it is stored
- Supabase holds your sign-in account.
- The Roook server keeps runs, event logs, counterexamples, user records and guest quota rows in a SQLite database on AWS EC2 in US West (Oregon).
- The website is hosted on Vercel.
- If you connect GitHub, short-lived installation tokens are kept in memory only.
Who receives it
Roook does not sell your data.
- Supabase, for sign-in.
- Vercel and AWS, which host the website and the server.
- GitHub, only if you connect it: Roook reads your installation's repository list from GitHub.
- Zoho Mail, which hosts the Roook mailbox, only if you email Roook.
- IBM Bob, for live runs only: repository content and run data are sent to IBM Bob as prompts. Recorded example runs send nothing to IBM Bob.
How long it is kept
- Runs, with their events and counterexamples, are deleted automatically after 30 days.
- Guest quota rows are deleted automatically after 2 days.
- Your Supabase sign-in account is kept until you ask for it to be deleted.
How to delete your data
- Delete a single run, with its events and counterexamples, from the web app.
- Delete all your data on the Roook server (your runs and the GitHub link) from the account menu in the web app.
- To delete your Supabase sign-in account, email aayush@roook.dev. The Roook server cannot delete it, and there is no self-serve option yet.
No analytics or tracking
There are no analytics, ads or tracking scripts on the site or in the app.
Changes to this policy
If this policy changes, the new version is published on this page with a new "Last updated" date.
Contact
Privacy questions and requests go to Aayush Kumar, operating Roook, at aayush@roook.dev. This policy is governed by the laws of India.