Legal
Privacy Policy
This Privacy Policy describes how Ruwad Connect ("we", "us", or "the Service") collects, uses, stores, and protects information when you use the Ruwad Connect web platform, desktop application, and related services. By using our services, you acknowledge the practices described in this policy.
1. Information We Collect
1.1 Account Information
When you register, we collect your name, email address, organization name, and password (stored in hashed form). Organization administrators may also provide team member details.
1.2 Usage & Activity Data
We collect time tracking entries, project/task associations, activity levels (counts of keyboard and mouse input, never the keys typed), the name of the active application and its window title, and, when your organization records them, the addresses of the websites in use, to provide productivity insights to your organization.
1.3 Screenshots
When enabled by your organization, the desktop application captures periodic screenshots during tracked work sessions. Screenshots are taken at configurable intervals set by your organization administrator, within the limit of its plan. You will always see a visible indicator when tracking is active.
On plans that include AI analysis, screenshots are also analysed by an AI service to describe and categorise the work shown. Section 6 explains what is sent, to whom, and who decides whether it is used.
1.4 Verification Images
If your organization enables identity verification, webcam images may be captured at random intervals during work sessions to confirm identity. Camera access requires explicit operating system permission and is clearly indicated.
1.5 Device Information
We collect basic device metadata including hostname, operating system, and local IP address to help identify device sessions.
1.6 Payment Information
Payment processing is handled by Stripe. We do not store credit card numbers. Stripe's privacy policy governs payment data handling.
2. How We Use Information
- Provide and operate the time tracking, activity monitoring, and team management services
- Generate reports and analytics for organization administrators
- Analyse screenshots with AI to describe and categorise work, when your organization's plan includes AI analysis (section 6)
- Process billing and subscription management
- Send transactional emails (invitations, password resets, billing notices)
- Maintain security and prevent unauthorized access
- Improve the service based on aggregated, anonymized usage patterns
3. Data Storage & Security
Account data and tracking records are stored in a MongoDB database on a server we operate at Hetzner in Germany. Screenshots, webcam verification images and file attachments are stored in a private Hetzner object storage bucket in Nuremberg, Germany. The bucket has no public address: each file is opened through a signed link that expires within 15 minutes. All data in transit between the apps and our servers is protected by TLS (HTTPS).
We implement industry-standard security measures including:
- Bcrypt password hashing with salt
- JWT-based authentication with short-lived access tokens
- Role-based access control (RBAC)
- Rate limiting on authentication endpoints
- HTTPS enforcement on all endpoints
4. Data Retention
We retain your data for as long as your organization's account is active. Screenshots are kept for the period your organization's plan sets: 30 days on the Free plan, 365 days on Starter, and with no time limit on Professional and Enterprise. Webcam verification images are kept for 365 days on Starter and Professional and with no time limit on Enterprise. Your organization can choose a shorter period. A job runs every night and deletes the files that have passed it.
Upon account deletion, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., billing records).
6. AI Analysis of Screenshots
On plans that include AI analysis, screenshots are analysed by an AI model that writes a short description of the activity, assigns a work category and a focus score, and flags activity that appears unrelated to the person's work. The results are shown to the organization's managers and administrators, and the same AI service writes daily and weekly summaries from them.
6.1 What is sent
A copy of the screenshot reduced to at most 1,024 pixels on its longest side (smaller still, or blurred so that text cannot be read, if the organization chooses), together with the active application, window title and website address (without its query string), the activity level of the capture, and work context such as the person's role, the assigned project and task, and the categories of the person's recent screenshots. The organization can choose not to send the project and task. The person's name is not sent.
6.2 Who receives it
OpenAI, in the United States, processes this data as our sub-processor. This means screenshots of organizations that use AI analysis are transferred to the United States. Under OpenAI's API terms, data sent through its API is not used to train its models and is kept only for a limited period for abuse monitoring. If an organization connects its own AI provider account (OpenAI, Google or Anthropic) in its settings, its screenshots are sent to that provider under the organization's own agreement with it.
6.3 What is not sent
Screenshots that are stored blurred are not analysed. Nothing is sent for organizations whose plan does not include AI analysis or whose administrator has turned analysis off, or for members their organization has excluded from analysis. An organization can also choose to analyse only a share of its screenshots.
6.4 Your choices
Your organization decides whether AI analysis is used, and for which members. If you are a member of an organization and have questions about it, contact your organization administrator, or email us at cs@ruwadconnect.com.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Object to or restrict certain data processing
- Withdraw consent for optional data collection (e.g., verification images)
To exercise these rights, contact your organization administrator or email us at cs@ruwadconnect.com.
9. Desktop Application
The Ruwad Connect desktop application runs locally on your device and communicates with our servers over encrypted connections. The desktop app:
- Only captures data when you actively start a tracking session
- Shows a visible indicator while tracking is active: an icon in the Windows system tray or the macOS menu bar
- Keeps records that have not been uploaded yet in a local queue on your device, and sends them when an internet connection is available
- Encrypts your sign-in tokens with the operating system's protected storage (Windows data protection or the macOS Keychain) where the operating system provides it
- Can be uninstalled at any time; the folder that holds its local settings and queue can then be deleted by hand
10. Children's Privacy
Ruwad Connect is designed for business use and is not intended for children under 16. We do not knowingly collect personal data from children.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of the service after changes constitutes acceptance of the updated policy.
12. Contact Us
For privacy-related inquiries, contact us at cs@ruwadconnect.com.