Unplug the machine. Everything still works.

The update check

Twenty-five seconds after launch, and then every six hours, an installed copy asks GitHub whether a newer release exists. If one does it downloads in the background and installs when you next quit, never while you are working. Running from source never checks at all.

• • One HTTPS request to api.github.com for the release feed, carrying no identifier beyond what any HTTP request carries.
• • Nothing about your documents, your mail or your machine is sent.
• • It is a setting. Turn it off and no request is made at all: not a smaller one, none.

The announcement check

Once a day at most, the launcher asks this site whether there is an announcement worth showing you: a release, a security note or a change to the licence. It is also how we know the suite is being used at all: the server counts requests, and because a request carries no identifier of any kind, what is counted is “a copy of Rutba Office opened somewhere today”, never “this copy” and never “this person”.

• • One HTTPS request to office.rutba.io/announcement, carrying the version of Rutba Office and the name of your operating system, so a notice about a Windows problem is not shown to somebody on Linux.
• • No cookie, no identifier in the URL, no identifier in a file. Nothing about your documents, your mail or what you opened.
• • It is a setting, in the launcher, in one press. Turning it off stops the request and the announcements together. There is no version of this that reports without telling you anything back.

Servers you add yourself

Mail talks to the mail servers of the accounts you add, and since version 1.29.8 Calendar and Contacts can keep in step with a CalDAV or CardDAV server you add, such as iCloud or your own. Those connections go only to the address you typed, encrypted unless the server is on this computer, and carry only your own mail, events and cards. Remove the account and they stop. None of them goes to us.

Talk, if you use it

Talk is the one app that needs an account, because it connects you to other people. You sign in with a free Rutba account at auth.rutba.io, and Talk then keeps in touch with introducer.rutba.io, which finds your contacts and holds messages for them while they are offline. A call goes straight between the two computers where it can, and through our relay, turn-eu.rutba.io, where it cannot. If you never sign in to Talk, none of what follows exists.

• • The introducer keeps your Rutba account id, name and confirmed email address, when you last connected, and your contacts, blocks, requests and invitation links. It keeps no IP address and nothing about your devices.
• • A message for someone who is offline waits, encrypted, until it is delivered, and is then deleted. One that is never collected is deleted after 30 days.
• • Calls are encrypted end to end. The relay logs each call it carries: when it started and ended, your account id, your IP address and how much it relayed, never what was said. That log has a fixed size, so its oldest lines are overwritten as new ones arrive.
• • An invitation is kept until it is accepted or withdrawn, and for 30 days at most. The privacy policy has the rest, and how long each part is kept.