Rambler
How it works Join the beta Support Privacy

Privacy

What Rambler does with what you say.

Last updated 24 September 2026

Rambler is a place to talk out loud about things you haven't finished thinking. That only works if you know exactly where those words go. So this page is written to be read, not to be survived.

The short version

Who we are

Rambler is made by Simply Fluent. For anything on this page, use the form on the support page. It goes to a person, who writes back.

What stays on your phone

Recordings, transcripts, analyses, explorations, tags, notes and settings are stored in Rambler's own container on your device. If you have iCloud Backup switched on, iOS may include them in your encrypted device backup. That is Apple's backup of your phone, not ours, and we have no access to it.

Transcription runs on-device using a Whisper model. The first time you choose a language, Rambler downloads that model from Hugging Face (huggingface.co), which sees a normal file request: no account, no content. After that, recording and transcription work with no network at all.

The audio itself is short-lived. It exists while you are recording and while it is being transcribed, and once there is a transcript the recording is deleted. The one exception is a transcription that failed outright, where the audio is kept because it is still the only copy of what you said.

Deleting a rambling deletes its transcript, its analysis and any audio still held for it. Deleting the app removes everything at once. None of your ramblings are left behind on our side, because none of them were ever there. If you made an account, deleting it is covered below.

Nothing is trapped in the app either. Transcripts, analyses and explorations all export as plain Markdown files you can read anywhere, so leaving Rambler does not mean leaving your ramblings behind.

What goes to the AI

Analysis is the one part that isn't local, and it's the part you opt into. Use your own key, or, for a simpler setup, sign in with a Rambler account.

With your own key. You bring a key from a provider you already have an account with, and the request goes from your phone straight to them, billed to you at their prices. Rambler is not in the middle of that request and never sees it.

With a Rambler account. You sign in instead of bringing a key, and the request goes from your phone to Rambler's server, which passes it to OpenRouter, which passes it to Claude. Every request asks OpenRouter to use only endpoints with zero data retention. For Claude today those are run by Amazon (Bedrock) and Google (Vertex AI); Anthropic's own endpoint keeps prompts for 30 days, so it is never used. Rambler's server passes the text along and neither stores nor logs it: not the transcript, not the instructions, not the answer. Its logs hold status codes and OpenRouter's error messages, nothing more. What the account itself holds is set out below.

Before the first request, Rambler says where the text will go and asks you to agree. If you decline, nothing is sent. What we send when you agree:

We never send audio, your name, your email, your location, your contacts or any device identifier.

With your own key, once the text reaches your provider, their privacy policy governs it. How long they keep it, and whether they train on it, is between you and them. All four publish that:

Your API key is held in the iOS Keychain on your device and sent only to the provider it belongs to. It is never transmitted to us, and it can't be: there is nowhere to transmit it to.

The optional Rambler account

You only need an account to use analysis without your own key. Everything else in Rambler works without one.

It uses Sign in with Apple. Rambler asks Apple for neither your name nor your email, so Apple gives us neither. What Apple does give us is an identifier for your Apple Account that is unique to Rambler and means nothing anywhere else.

What Rambler's server keeps for an account:

That is the whole list. It never includes the text of a rambling, a prompt or an answer, and no email, name, phone number or location.

The server runs on Cloudflare Workers, and the account data is in a Cloudflare D1 database. Cloudflare handles each request, including your IP address, to run and protect the service, as it does for this website. The server itself doesn't record IP addresses.

Signing out ends the session on the server as well as on your phone. Deleting the account, under Settings → Providers → Rambler, removes everything in the list above from the server straight away and revokes Rambler's access to your Sign in with Apple. Your ramblings are on your phone and are not affected. A subscription is billed by Apple, so deleting the account doesn't cancel it; cancel it in your Apple Account settings first. If you can't reach the app, use the form on the support page and we'll delete the account for you.

Crash reports and usage signals

Two things come back to us. Both are anonymous, and neither contains any of what you said or typed.

Crash reports go through Sentry. When Rambler crashes or freezes, we get the stack trace, the app version, the iOS version, the device model, the language setting, and the state the device was in (free memory, battery, orientation), plus a list of what happened just before: the app moving to the foreground or background, which screens opened, named as they are in our code, and device events such as low memory or a dropped connection. That's what makes a crash fixable rather than merely countable.

Screenshots, view hierarchies, network request logging, failed-request capture and performance tracing are all turned off in our configuration. Before a report leaves the phone, the app removes the device hash Sentry adds by default, your time zone, and the titles of screens and buttons. Sentry is set not to store the IP address a report arrives from, or the location it would otherwise work out from that address.

Each crash report carries a random ID that Sentry creates when the app is installed, so that one phone crashing ten times can be told apart from ten phones crashing once. It is not your device's identifier, it is not linked to your name, your email, your Apple Account or a Rambler account, and reinstalling Rambler makes a new one.

Usage signals go through TelemetryDeck. These are named events, and the list is short and fixed: onboarding finished, a rambling started, a rambling analysed, an exploration started, an import finished, a model download finished, the purchase screen shown, a purchase completed, sending to an AI provider allowed, a sign-in started, finished or failed, a sign-out, an account deleted, and the Rambler allowance used up. That's all of them. Some carry one word of detail from a fixed list: which AI provider (for example "claude" or "hosted"), which purchase ("unlock" or "subscription"), which plan ("free" or "subscriber"), or where a sign-in failed ("apple" or "server"). They tell us which parts of the app people actually reach.

Each one carries the technical context TelemetryDeck attaches by default: app version and build, iOS version, device model, screen size, locale, time zone, and whether accessibility settings like Reduce Motion are on. There is no free-text content: no rambling titles, no tags, no transcript fragments, no glossary terms. Rambler doesn't send them, and there is no code path that could.

So that repeat use can be told apart from many first-time users, signals carry a per-install identifier: your device's vendor ID, salted and hashed with SHA-256 before it ever leaves the phone. The original value isn't sent and can't be recovered from the hash. Reinstalling Rambler on a phone with no other apps from us produces a new one, and it's not linked to your name, your email or your Apple Account, and it isn't linked to a Rambler account either.

Neither is used for advertising, neither is shared with data brokers, and Rambler does not track you across other apps or websites. Both live under Settings → Diagnostics and can be switched off independently, at any time, with no loss of function.

The two processors, so you can check them yourself: TelemetryDeck GmbH (Augsburg, Germany) and Functional Software, Inc., trading as Sentry (San Francisco, USA). Both run parts of their infrastructure outside the country they're registered in, which is normal for hosted services and covered by the transfer safeguards in their policies. Neither receives anything you said.

Notifications

Follow-ups and the daily digest are scheduled locally by iOS on your phone. No push server is involved and no notification content leaves the device.

Purchases

Purchases are handled entirely by Apple through the App Store. There are two: a one-time unlock for using Rambler with your own key, and a monthly subscription for analysis on a Rambler account. We never see your name, your payment details or your address.

For the one-time unlock, Apple tells the app whether this Apple Account owns it, and no purchase information is sent anywhere by Rambler. For the subscription, the app sends its transaction ID to Rambler's server, which asks Apple whether it is active and until when, so the monthly allowance can apply. That is described in the account section.

This website

tryrambler.com is static files on Cloudflare Pages. Cloudflare processes standard request logs (including IP addresses) to serve and protect the site, as any web host does. There is one script on the site, written by us and served from this domain, and it does the two things described below.

Nothing here sets a cookie to recognise you, on this site or anywhere else, so there is no consent banner to click past. Cloudflare may set its own short-lived security cookies, as it does on every site it protects.

Visits are counted on our own server. We run Umami, an open-source, cookieless analytics tool, at analytics.simplyfluent.com, on the same machine as the mailing list. A visit records the page, the page you arrived from, the country, the browser and the screen size, and which links and buttons were pressed. That is the whole list. There is no identifier that survives between visits, no profile, and nothing is sent to Google or to any advertising network. If your browser sends Global Privacy Control or Do Not Track, none of it runs at all.

There are two forms on it: the beta list and the support form. The beta list posts to this domain, and the address is written to a database we run at Cloudflare. Stored with it: the date, the two-letter country code, and the language your browser asked for. Cloudflare puts both of those on the request before it reaches us, so neither is asked for or measured, and nothing finer is kept. No name and no IP address.

The support form posts to this domain too, and what you write is stored in the same database with the address you gave, the date, the country code and the browser's language. It is kept so we can read it and reply from an ordinary mailbox, and is used for nothing else. The notification that reaches our chat says only that a message arrived, with the masked address, the country, the language and its length. The text of the message stays in the database. Ask in a message and we'll delete your earlier ones.

Both forms are checked for bots by Cloudflare Turnstile. To do that, Cloudflare is given your IP address, your browser's user agent and a fingerprint of the connection, and it answers with yes or no. It never sees what you typed, and we never see the signals it used. Their Turnstile privacy policy sets out what they do with them. A "no" does not turn you away: the submission is kept and marked as unchecked. For those only, the part of the address after the @ is looked up in DNS through Cloudflare's resolver, to see whether that domain can receive email at all. The rest of the address is not sent.

A copy of the address goes to Listmonk, the mailing-list software we run ourselves at list.simplyfluent.com, because something has to send the message. No third-party mailing service, form provider or marketing platform is in the path at any point. A one-line notification also reaches our own chat so a signup or a used invite gets noticed, and it carries a masked version of the address only (ma***@example.com), never the whole one.

The list is used for two things: an invite to the TestFlight beta, and one email when Rambler is on the App Store. When you sign up, one email confirms it. The invite carries a link made for your address, and when you open it we record the date it was first opened and how many times it has been opened, so we know whether an invite was used. It then sends you on to a public TestFlight link, so Apple is not given the address. Every message we send carries a link that takes you off the list, and asking through the form on the support page does the same at any time. After that the address is kept only so that nothing can add it back.

Children

Rambler isn't directed at children and we don't knowingly collect anything from anyone under 13.

Your rights

Under the GDPR and similar laws you have rights of access, correction, deletion, portability and objection. In Rambler's case most of them are already in your hands: your content is on your device, Settings exports all of it as JSON, and deleting the app erases it. Deleting a Rambler account in the app removes what the server holds about it. For the crash and usage signals, switching the toggles off stops collection, and asking through the form on the support page gets anything associated with your installation removed. We rely on your consent for those signals, and withdrawing it costs you nothing.

Changes

If this policy changes in a way that affects what leaves your phone, the app will say so before the change takes effect. The date at the top always reflects the current version.