Privacy Policy
Effective date: June 18, 2026.
Last updated: June 18, 2026.
Hosting region: All operational data is hosted in the European Union, in Frankfurt am Main, Germany.
Operated by: an individual developer ("Brume", "we", "us"). Brume is not a registered company.
This Privacy Policy describes what personal information Brume collects, why, how long we keep it, who we share it with, and how you can exercise rights over it. It applies to the marketing website at brume.run, the dashboard at app.brume.run, the application programming interfaces, and the TypeScript SDK packages (collectively, the "Service").
1. Roles
For the data described in this Policy, Brume is the data controller under the EU GDPR (and equivalent roles under other applicable data protection law, including the UK GDPR for UK users). You are the data subject. If you are an organization that uses Brume to rate-limit traffic from your own end users (for example, by sending identifiers that refer to your end users), you are the data controller for your end users' data, and Brume acts on your written instructions as a data processor.
See § 10 below for processor-specific commitments.
All operational infrastructure for the Service runs on a single virtual private server in Frankfurt am Main, Germany, provided by our sub-processor Datalix.eu (Equinix FRA data center). This means:
- The rate-limiting gateway (
crates/core).
- The Postgres database that backs the dashboard and Better Auth.
- The Redis instance used for rate-limit counters, windows, and quota state.
- The SMTP server that delivers account verification, password reset, and account-deletion emails.
are all co-located on the same VPS. There is no separate cloud database or third-party email provider.
2. Information we collect
2.1 Account information
When you create an account, we collect:
- Email address (verified via a one-time link)
- Display name (you choose)
- A salted and Argon2id-hashed password (we never store the plaintext)
- Time of account creation and last sign-in
- IP address and user-agent string of sign-in events (for security audit; retained 30 days)
2.2 Billing information
Payment information (card number, billing address) is collected and stored exclusively by Polar.sh, our payment processor. We receive from Polar.sh only:
- A Polar.sh customer identifier
- A Polar.sh subscription identifier
- The plan tier (free / starter / pro / business) and the billing interval
- The subscription status (active / cancelled / past_due)
We do not see, store, or transmit your card details.
2.3 Service usage data
We collect aggregate metrics about how the Service is used:
- Per-project: rate-limit evaluations (allowed, denied, degraded), evaluation latency percentiles, daily check budget usage, rule and quota state, authentication failures.
- Service-wide: aggregate request counts and error rates.
These metrics are aggregate. They are not tied to your end users' identities, and they do not contain request payloads.
2.4 What we do not collect
- Request payloads. A rate-limit check carries a namespace, an identifier, and a cost — there is no body to log, and the Service does not store request payloads. This is enforced in code (
crates/core); it is not a configurable option.
- Debug logs of payload content. Server logs capture evaluation outcomes, errors, and metrics only.
- Cookies set by third-party advertising or cross-site tracking networks. The marketing site sets a small set of essential cookies and an optional analytics cookie described in § 7.
3. How we use information
We use the information we collect to:
- Provide the Service (authenticate you, evaluate your rate-limit checks, render the dashboard).
- Detect and prevent abuse, fraud, and attacks on the Service.
- Send you transactional emails: account verification, password reset, billing notices, account-deletion receipts, security incidents that affect you.
- Improve the Service: capacity planning, performance tuning, prioritizing engineering work.
- Comply with legal obligations and respond to lawful requests from public authorities.
We do not use your data for advertising. We do not sell your personal information. We do not share request payloads with anyone — there are none to share.
4. Sub-processors
We use the following sub-processors to operate the Service:
| Sub-processor | Purpose | Location | Data they receive |
|---|
| Datalix.eu | VPS hosting for all Service infrastructure (gateway, Postgres database, Redis, SMTP server) | Frankfurt am Main, Germany (Equinix FRA) | Rate-limit check traffic (namespaces, identifiers, costs), account metadata, project metadata, API key hashes, audit logs, Postgres metadata, Redis counter and quota state, sign-in audit data, anonymized billing identifiers |
| Polar.sh | Payment processing and subscription management | EU (varies) | Customer id, plan tier, billing status |
Datalix.eu acts as a sub-processor for the operational data hosted on their infrastructure. Their published terms and DPA apply: see datalix.eu/legal.
Polar.sh acts as an independent data controller for the payment data they collect. Their privacy policy applies to that data: see polar.sh/legal/privacy.
Because the gateway, database, Redis, and SMTP server are co-located on the same VPS, there is no third-party database, email, or caching sub-processor. If we ever introduce one, this section will be updated and you will be notified by email at least 30 days in advance. You may object to a new sub-processor; if we cannot resolve the objection, you may terminate your account.
5. International data transfers
All operational infrastructure for the Service runs on a single VPS in Frankfurt am Main, Germany, in the European Union. By default, your data does not leave the European Union.
Some sub-processors may process your data outside the EU. Polar.sh, our payment processor, may transfer payment-related data outside the EU in the course of providing their service; Polar.sh's published safeguards apply to that data. We require sub-processors to maintain appropriate safeguards for any cross-border processing.
If you are based in the European Economic Area, the United Kingdom, or Switzerland, your operational data stays within the EU and no transfer safeguards are required for the operational infrastructure.
If you are based outside the EEA, UK, or Switzerland, your data is still hosted in the EU. You understand that any data you submit to the Service will be transferred to and processed in the European Union, where the data protection standards may differ from your home jurisdiction. We rely on the European Commission's Standard Contractual Clauses (or equivalent safeguards adopted by the UK or other jurisdictions) for transfers out of the EU to jurisdictions that require such safeguards.
If you are based in a jurisdiction that restricts cross-border data transfers and you object to your data being hosted in the EU, do not use the Service or terminate your account.
6. Data retention
| Data category | Retention period |
|---|
| Account record | Until you request deletion, plus a 30-day grace window |
| Password hash | Until account deletion |
| Sign-in audit log | 30 days |
| Polar.sh billing identifiers | 7 years (required by applicable tax law) |
| Project records (id, name, tier) | Until you delete the owning account; tombstoned afterward with no PII |
| API keys (Argon2id hashes) | Until you revoke the key or delete the account |
| Webhook endpoints | Until you delete them or delete the account |
| Aggregate service metrics | Indefinitely, non-personally-identifiable |
| Request payloads | Never stored |
| Rate-limit counters | Until the window closes; ephemeral Redis state |
After account deletion, your email is anonymized in any audit records we are obligated to retain for billing (Polar.sh invoices). Specifically, your email is replaced with deleted-<receipt-id>@brume.invalid, where <receipt-id> is a random opaque identifier generated at deletion time. We retain the mapping table only for the period required by applicable tax law (7 years) and only for billing reconciliation; we do not use it to re-identify you.
7. Cookies
7.1 Marketing site (brume.run)
- Essential cookie: a single session token if you sign in to a customer account from the marketing site (rare; most users sign in via the dashboard).
- Optional cookie: a first-party analytics cookie (
brume_analytics) if you accept analytics cookies via the cookie banner. The analytics cookie is set by a self-hosted Plausible-compatible counter; it does not identify you across sites and does not share data with any third party.
- Preference cookie:
brume_theme stores your dark/light mode preference.
7.2 Dashboard (app.brume.run)
- Essential cookie: a Better Auth session token (
__Secure-better-auth.session_token in production). This cookie is HTTP-only, Secure (HTTPS only), SameSite=Lax, with a 7-day expiry. We set this cookie exclusively to keep you signed in.
- No analytics cookies are set on the dashboard.
7.3 Cookie controls
You can clear cookies at any time via your browser settings. Clearing the dashboard session cookie signs you out. Clearing the marketing site cookies resets your theme preference and any analytics opt-in state.
8. Security
We use industry-standard safeguards: TLS 1.3 in transit, Argon2id for password hashing, secrets redacted from logs (Config::Debug redaction in crates/core). API keys are stored as Argon2id hashes; the plaintext key is shown to you exactly once at creation and cannot be recovered afterward.
No system is perfectly secure. If we become aware of a security incident affecting your personal data, we will notify you by email and, where required by law, notify the relevant supervisory authority.
9. Your rights
We extend the following rights to all users regardless of jurisdiction. Some of these rights are statutory in the EU and UK; others are extended voluntarily to match GDPR-equivalent standards globally.
| Right | How to exercise it |
|---|
| Right to access | Email privacy@brume.run. We will respond within 30 days. |
| Right to rectification | Update your name in the dashboard Settings tab. |
| Right to erasure | Delete your account from the dashboard Settings tab (see § 6). |
| Right to data portability | Email privacy@brume.run. We will provide a JSON export of your account data within 30 days. |
| Right to restriction of processing | Email privacy@brume.run. We will pause non-essential processing. |
| Right to object to processing | Email privacy@brume.run. |
| Right to withdraw consent | Delete your account or email privacy@brume.run. |
| Right to lodge a complaint | You may complain to the data protection authority in your jurisdiction. EU users may complain to their national supervisory authority. UK users may complain to the ICO. |
We do not make decisions about you solely by automated processing that produce legal or similarly significant effects.
10. When you put your end-user data through Brume
If you use the Service to rate-limit traffic from your own end users (for example, by sending identifiers that refer to your end users), you are the data fiduciary / data controller for that data. Brume processes it on your written instructions (these Terms and the Acceptable Use Policy constitute your written instructions) as a data processor / data processor.
We commit to:
- Process your end-user data only to provide the Service to you.
- Not sell, share, or use your end-user data for our own purposes, advertising, or model training.
- Notify you without undue delay if we become aware of a personal data breach affecting your end-user data.
- Make available to you all information necessary to demonstrate compliance with this section, subject to reasonable confidentiality.
- Delete your end-user data from operational systems within 30 days of account deletion, except where retention is required by law (see § 6).
We do not currently offer the EU Commission's Standard Contractual Clauses as a signed exhibit; if you require signed SCCs as a condition of procurement, contact legal@brume.run before signing up. Brume is a hobby SaaS at the current scale and may decline to sign enterprise procurement documents.
11. Children
The Service is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, email privacy@brume.run and we will delete the account.
12. Changes to this Policy
We will notify you by email and on the dashboard of material changes at least 14 days before they take effect. Non-material changes (clarifications, contact details, link updates) take effect immediately on publication.
13. Contact
- Privacy email:
privacy@brume.run
- Postal address: not provided. Written notices sent by email are valid.