Privacy

The short version

• No data is collected by the developer. There is nowhere for it to go — Rulebook has no backend.
• No analytics, no tracking, no advertising identifier, no third-party SDKs of that kind.
• Your rules live in your mailbox. The app edits them in place; it does not keep a copy anywhere else.
• Rulebook does not read your mail.

What the app reads

Signed in to a Microsoft 365 or Outlook.com account, Rulebook reads and writes:

• Your mail rules — names, conditions, actions, order, and whether each is enabled. This is the entire point of the app.
• Your folder names — so a rule can say “Move to Finance/Invoices” instead of an opaque identifier.
• Your account name and address — shown so you can tell which mailbox you're looking at.

A permission that is broader than the app's use of it

Listing your folders through Microsoft Graph requires a permission that also grants access to message senders, recipients and subjects. Rulebook does not read them, and there is no code in the app that does — but the grant you see on the Microsoft consent screen is wider than what the app actually uses, and you should know that before approving it rather than discover it afterwards. The source is public if you want to check.

Message bodies are never requested at all. Rulebook does not ask for the permission that would allow it.

Where things are stored

Sign-in tokens are held in the iOS Keychain on your device, managed by Microsoft's authentication library. They are not transmitted to the developer, because there is no developer-controlled server to transmit them to.

Rules are cached on the device so the list can be shown before the network responds. Deleting the app removes the cache and the tokens together.

Who your data is shared with

Nobody. Rulebook makes network requests to Microsoft, on your behalf, using your own credentials. That traffic is governed by Microsoft's privacy terms and — for a work or school account — by your organisation's policies, both of which apply exactly as they already do to your mailbox.

There are no other network destinations.

Children

Rulebook is not directed at children. It requires an existing mail account to do anything at all.

Removing access

Sign out from Manage accounts in the app, which deletes the token from your phone. To revoke the grant itself, use account.live.com/consent/Manage for a personal Microsoft account, or myapps.microsoft.com for a work or school account.

Changes, and how to ask

If this policy changes, the updated version appears on this page and the date below changes with it. Questions are welcome as a GitHub issue, or by email to jeff@steinbok.net.