1.Who we are#
Redwain Cloud is operated by [LEGAL ENTITY NAME] (“Redwain”, “we”, “us”), [MAILING ADDRESS].
This policy covers the Redwain Cloud hosted service: the account system, the web portal at redwain.com, and the storage and sync backend used by our Homedrive file sync app and our Basu notes app. It does not cover anything you do with those apps purely on your own device, and it does not cover other companies’ websites or services.
2.Information we collect#
Account information
Your email address, and a verification status for it. Accounts are managed through Amazon Cognito. Your password is set and verified by Cognito’s hosted sign-in; Redwain never receives or stores your password.
Content you store
The files you sync with Homedrive, and the notes and shared spaces you keep in Basu, including their names, folder structure, sizes, and content hashes. This content is stored so we can hold it for you and sync it between your devices. Please read section 7 for what that means in practice.
Service metadata
Information generated by using the service: bytes stored, file counts, storage quota and usage, timestamps for uploads and changes, device sync bookkeeping, and server logs (including IP address, request paths, and error details) kept for security, abuse prevention, and debugging.
Support communications
If you open a support ticket, we store the ticket, the messages in it, and our replies, associated with your account.
Billing records
If you subscribe, we store your subscription status, the plan you bought, your storage allowance, renewal dates, and an identifier for your customer record with our payment processor. Card numbers and payment credentials never touch Redwain’s systems — the entire payment flow is handled by Stripe.
AI assistant content (only if you use it)
If you use the optional AI assistant, we process the messages and note content you submit to it, and we retain a record of usage (model, token counts, and cost) for metering. See section 6.
3.What we do not collect#
- We do not use third-party analytics, advertising trackers, or advertising identifiers.
- We do not run ads, and we do not build advertising or marketing profiles about you.
- We do not receive or store your payment card details.
- We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
- We do not use your files, notes, or assistant conversations to train machine-learning models.
4.How we use information#
- To provide the service: store your content, sync it across your devices, and serve it back to you.
- To authenticate you and keep your account secure.
- To measure storage use and enforce plan limits.
- To process subscriptions, renewals, and cancellations.
- To answer your support requests.
- To detect, investigate, and prevent abuse, fraud, and security incidents, and to diagnose and fix problems.
- To send service messages about your account, billing, or material changes to the service.
- To comply with legal obligations.
6.The optional AI assistant#
Basu can offer an AI assistant. It is optional and it is not running in the background: nothing is sent to an AI provider unless you actively use it.
- When you send a message to the assistant, that message — along with any note content you attach or ask it to work on, and the earlier messages in that conversation — is transmitted to OpenRouter, which routes it to the model you selected for processing, and the response is returned to you.
- Content you never send to the assistant is never transmitted to OpenRouter or any AI provider.
- We keep a usage record (model, token counts, cost, timestamp) so we can meter assistant usage against your budget. That record does not include the text of your messages.
- OpenRouter and the model providers it routes to handle that content under their own terms and privacy policies. If you are not comfortable with specific content leaving Redwain, do not submit it to the assistant.
- We do not use your assistant conversations to train models.
7.Security — and its limits#
What we do:
- Your stored content is encrypted at rest with AES-256 server-side encryption.
- All traffic to and from the service is encrypted in transit with TLS 1.2 or better.
- Each account’s content lives under its own isolated storage prefix, enforced by per-identity access credentials plus a second, independent deny-by-default policy layer, so one account’s credentials cannot reach another account’s data.
- Uploads go through short-lived, single-purpose signed URLs rather than broad storage access.
- Sign-in, password handling, and email verification are delegated to Amazon Cognito.
Redwain Cloud is not end-to-end encrypted. Your content is encrypted with keys that we control, not with a key only you hold. That means Redwain is technically able to access the content you store. We restrict that access to what is necessary to operate the service, respond to a support request you have made, or comply with a valid legal demand. If you need content that no one but you can ever read, encrypt it yourself before it is synced.
No online service can promise perfect security. We cannot guarantee that unauthorized access will never occur, and you are responsible for keeping your account credentials safe.
8.How long we keep information#
- Files and notes: kept until you delete them. When you delete a file in Homedrive, it stops counting against your storage allowance right away and stays recoverable for about 30 days, after which the underlying content is removed. Content replaced by a newer version of the same file is removed on a much shorter schedule (about a day), since a stale copy of an overwrite has no recovery value. Residual prior versions in our storage layer expire within a further 90 days.
- Account information: kept while your account is open. If you close your account, we delete your stored content and account record on the schedule above.
- Billing records: retained after account closure for as long as tax, accounting, and anti-fraud obligations require.
- Support tickets: retained after account closure so we have a record of what was asked and answered, unless you ask us to delete them.
- Server logs: retained on a rolling short-term basis for security and debugging.
Exceeding your storage limit never causes deletion. If you go over your allowance, new uploads are blocked, but reading, downloading, listing, and deleting your existing data continue to work normally.
9.Your California privacy rights#
This section applies to California residents under the California Consumer Privacy Act, as amended by the CPRA.
Categories of personal information we collect
| Category | Examples | Purpose |
|---|---|---|
| Identifiers | Email address, account identifier, IP address | Account creation, authentication, security, support |
| Commercial information | Subscription plan, purchase and renewal history | Billing and entitlement |
| Internet or network activity | Request logs, sync activity, storage usage | Operating the service, quota enforcement, security |
| Your content | Files, notes, and any personal information you choose to put in them | Storing and syncing it for you, at your direction |
| Customer records | Support tickets and messages | Responding to your requests |
We collect this information directly from you and from your use of the service. We disclose it for business purposes only to the service providers listed in section 5.
No sale or sharing
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months, including for consumers we know to be under 16. Because we do not sell or share, there is no opt-out to exercise.
Sensitive personal information
We do not request sensitive personal information. Your account credentials are handled by Amazon Cognito for sign-in only. If you choose to store sensitive information inside your own files or notes, we use it only to provide the storage you asked for — never to infer characteristics about you.
Your rights
- Know and access: request the categories and specific pieces of personal information we have collected about you.
- Delete: request deletion of your personal information, subject to the exceptions the law allows (for example, records we must keep for tax purposes).
- Correct: request correction of inaccurate personal information.
- Non-discrimination: we will not deny service, charge you a different price, or give you a lower quality of service for exercising any of these rights.
How to make a request
Email support@redwain.com from the email address on your account and tell us what you want. Sending your request from the account address, and being signed in when we ask you to confirm, is how we verify that a request is really yours; we may ask for additional confirmation for deletion requests. We will respond within the timeframes the law requires. An authorized agent may submit a request on your behalf with written permission that we can verify.
10.Children#
Redwain Cloud is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account or given us personal information, email support@redwain.com and we will delete it.
12.Changes to this policy#
We may update this policy as the service changes. When a change is material, we will notify you by email or through the portal before it takes effect. The “Last updated” date at the top always reflects the current version.
13.Contact us#
Questions, requests, or privacy concerns: support@redwain.com, or write to [LEGAL ENTITY NAME], [MAILING ADDRESS].