Privacy
Policy
RugaLab ("we", "us") is a one-person lab in Hong Kong that runs open experiments at the intersection of AI, digital marketing and search-trend intelligence. This policy explains what personal data we collect through rugalab.com (including the /blog section and the waitlist form), why we collect it, and the choices you have. We keep it short because we collect very little.
1. Who we are
RugaLab is operated by an individual based in Hong Kong SAR. For any privacy question, request or complaint, contact: [email protected]. We aim to reply within 7 days.
2. Data we collect
- Waitlist email. If you submit the waitlist form, we receive the email address you typed, submitted through Web3Forms to our inbox. Purpose: to send you launch news and experiment notes. Basis: your consent (you pressed "Sign me up").
- Analytics data. We use Google Analytics 4 (via Google Tag Manager) to count page views, referrers and approximate geography (country/city level). This includes standard Google Analytics cookies (e.g. _ga) and pseudonymised identifiers. Purpose: understand what content works. Basis: our legitimate interest in running and improving the site.
- Error logs. If a form submission fails, Sentry receives an error report that may include technical details of your browser session. It does not include your email. Purpose: fixing bugs. Basis: legitimate interest.
- Google sign-in (OAuth). If you use a "Sign in with Google" feature on any RugaLab tool, Google shares with us your account ID, name, email address and profile picture. We use them only to create your account, remember your sign-in, and show your name where relevant. We do not request or store your Google password — authentication happens entirely at Google.
3. Google API Services — Limited Use disclosure
RugaLab's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to operate the feature you used, and we do not use Google user data to serve advertising or to build profiles across sites.
4. Cookies
We set only functional and analytics cookies: the Google Analytics identifiers (_ga, _ga_*) set by googletagmanager.com, and no others. No advertising cookies, no cross-site tracking pixels, no social embeds. You can block or delete these cookies in your browser settings; the site keeps working without them.
5. Third parties we rely on
- Web3Forms — waitlist form delivery (the email you submit passes through their API to our inbox).
- Google — Google Analytics, Google Tag Manager, Google sign-in and Google Cloud hosting for some tools.
- Sentry (Functional Software, Inc.) — error monitoring.
- Cloudflare — content delivery, DNS and bot protection (may log request metadata such as IP address and user agent for security).
These providers process data on our behalf or under their own terms; each is bound by its own privacy policy. We do not share your data with anyone else, and we do not sell or rent it — ever.
6. Retention
Waitlist emails are kept until you ask us to delete them or until the waitlist purpose ends. Analytics data follows Google Analytics' standard retention settings. Error reports are deleted after 90 days.
7. Your rights
Wherever you live, we honour these requests: access (tell you what we hold), correction, deletion, and withdrawal of consent (e.g. unsubscribe — every email we send has an unsubscribe path, or just reply). If you are in Hong Kong, this site is operated in line with the Personal Data (Privacy) Ordinance (Cap. 486); if you are in the EEA/UK, we process on the bases of consent and legitimate interest as described above. Email [email protected] to exercise any right.
8. Children
RugaLab is not directed at children under 13, and we do not knowingly collect their data. If you believe a child submitted data, contact us and we will delete it.
9. Security
The site is served over HTTPS. Data lives in email inboxes and cloud services with access limited to the operator. As a one-person lab we keep the attack surface deliberately small — but no internet service can promise perfect security.
10. Changes
If we change this policy we will update the date above and, for material changes, note it on the site. Continued use after a change means you accept the updated policy.