Legal

Privacy Policy

Last updated: July 1, 2026

Rebuildr is built local-first: the app runs on your machine, and most of what it does — scanning your hardware, applying tweaks, packing a Rebuild Pack — never leaves your computer. This page explains exactly what we collect when it does, why, and what we deliberately do not do with it.

What we collect

Account data. If you create an account, we store your email address and a securely hashed password (or your Google account identifier, if you sign in with Google). We use this solely to authenticate you and manage your subscription.
Hardware & system profile. To run the Optimizer, Driver Center, and Security Scanner, the app reads local system information — installed apps, driver versions, OS build, and configuration state. This stays on your device unless you explicitly export or sync a pack.
Rebuild Pack contents (Cloud Vault, Pro/Ultra only). If you opt in to Cloud Vault, your pack — apps list, tweaks, configs — is encrypted on your device before it ever reaches our servers.
Billing data. Payments are processed by our payment provider (e.g. Stripe/Paddle). We receive a subscription status and plan tier, never your full card number.
Basic usage diagnostics. Crash reports and coarse feature-usage counts (e.g. "optimizer run") help us fix bugs and prioritize features. These are anonymized and contain no personal or hardware-identifying content.

Zero-knowledge encryption

Cloud Vault uses client-side, zero-knowledge encryption: your Rebuild Pack is encrypted with a key derived from your credentials before it leaves your device. Rebuildr's servers only ever store ciphertext. We cannot read, decrypt, or reconstruct the contents of your vault — and neither can anyone who gains access to our infrastructure.

Local-first processing

Everything the desktop app does by default — scanning, optimizing, packing, restoring — happens entirely on your machine. Cloud Vault sync is an explicit, opt-in feature. If you never enable it, no pack content is transmitted anywhere.

What we never do

We do not sell, rent, or trade your personal data or Rebuild Pack contents to any third party.
We do not use your hardware or usage data to build advertising profiles.
We do not scan, index, or read the contents of your encrypted vault.

Data retention

Account data is retained for as long as your account is active. Encrypted vault data is retained until you delete the pack or close your account. You can request full account and data deletion at any time — see Contact below — and we will complete it within 30 days.

Third-party processors

We rely on a small set of infrastructure providers to operate Rebuildr: cloud hosting/CDN (for the website and API), a payment processor (for subscriptions), and error-reporting tooling (for crash diagnostics). Each processes only the minimum data required for its function and is bound by its own data-protection terms.

Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Write to us using the contact details below and we'll respond promptly.

Children

Rebuildr is not directed at children under 16, and we do not knowingly collect data from them.

Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above and, where appropriate, notify active account holders by email.

Contact

Questions about this policy or your data: contact@getrebuildr.com

This document is a genuine, complete policy draft intended for a real product launch — it is not a substitute for review by a qualified lawyer in your jurisdiction before going live commercially.