What the browser stores and loads
Runic sets three first-party cookies, all classed as necessary. runic_session keeps you signed in: httpOnly, SameSite=Lax, Secure in production, 30 days, cleared on sign-out. runic_oauth_state protects a Google or GitHub sign-in against forgery for ten minutes. runic_consent records your cookie choice for 12 months. Local storage holds any work made before you had an account plus a signed-in user's custom step icons (runic.v1), a parked team invite (runic.pendingInvite) and, only with Preferences consent, editor preferences (runic.prefs). The Statistics and Marketing categories are empty: no analytics, no advertising. The /cookies page renders its table from the same inventory the dialog uses, so the policy cannot drift from the code.
The consent dialog opens on first visit with Deny, Customize and Allow all; Customize shows a switch per category and Allow selection. Cookie settings in the footer reopens it, and /cookies offers Change consent and Withdraw all. Refusing Preferences deletes runic.prefs on the spot. The choice is logged as an anonymous record (consent id, version, categories, time; no IP, no user agent, no account link) and deleted after three years.
The Content Security Policy allows scripts, styles, fonts and connections from Runic's own origin only (plus data: URIs for fonts and images), so the page cannot load a script from a CDN or talk to another host. Fonts are served from /fonts. The browser reports one thing on its own: unhandled errors (message, stack, page path). On the server, five actions are counted by name against your user id (login, signup, document created, share created, checkout started) for the staff console's 30-day numbers. Neither record carries document text.
AI without keys in the browser
Every AI feature is a server route. The Anthropic API key exists only in a server environment variable, never a NEXT_PUBLIC_ one, so it is not in the client bundle, and the CSP means the page never talks to api.anthropic.com itself. Document text and prompts go to Anthropic only when you invoke an AI feature: chat (including imports from screenshots or Mermaid), AI edit, ghost suggestions, generation, the audit's analyst pass and Build. The privacy policy states that Anthropic's commercial terms exclude that data from training. Every AI route you invoke directly needs a verified email and has its own hourly limit; the chat's archive-summary route needs only a signed-in account.
Accounts and secrets at rest
Passwords are stored as salted scrypt hashes and compared in constant time. Session tokens, verification links, reset links and MCP tokens are stored as SHA-256 hashes; the raw values appear once, in the cookie, the email or the modal that created them. Reset links are single-use, expire after two hours, and a successful reset revokes every session. Stripe secrets are server-only and card details never touch Runic. Every response carries HSTS, nosniff, a referrer policy and X-Frame-Options: DENY, except share and embed pages, which are meant to be framed.
Rate limits and lockouts
Sign-in is throttled per IP (20 attempts per 10 minutes) and per account (4 failures in 10 minutes lock that IP-and-email pair for 15 minutes). Signups, reset requests, account deletion, data export, token creation, MCP calls, document creation and every AI route have their own hourly buckets. With Upstash Redis configured the counters are shared across instances; if Redis is unreachable the limiter falls back to its in-memory counter rather than blocking anyone.
Your data: export and delete
Avatar menu → Download my data streams runic-data-export.json: profile, processes, sequence diagrams, version snapshots, feedback you sent, AI chat history, API token names and dates, and team memberships. Avatar menu → Delete account… asks for your password, then Delete forever removes the account; an account created through Google or GitHub has no password yet, so set one with Forgot password? first. Deletion clears API tokens, version snapshots, chat state, feedback, login-lock rows, OAuth identities and pending team invites, unlinks your id from the event counts, cancels any live Stripe subscription and deletes the Stripe customer, then ends the session. Documents, sessions and share links go with the user row by cascade; the policy says backups expire shortly after.
Data lives in Turso (libsql) in production. The privacy policy lists Vercel, Turso, Resend, Anthropic and Stripe as its processors and notes that they operate in the United States.
How to use it
- Read the two policiesThe landing page footer links to /privacy and /cookies. The cookie page lists every cookie and storage key by category, generated from the same inventory the dialog uses.
- Make or change your cookie choiceOn first visit the dialog offers "Deny", "Customize ›" and "Allow all". Click "Cookie settings" in the footer to reopen it on the Details tab, flip the Preferences switch and press "Allow selection". On /cookies, "Withdraw all" turns every optional category off.
- Download your dataClick your avatar and choose "Download my data". The browser saves runic-data-export.json with your profile, documents, snapshots, chat history, token names and teams. Up to 12 exports per hour.
- Revoke access you no longer needAvatar → "Claude & MCP" → "Revoke" on a token. Avatar → "Connected accounts" → "Disconnect" on a provider. Both take effect at once.
- Delete the accountAvatar → "Delete account…". Type your password into "Confirm with your password" and press "Delete forever". You land on the home page signed out; there is no undo.
Commands & shortcuts
| runic_session | session cookie: httpOnly, SameSite=Lax, Secure, 30 days |
| runic_oauth_state | CSRF cookie for a Google or GitHub sign-in, 10 minutes |
| runic_consent | your cookie choice, 12 months; the only cookie readable by script |
| Footer → Cookie settings | reopens the consent dialog on the Details tab |
| Avatar → Download my data | GET /api/auth/export, saves runic-data-export.json |
| Avatar → Delete account… | password-confirmed erasure via POST /api/auth/delete |
| /privacy | the privacy policy, written for GDPR and KVKK, with notes for the UK, California, Canada, Japan and Türkiye |
| /cookies | the cookie policy with Change consent and Withdraw all |
| info@odeontech.com | contact for data requests and the DPA, per the policy |
Tips
- Download my data before Delete account…; the deletion dialog says the same and there is no undo.
- Deleting a document removes its version history and stops its share and embed links at once. If you only want to stop a link, revoke it from the Share menu instead.
- Deny in the cookie dialog costs you only remembered editor layout; documents and sign-in are unaffected.
- Editor preferences live in your browser's localStorage and are not part of the export.
- Treat MCP tokens like passwords: they are shown once, stored hashed, and revocable from the same modal.
Questions
Do you run Google Analytics or any tracking pixel?
No. The CSP allows scripts and connections from Runic's origin only, and the Statistics and Marketing categories in the dialog are empty by construction. The only telemetry is a first-party browser error reporter, counted events such as login and signup, and the anonymous consent log, all in Runic's own database.
When are my documents sent to Anthropic?
Only when you invoke an AI feature. If you never use AI chat, AI edit, ghost suggestions, generation, imports, the audit's analyst pass or Build, no document text leaves Runic for Anthropic.
What happens to my share links after deletion?
Share links reference the document row and are removed by cascade with the account, so every /s/ and /embed/ URL stops working.
Where is the data stored?
In Turso (libsql) in production; the privacy policy names Vercel, Turso, Resend, Anthropic and Stripe as processors operating in the United States, under the Data Privacy Framework or Standard Contractual Clauses.