Last updated: October 11, 2026
Rebuildr is built local-first: the app runs on your machine, and most of what it does — scanning your hardware, applying tweaks, packing a Rebuild Pack — never leaves your computer. This page explains exactly what we collect when it does, why, and what we deliberately do not do with it.
The Rebuildr app sends no crash reports, no usage statistics and no analytics — not to us, and not to anyone else. We do not know which features you use, how often you open the app, or what is on your PC. What our server does keep are counters, never content: the AI assistant's daily questions (described above), and the abuse-prevention counters and the lock on repeated failed sign-ins (described below). This website carries no analytics or advertising scripts.
The app contacts our server in exactly these cases:
Like any server, ours sees the IP address of whoever contacts it. We keep it only in abuse-prevention counters — how many requests of one kind an address made (for example assistant questions, contact-form messages, or uninstall surveys; for sign-in and password-reset attempts, together with the email address that was tried). These counters never contain the content of a request. Each one covers a window of at most one hour, and is deleted within 24 hours after that window ends. One record is kept longer: when sign-ins to an account fail repeatedly, the lock on that account, with the last address that tried, stays until the account next signs in successfully.
Some features talk to other services directly from your PC when you use them — for example winget to install or update an app, NVIDIA to look up the newest driver for your card, or a speed-test host. Those requests go from your computer to them; they do not pass through us.
Cloud Vault uses client-side, zero-knowledge encryption: your Rebuild Pack is encrypted with a key derived from your credentials before it leaves your device. Rebuildr's servers only ever store ciphertext. We cannot read, decrypt, or reconstruct the contents of your vault — and neither can anyone who gains access to our infrastructure.
Everything the desktop app does by default — scanning, optimizing, packing, restoring — happens entirely on your machine. Cloud Vault backup is an explicit, opt-in feature. If you never enable it, no pack content is transmitted anywhere.
Account data is retained for as long as your account is active. Encrypted vault data is retained until you delete the pack or close your account. You can request full account and data deletion at any time — see Contact below — and we will complete it within 30 days.
We rely on a small set of infrastructure providers to operate Rebuildr: cloud hosting, CDN and AI inference (Cloudflare — for the website, the API and the AI assistant), a payment processor (Lemon Squeezy — for subscriptions), and an email delivery service (Resend — for account, waitlist and contact emails). Each processes only the minimum data required for its function and is bound by its own data-protection terms.
Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Write to us using the contact details below and we'll respond promptly.
Rebuildr is not directed at children under 16, and we do not knowingly collect data from them.
If we make material changes to this policy, we'll update the "Last updated" date above and, where appropriate, notify active account holders by email.
Questions about this policy or your data: contact@getrebuildr.com
This document is a genuine, complete policy draft intended for a real product launch — it is not a substitute for review by a qualified lawyer in your jurisdiction before going live commercially.