What we do with your data, stated plainly

• Application

  The Rodeo API and the real-time collaboration service run on Microsoft Azure App Service.

• Database

  Workspace data lives in a managed MySQL database on Microsoft Azure.

• Files

  Uploaded files and images are stored in Cloudflare R2, each under a random, unguessable key inside a per-workspace folder.

• Website

  rodeo.so and the web app are static files served by Netlify. Your workspace data isn't stored there; the app fetches it from the API.

• Email

  Sign-in links, invitations and notifications are sent through Ránṣẹ́, our email service, which delivers through Azure Communication Services.

• In transit

  rodeo.so is served over HTTPS with HTTP Strict Transport Security, so browsers refuse to load it unencrypted. The web, desktop and mobile apps talk to the API over HTTPS.

• Files at rest

  Cloudflare R2 encrypts every stored object at rest.

• Secrets at rest

  We store sign-in links, session refresh tokens and API tokens only as SHA-256 hashes, so a copy of the database can't be used to sign in as you.

• No passwords

  Rodeo has no passwords to leak. You sign in with Google, Apple, or a single-use link emailed to you.

• Card data

  Payments go through Paystack. Card numbers never reach Rodeo's servers; we keep only the reference Paystack gives us to renew your plan.

• Workspace isolation

  Every request is checked against your workspace membership at the data layer. Non-members get nothing, not even whether a page exists.

• Roles

  Owners and admins manage the workspace and billing, members collaborate, and guests see only the pages shared with them.

• Private spaces

  A private space is visible only to its members on every path: sidebar, search, links, databases, comments and the API.

• Page sharing

  Share a single page with a specific person at view, comment or edit level, and revoke it at any time.

• Sessions

  Access tokens last 15 minutes. Refresh tokens rotate on every use and can't be reused, and signing out revokes the session.

• API and AI assistants

  Personal access tokens are scoped, and AI assistants connect over MCP only after you approve them on a consent screen.

• Trash

  Deleted pages and databases go to the trash first, where you can restore them.

• Version history

  Pages keep a version history, so you can see and bring back earlier versions.

• Account deletion

  When you delete your account, workspaces only you own are archived, then permanently erased with their files 30 days later.

• Database backups

  The database runs on Azure's managed MySQL service, which takes automated backups. We'll publish the retention window here once it's confirmed.

• Export

  You can export any page as Markdown or HTML at any time.

• Who we are

  Rodeo is run by Harmonics Technology Ltd in Lagos, Nigeria. For account data (your name, email and sign-in records) we are the data controller. For the content your workspace stores, your organisation is the controller and we process it on its instructions.

• Lawful basis

  We process personal data to provide the service you signed up for, to keep it secure, and to meet legal obligations. We don't sell personal data or use it for advertising.

• Your rights

  Under the NDPA you can access, correct, port and delete your personal data, and object to or restrict how it's used. You can delete your account yourself in Settings, or write to hello@rodeo.so.

• Transfers

  Our infrastructure is hosted outside Nigeria. When data leaves Nigeria we rely on the safeguards Part VIII of the NDPA allows, and our DPA sets this out for customers.

• Complaints

  Tell us first at hello@rodeo.so. You can also complain to the Nigeria Data Protection Commission.

• Microsoft AzureHosts the API, collaboration service and database; runs the AI features; delivers email.
• Cloudflare R2Stores uploaded files.
• NetlifyServes the rodeo.so website and web app as static files.
• PaystackProcesses payments.
• Expo, Apple and GoogleDeliver push notifications to the mobile apps.
• TavilyRuns a web search when an AI feature needs one.
• Google and AppleHandle sign-in when you choose them.

A public status page is on its way. Until it's live, email hello@rodeo.so if Rodeo isn't working for you and we'll reply with what we know.

Send security questionnaires, DPA requests, data-protection requests and vulnerability reports to hello@rodeo.so. Please give us a reasonable chance to fix a vulnerability before you disclose it publicly.