Unplug the machine. Everything still works.

Every privacy policy says roughly the same thing, which is why almost nobody reads one. "We take your privacy seriously" is not a claim; it is a genre. The useful version is a test somebody can run.

Turn off the network. Does the software still do its job?

For Rutba Office the answer is yes, and that is not a feature we added. It falls out of a set of decisions that were each slightly harder than the alternative.

There is nothing to sign into

No account means no user record, no session, no password reset, no "we will email you a code". It also means we cannot build a profile of you, because there is no key to attach one to. That is a capability we gave up rather than a promise we are making.

It costs us the thing every consumer product wants: a way to count our users. We genuinely do not know how many people run it. The trade seemed obvious once written down.

Four things worth checking rather than believing

• Passwords go to the operating system. Mail credentials are handed to DPAPI on Windows, Keychain on macOS, libsecret on Linux, never written somewhere the application can read back in clear text.
• Message bodies cannot phone home. Mail renders in a frame with an empty sandbox: no scripts, no forms, no same-origin access. The content policy blocks remote fetches, so a tracking pixel cannot report that you opened the message. Remote images load only when you ask, per message.
• Deleting is not destroying. Removing a file moves it to the operating system trash. An office suite should never be the reason something is unrecoverable.
• Your documents never leave the machine. No sync service of ours, no cloud tier, no crash reporter, no document telemetry. Calendar and Contacts can keep in step with a CalDAV or CardDAV server, but only one you add yourself.

Every one of those is in published source, which is the point of publishing it. You do not have to take the list on trust; you can go and look at the line.

The two exceptions

Servers you add yourself are a different matter: your mail accounts and, since 1.29.8, a calendar or address book server. Those connections go only where you pointed them. Leaving them aside, the suite makes two requests of its own.

An installed copy asks GitHub whether a newer release exists: twenty-five seconds after launch, then every six hours. One HTTPS request, carrying nothing we add. If a newer version exists it downloads in the background and installs when you next quit, never while you are working. Running from source never checks at all.

It is a setting. Turn it off and no request is made: not a smaller one, none.

The second is ours. Once a day at most, the launcher asks office.rutba.io whether there is an announcement worth showing you: a release, a security note, a change to the licence. It sends the version and the name of your operating system, in the address, and no identifier of any kind. It is also the only usage figure we have: the server can count that a copy was opened somewhere today, never that this copy was, and never the same copy across two days. Also a setting, and turning it off stops the request and the announcements together.

And the honest limit of "collects nothing"

Any request to any server reveals an IP address and a user agent. So GitHub sees those when your copy checks for an update, and when you download an installer. We do not receive them and never see them. That is GitHub’s processing under their policy, not ours.

That is the truthful boundary of what "collects nothing" can mean for software able to update itself. Anyone claiming a stronger version is either not updating, or not telling you.