Privacy Policy

When you use Roomit AI, we collect the following categories of data:

• Identifiers. We generate a unique user ID when you create an account, and we collect your device ID to help prevent fraud and secure your account.
• Contact information. We collect your email address and phone number. Your phone number is used for one-time password (OTP) verification and account recovery.
• User content. This includes profile photos, bio information, messages you send to other users, and any photos or descriptions you add to room listings.
• Location. We collect approximate location (city or neighborhood level) to show you relevant matches and listings nearby. We do not track your precise GPS coordinates in the background.
• Diagnostics. We collect crash logs and performance data via Sentry to identify and fix bugs.
• Usage data. We collect anonymized analytics via PostHog to understand how features are used and improve the app. This data is not linked to your personal identity.

We use your data for the following purposes:

• To provide the core roommate matching and messaging service
• To verify your identity and prevent fraud or abuse
• To enable communication between matched users
• To diagnose crashes and improve app stability
• To understand feature usage and guide product development

Your data is stored in encrypted databases hosted by Supabase. Profile photos and listing media are stored in secure cloud storage with strict access controls. Messages are encrypted at rest. All data in transit is protected with industry-standard TLS.

We do not store your government ID document images after verification is complete. Verification results are stored as a status flag, not as raw document data.

We do not sell your personal information. We share data only with trusted sub-processors who help us operate the app:

• Supabase — database and file storage
• Sentry — crash reporting and diagnostics
• Persona — identity verification (processes the government ID and selfie you submit for verification)
• PostHog — product analytics (anonymized)
• Apple & Google — subscription and in-app purchase billing
• OpenAI — AI assistant chat, live voice conversations, and compatibility insights. We ask for your consent before sharing data with OpenAI; see "AI features and third-party processing" below. Under our agreement, OpenAI does not retain your data for training purposes.
• LangChain (LangSmith) — AI request tracing and quality monitoring for our AI features, which may include the prompts and responses those features process. Under our agreement it is used only to operate and improve the service, not to train models.

Each sub-processor is contractually bound to use your data only for the specific services they provide to us and to maintain appropriate security measures.

Roomit's AI features — an AI assistant you can chat with, live voice conversations with the assistant, and AI-generated compatibility insights about your matches — are powered by our third-party AI provider, OpenAI.

When you use these features, we send OpenAI only the information needed to provide them:

• What we share. The messages you send to the AI assistant, the voice audio you speak during a live voice session, and the profile details being compared when you request compatibility insights.
• Why. Solely to generate the assistant's replies, transcribe and respond to your voice, and produce the compatibility analysis you requested.
• Your consent. Roomit's core experience is built around these AI features, so your agreement to this processing is required to use Roomit. We ask for your explicit consent inside the app before any personal data is shared with the AI providers — nothing is shared until you agree. You can review your choice at any time in Settings → Privacy; because these features are integral to Roomit, withdrawing consent means you'll be asked to agree again before you can continue using the app.
• Protection. OpenAI processes this data on our behalf under contractual terms that require confidentiality and protections consistent with this policy, and does not use it to train its models.
• AI infrastructure. To operate and monitor the quality of these features, the prompts and responses may also be processed by LangChain (LangSmith), our AI request-tracing provider, under the same confidentiality terms. Data shared for AI features is not used to train any provider's models.

• Account data is retained until you delete your account.
• Messages are retained for 12 months after account deletion, then permanently erased.
• Analytics and diagnostics data are anonymized within 90 days of collection.
• You can request immediate deletion of your data at any time (see Your Rights below).

You have the following rights regarding your data:

• Access. You can view all data associated with your account in the app Settings.
• Deletion. You can delete your account and all associated data from Settings → Account → Delete. Deletion is permanent and cannot be undone.
• Export. Email [email protected] with the subject "Data Export Request" and we will provide a copy of your data within 30 days.
• Correction. You can update your profile information directly in the app at any time.

Roomit is intended for users 17 and older, per our App Store and Google Play ratings. We do not knowingly collect personal information from children under 13. If we discover that we have collected data from a child under 13, we will delete that information immediately.

We are COPPA-compliant. If you believe we have inadvertently collected information from a child under 13, please contact us at [email protected].

California residents (CCPA/CPRA): You have the right to know what personal information we collect, the right to delete it, and the right to opt out of sale. We do not sell your personal information. To exercise your rights, email [email protected].

EU and UK residents (GDPR): You have the right to access, rectify, erase, restrict processing, data portability, and object to processing. We process data under the lawful bases of contract performance and legitimate interest. To exercise your rights, contact [email protected].

Roomit is operated from the United States, and some of our service providers (including OpenAI, LangChain, Supabase, Sentry, PostHog, and RevenueCat) process data in the United States. When we transfer personal data of users in the EEA, UK, or Switzerland outside those regions, we rely on appropriate safeguards — the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) and, where applicable, a provider's certification under the EU–US Data Privacy Framework — so your data receives an equivalent level of protection. You can request a copy of the relevant safeguards by contacting us.

If you are in the EEA, the UK, or Switzerland, the following additional information applies to how we process your personal data.

• Legal bases. We process your data to perform our contract with you (matching and messaging), for our legitimate interests (security, fraud prevention, and improving the service) balanced against your rights, to comply with legal obligations, and with your consent where required.
• Special category data. Certain details you choose to add — such as information revealing religious beliefs, or data concerning your sex life or sexual orientation — are special category data under Article 9 GDPR. We process these only with your explicit consent, which you give when you choose to provide them and when you agree to our AI data sharing, and you may withdraw it at any time.
• Automated processing. We use automated systems, including AI, to rank and recommend potential roommates and to generate compatibility insights (profiling). These are decision-support tools; they do not produce legal or similarly significant effects about you without human involvement, and you always make the final decision.
• Right to complain. You may lodge a complaint with your local data protection supervisory authority (EEA), the Information Commissioner's Office (UK), or the Federal Data Protection and Information Commissioner (Switzerland). We would appreciate the chance to address your concern first.
• EU/UK representative. Where an Article 27 GDPR representative is required, we are in the process of designating one; until that appointment is completed you can reach us at [email protected] about any matter our representative would handle.

For privacy-related questions or requests, please email [email protected]. We aim to respond within two business days.