Privacy Policy

Effective date: August 10, 2026

Last updated: October 25, 2026

Roomie is operated by Roomie Technologies OÜ, a private limited company established in Estonia (registry code 17444617, registered address Mulla 4). We are the controller of the personal data described in this policy, which covers roomie.cafe and the Roomie mobile apps for iOS and Android. This policy explains what information we collect, how we use it, who we share it with, and what rights and choices you have.

Information we collect

We collect information needed to provide the product experience, including:

Account and profile details: provided when you sign in with Google or Apple, such as name, email address, and profile image. If you use Apple's "Hide My Email", we receive the private relay address Apple generates for you. You may also optionally add a bio and date of birth to your profile.
User-generated content: content you create in Roomie, including focus sessions, focus areas, reflections, comments, reactions, and @mentions. Some of this content may be visible to other users depending on your session visibility settings.
Activity and presence data: when you start or end a focus session, and real-time presence indicators that show other users when you are actively focusing. These are delivered through our own real-time infrastructure.
Payment and subscription data: if you purchase Roomie Supporter, your subscription status, plan, renewal or expiry dates, the store you subscribed through, and transaction and entitlement identifiers, provided by our subscription management platform. Your full card details never touch Roomie's servers — they are collected directly by Stripe (on the web), Apple, or Google.
Push notification tokens: if you enable notifications, a device token used to deliver notifications through Google's push notification service.
Location check-ins: if you use them, the place you choose to check in at. Place search queries are processed by Google Maps to show you suggestions.
Essential product usage data — signed-in accounts: which screens you open, whether you saw and used the focus timer, and key actions such as starting or ending a session, creating a focus area, following someone or reacting, with the device type, app version and, at sign-up, the site or campaign that brought you to Roomie. It is linked to your account ID, never contains what you write, and nothing is stored on your device for it. See Essential product telemetry.
Detailed analytics, session recordings and diagnostics — only with your consent: automatically captured interactions, recordings of how you use the app (session replay), error reports, and device and browser information, collected through PostHog, hosted in the EU. Your consent choice itself is also stored.
Content moderation data: reports you submit about content or other users, and users you have blocked.
Basic technical and security data: authentication logs and operational logs used to maintain platform reliability and security.

User-generated content

Roomie allows you to post comments, write reflections, and share focus sessions with others. Content you post may be visible to other Roomie users based on your visibility settings. You are responsible for the content you share. We may remove content that violates our Terms of Service.

Other users can report or block your content. We review reports to keep the community safe. Moderation actions we take are stored as part of our platform safety operations.

How we use your information and on what legal basis

Under the EU General Data Protection Regulation (GDPR), every use of personal data needs a legal basis. Here is how they map:

Purpose	Legal basis (GDPR)
Providing the service: your account, focus sessions, social and accountability features, presence indicators	Performance of a contract, Art. 6(1)(b)
Processing Supporter purchases and managing your subscription benefits	Performance of a contract, Art. 6(1)(b)
Keeping transaction records for tax and accounting	Legal obligation, Art. 6(1)(c)
Essential product telemetry: seeing whether new members can get started and which parts of Roomie work for them	Legitimate interests, Art. 6(1)(f) — improving the product you use. You can switch it off at any time in Settings
Detailed analytics, session recordings and diagnostics to understand usage and fix problems	Consent, Art. 6(1)(a) — you can withdraw it at any time in Settings
Sending push notifications	Consent, Art. 6(1)(a) — controlled via your browser or device permissions
Location check-ins you choose to share	Performance of a contract, Art. 6(1)(b)
Security, abuse prevention, and content moderation	Legitimate interests, Art. 6(1)(f) — keeping Roomie and its users safe
Responding to support and privacy requests	Performance of a contract and legitimate interests, Art. 6(1)(b) and (f)

Essential product telemetry

When you are signed in, Roomie records a small set of product events so we can see whether people manage to get started — for example, whether a new member saw the focus timer, started a first session, or found other people to focus with. We do this on the basis of our legitimate interest in improving the product you use (GDPR Art. 6(1)(f)), and we have kept it narrow so it does not override your interests:

It covers the screens you open, whether the timer was on screen and which of its controls you used first, and actions such as starting, ending or pausing a session, creating a focus area, following someone and reacting. Events carry counts and timings, never the content you write, your email address or your name.
It is linked to your account ID only. Nothing is stored on your device for it: no cookie, no local storage.
When you sign up, we note the site or campaign that brought you (the referring page and any campaign tags in the link) and the first page you visited. If you accepted analytics before signing in, your earlier anonymous analytics activity is joined to your new account.
It is processed by PostHog, our product analytics provider, in its EU-hosted cloud. It does not include session recordings: those, along with automatic interaction capture and analytics storage on your device, happen only if you accept analytics.
You can switch it off at any time with Product improvement data in Settings, which stops it on every device you use. You can also object by contacting us.

Who we share information with

We do not sell personal information. We share personal data only with:

Stripe, when you purchase on the web. Stripe acts as merchant of record and processes your payment as an independent controller under its own privacy policy.
Apple, if you sign in with Apple or subscribe through the App Store. Apple is an independent controller for App Store purchases.
Google, if you sign in with Google, use location check-ins (Google Maps), receive push notifications, or subscribe through Google Play. Google is an independent controller for Play purchases.
Service providers that process data on our behalf and under our instructions: a subscription management platform, PostHog (product analytics, hosted in the EU), and EU-based hosting providers.
Public authorities, where we are required to by law.

Real-time features (presence, live updates) run on our own infrastructure and do not involve a third-party messaging provider.

Content you post publicly within Roomie (such as comments on shared sessions) is visible to other users of the platform as part of the core product experience.

International data transfers

Your data is primarily stored and processed in the European Economic Area — our hosting and analytics providers are EU-based. Some providers, such as payment and app-store companies and our subscription management platform, process certain data in the United States. Where that happens, the transfers are protected by EU Standard Contractual Clauses and/or the provider's certification under the EU–U.S. Data Privacy Framework.

Data retention

We keep personal data only as long as needed for the purposes described in this policy:

Data	How long we keep it
Account, profile, and content data	While your account is active. If you delete your account, there is a 14-day recovery window during which you can change your mind; after that, your personal data is deleted or anonymized.
Payment and transaction records	7 years, as required by the Estonian Accounting Act
Security and operational logs	As long as needed to keep the platform secure and reliable and to investigate abuse, after which they are deleted or anonymized
Analytics data	Essential product telemetry is collected while it is switched on in your settings; detailed analytics and session recordings only while your consent is active. Both are kept as long as needed to understand product usage, after which they are deleted or anonymized
Support correspondence	As long as needed to resolve your request and handle any related follow-ups or disputes

Your rights and choices

Under the GDPR, you have the right to:

Access the personal data we hold about you.
Have inaccurate data corrected.
Have your data erased.
Restrict or object to how we process your data, including processing based on our legitimate interests.
Receive a copy of your data in a portable format.
Withdraw consent at any time — for detailed analytics and session recordings, use the toggle in Settings; for push notifications, use your browser or device permissions. Withdrawing consent does not affect processing that happened before.
Switch off essential product telemetry with Product improvement data in Settings.

You can delete your account directly in Settings (with a 14-day recovery window). To request a copy of your data or exercise any other right, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority — in our case, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) — or with the data protection authority in the country where you live.

You may also manage your blocked users and visibility settings directly within the app.

Cookies and similar technologies

We keep the use of cookies to a minimum:

Essential cookies used to keep you signed in and to protect your session. These are required for Roomie to work.
Preference storage: a first-party cookie and browser storage that remember choices such as your cookie-notice and analytics-consent decisions.
Analytics storage: our analytics tool sets a cookie and uses browser storage only after you accept analytics. If you decline or say nothing, no analytics identifiers are stored on your device, no session is recorded and no interactions are captured automatically. If you are signed in, essential product telemetry (see above) still runs, keyed to your account and without storing anything on your device, unless you switch it off in Settings. You can change either choice at any time in Settings.

Roomie does not use advertising cookies or cross-site tracking.

Children's privacy

Roomie is intended for users aged 13 and older — 13 is also the age at which minors can consent to online services under Estonian data protection law. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will delete it promptly.

Security

We protect your data with encryption in transit, access controls, and by never storing full payment card details on our systems. No online service can guarantee absolute security, but we work continuously to protect your information.

Changes to this policy

We may update this policy from time to time. Updates are posted on this page with a new "Last updated" date. If a change is material, we will notify you by email or an in-app notice before it takes effect.

Contact

If you have questions about this Privacy Policy, contact [email protected] or write to Roomie Technologies OÜ, Mulla 4.