Your room is private.
So is the fine print.

1. Who we are

Roomy (“Roomy”, “we”, “us” or “our”) provides private, time-limited digital rooms for real-life events through the Roomy website and mobile applications. Roomy is operated by Aquib Akhtar, who is the legal operator and controller of the personal information described in this policy.

Questions or privacy requests can be sent to aquibakhtar@proton.me.

2. Information we collect

Room and participation details

When a room is created or joined, we process the room name, room code, scheduled end time, nickname, a randomly generated device identifier, join and activity times, and the IP address used to connect. Hosts also receive an admin code; Roomy stores a protected hash of that code rather than the readable code itself.

Content and interactions

We process content contributed to a room, including photos, videos, voice notes, comments, reactions, room messages, tally labels and tally activity. Content may include personal information about the person posting it or other people shown or heard in it.

Notifications

If you choose to enable app notifications, we process a push token, device platform and the room it belongs to. Notification permission is optional and can be turned off through your device settings or by removing the room from the app.

Payments and purchases

If a paid room upgrade is used, we process the room, anonymous identifier, selected tier, amount, currency, provider transaction or payment reference, and confirmation status. Payment-card details are handled by the payment provider and are not stored by Roomy.

Device and technical information

The browser version uses local storage, and the apps use on-device storage, to remember items such as the anonymous identifier, nickname, room history, room theme and host credentials for rooms created on that device. Standard server logs may also include request details, IP address, browser or device information, timestamps and error information.

No ad profiles. Roomy does not sell personal information or use it for targeted advertising. The marketing site does not include third-party advertising or analytics trackers.

3. How we use information

We use information to:

• create rooms, let invited guests join, and keep room activity in sync;
• display uploads and interactions to people inside the same room;
• give hosts moderation, participant-management and export controls;
• enforce room limits, prevent abuse, rate-limit activity and apply room bans;
• send room notifications when a user has opted in;
• process and confirm paid upgrades;
• operate, secure, diagnose and improve the service; and
• meet legal obligations and respond to lawful requests.

Where UK or European data-protection law applies, our lawful bases are performing our contract to provide Roomy, our legitimate interests in running and protecting the service, consent where we ask for it (such as notification permission), and compliance with legal obligations. You are not legally required to provide room content, but Roomy cannot provide the relevant feature without the information it needs.

4. Who sees or receives information

• People in the room: invited participants can see room content, nicknames and shared activity while they have access.
• The host: the host can moderate content and participants and can download the room export using the admin code.
• Service providers: hosting and delivery providers help us run Roomy. Expo and Google Firebase may process push-notification tokens and delivery data. Stripe, Apple or another relevant app-store provider may process payments or purchase verification.
• Legal and safety disclosures: we may disclose information where required by law or where reasonably necessary to protect Roomy, our users or others.

Room content is not placed on a public profile or searchable public feed. Guests should only add content they are entitled to share, and hosts should share room links and codes with people they intend to invite.

5. How long we keep information

New room activity stops at the scheduled end time. The room remains read-only for the host’s 24-hour export window. After that window, Roomy’s periodic cleanup deletes the room record, its uploaded files and room-linked records such as participants, IP addresses, content, reactions, tallies, push subscriptions and Roomy’s payment references.

Because cleanup runs periodically, deletion may occur shortly after the 24-hour window rather than at the exact second it ends. Payment providers may retain their own transaction records under their policies and legal obligations. Security logs, records needed to resolve disputes, and legally required records may be kept for a limited period appropriate to their purpose.

Information stored locally on your browser or device remains there until Roomy removes it as part of the product flow, you remove the room, clear site/app data, or uninstall the app.

6. Your choices and rights

You can choose a nickname, decide what to contribute, decline notification permission, remove a room from your device, or ask the host to moderate content during the room’s available period.

Depending on where you live, you may have rights to access, correct, delete, restrict or receive a copy of personal information, and to object to certain processing or withdraw consent. Roomy is intentionally pseudonymous and short-lived, so we may need the room code, nickname, approximate time and other details to locate and verify a request. We may not be able to identify data after the room has been deleted.

You may object at any time to processing based on legitimate interests. Send requests to aquibakhtar@proton.me. If you are in the UK, you may also complain to the Information Commissioner’s Office at ico.org.uk.

7. Security and international transfers

Roomy uses measures intended to protect information, including private room access, admin-code controls, encrypted HTTPS connections, limited upload links, restricted host actions and time-limited deletion. No online service can guarantee absolute security, so keep room and admin codes private and contact us if you believe a room has been accessed improperly.

Some service providers may process information outside your country. Where required, we rely on recognised transfer mechanisms or contractual safeguards provided by those services.

8. Children

Roomy is not directed to children under 13. A parent or guardian should supervise use by a young person and decide whether sharing event content is appropriate. If you believe a child’s information has been provided improperly, contact us promptly.

9. Changes and contact

We may update this policy when Roomy’s features or data practices change. The date at the top shows the latest revision. Material changes will be presented through the website or app where appropriate.