Privacy Policy

Who is responsible (data controller)

Roomie is operated from Switzerland by [Legal entity name, registered address and commercial register number — to be completed before launch], which is the data controller for personal data processed through the Service. Contact: support@roomie.wtf.

[EU representative under Art. 27 GDPR, if required — to be completed before launch]

Where your data lives

Account data (your profile, messages, photos and documents) is stored on infrastructure located inside the European Union (EU/EEA). Some parts of the Service involve processors outside the EU: payments (Stripe, USA), push notifications (Apple, Google and the Expo push service, USA), maps and commute times (Google Maps Platform, USA), and the content delivery network that serves our website and the support form (Cloudflare, global network). Transfers in those cases rely on EU Standard Contractual Clauses or equivalent safeguards.

What data we collect

We collect data you give us, data generated by your use, and a limited set of technical data:

• Account: email, date of birth, password-less sign-in codes.
• Profile: name, photos, bio, prompts, hobbies, languages, lifestyle preferences, whether you are looking for a room, belong to a flat, or both, the area you are searching in, budget, move-in date.
• Flats and vacancies: the address and photos of a flat you belong to or list. Other people see only the neighbourhood until an application is accepted.
• Activity: applications, matches, conversations, search alerts, reports you submit.
• Payments: handled by Stripe; we receive the subscription status and invoice ID, never your card number.
• Technical: device type, OS, app version, and your IP address, which we keep only as a salted hash (and not at all when your session is refreshed), plus server error logs.

Why we use it (purposes and legal bases)

• Provide the Service — contract (Art. 6(1)(b) GDPR / Art. 31 FADP). Without this data the app cannot match you with anyone.
• Safety, moderation, fraud prevention — legitimate interests (Art. 6(1)(f)). We process reports and abuse signals to keep users safe.
• Communicate — contract / legitimate interests. Transactional emails are required to run the Service.
• Marketing emails — only if you opt in (Art. 6(1)(a) consent). You can withdraw consent any time.
• Legal compliance — to respond to lawful requests and meet record-keeping obligations.

Who we share data with

We share personal data only with the processors needed to run the Service:

• Hosting and storage (Cloudflare, Hetzner — EU regions for account data).
• Payments (Stripe Inc., subject to Standard Contractual Clauses for EU users).
• Email delivery (provider listed at support@roomie.wtf on request).
• Push notifications (Apple, Google, and the Expo push service, which relays the notification content — including message previews — through servers in the USA).
• Maps and commute times (Google Maps Platform): the map you browse, and the places you save when you ask for commute times.

We do not sell personal data. We do not share data with advertisers.

What other users can see

Your profile (name, photos, age, prompts, bio, lifestyle, general area) is visible to other users in the course of the Service. We show an age, never your date of birth. Your contact details (email, phone numbers) are never shared with other users. The exact address of a flat is visible only to its members and to people whose application to that flat was accepted; everyone else sees the neighbourhood.

How long we keep data

• Account and profile data: while your account is active. When you delete your account it is disabled immediately and permanently deleted within 30 days; backups follow their own rotation, except where law requires longer retention.
• Abuse reports and related evidence: up to 24 months after resolution.
• Billing records: as required by tax law (typically 10 years).
• Product analytics events are linked to your account and deleted after 180 days; sign-in events (with a hashed IP address) and security audit logs after 90 days.

Your rights

Under the GDPR and the Swiss FADP you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Have inaccurate data corrected.
• Have your data deleted (the “right to be forgotten”).
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), or with your local EU supervisory authority.

In the app, Settings → Privacy & safety → Download my data gives you a machine-readable copy of your data, and Settings → Delete account removes your account (see how deletion works). For everything else, write to support@roomie.wtf — we respond within 30 days.

Security

We use industry-standard measures: TLS everywhere, encryption at rest for sensitive fields, separation of duties for administrative access, audit logs, and prompt patching. No system is perfectly secure; if we discover a breach affecting you, we will notify you and the supervisory authority as required by law.

Minors

Roomie is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, please report it from Settings → Help.

Changes to this policy

We will update this Policy from time to time. Material changes will be announced in-app and by email at least 14 days before they take effect.

Contact

Privacy questions can be sent to support@roomie.wtf or via the Support page.