Privacy Policy

1. Information Roomie collects

Roomie may collect the following categories of data:

• Account details, including username, email address, and password when you register.
• Profile details for registered users: your first name, date of birth, gender (male or female), and a profile photo. See Section 4.
• Optional location: the city, region, and country you choose to show on your profile. See Section 4.
• Account activity data, including when your account was created, when you last signed in, when you were last seen online, how many messages you have sent, and your settings (such as whether others may send you direct messages, whether your online status is hidden, and which notifications you receive).
• Authentication and session data, including the session cookie used to keep you signed in.
• Device records for each device you are signed in on (up to three per account): a device identifier, its push notification token, the platform (Android or iOS), the app version, the session it is signed in with, and when it was last used.
• Live chat and room activity, including messages, room identifiers, your display name, and related timestamps.
• Guest account identifiers created when you use the app without registering.
• Password reset and account verification records, including temporary verification tokens and expiry times.
• Direct message data, including message content (stored in encrypted form for end-to-end encrypted messages — see Section 7), sender and recipient user identifiers, the sender's display name at the time of sending, and server-side timestamps recording when a message was created, delivered to an active session, and read by the recipient.
• End-to-end encryption data: your public encryption and signing keys, the history of public keys you have published, and a backup of your private keys that your device encrypts with your PIN before uploading it. Roomie never receives your PIN or your private keys in readable form. See Section 7.
• Technical data that your device necessarily sends when using the service, such as IP address, user-agent string, and request headers. Roomie examines user-agent strings server-side to detect automated crawlers and bots.
• Poll data, including poll questions, answer options, vote records (linked to user identifiers), the creator's display name, a unique share slug, timestamps, and whether the poll has been closed.
• If you sign in with Google, Roomie receives your Google account email address, name, Google account identifier, and the address of your Google profile picture from Google's OAuth service. If you sign in with Apple, Roomie receives your Apple account identifier and, on your first sign-in, the email address you chose to share (which may be an Apple private relay address) and your name. If you sign in with Facebook, Roomie receives your Facebook account identifier, first name, email address (if your Facebook account has one and you allow it), and your Facebook profile picture. See Section 3.
• Search queries and a customer identifier (your account ID or username) sent to the Klipy API when you use the in-app picker to search or browse trending GIFs, memes, or stickers in a chat room or direct message conversation. The media URLs you select and send as messages are stored in the database as part of the message record. The picker may also display sponsored content (advertisements) served by Klipy.
• User report data when a registered user submits a report, including the reporter's user identifier and display name, the reported user's identifier and display name, the selected report reason, any additional details provided, and a creation timestamp. Guests cannot submit reports.
• Block records when a registered user blocks another user, consisting of the two user identifiers and when the block was made.
• Feedback text submitted through the in-app feedback form (up to 2,000 characters), along with a creation timestamp. Feedback may be submitted by any user, including guests.
• Voice message audio files recorded and sent in chat rooms or direct messages. These files are uploaded to and stored on Roomie's servers.
• Audio Room participation data, including your role in the room (host, speaker, or listener), a temporary access token issued for the live voice session, and, once assigned by Agora, an identifier used to manage that session. This data is held only for the duration of your connection to the room and is not retained as a permanent record. The audio content of your conversation is transmitted through Agora in real time and is not recorded or stored by Roomie.
• Notification permission status and your devices' Firebase Cloud Messaging (FCM) registration tokens. The app requests the operating system's notification permission (granted, denied, or default). To deliver push notifications, each device's FCM token is sent to and stored on Roomie's servers, linked to your account, and removed when you delete your account.
• Paid Room and payment-related data. If you host a Paid Room, Roomie stores your Stripe Connect account identifier and whether Stripe has enabled that account to accept payments and payouts (charges-enabled status). If you join a Paid Room, Roomie stores your room membership status (such as accepted or cancelled), a Stripe customer identifier, and, for recurring subscriptions, a Stripe subscription identifier. Roomie does not collect, process, or store your payment card number, card expiry date, card security code, or bank account details — these are provided directly to Stripe, our payment processor, through Stripe's own hosted checkout and Connect onboarding pages, and are never transmitted to or through Roomie's servers.

2. How Roomie uses information

• To create and verify user accounts.
• To authenticate users and maintain secure sessions, and to let you see and sign out the devices signed in to your account.
• To confirm that users are 18 or older, using the date of birth you provide.
• To show your profile (username, first name, age, gender, photo, optional location, and hosted rooms) to other users, and to list you in people lists once your profile has a username and photo.
• To provide chat rooms, room history, online user indicators, and guest access.
• To send account verification and password reset emails, a one-time reminder email if your profile is missing required details, an email confirming that your account has been deleted, and a warning email before an unused account is removed (see Data retention).
• To deliver, store, and display private one-to-one direct messages between registered users, including queuing undelivered messages and delivering them when the recipient reconnects, and to store the public keys and encrypted key backups that end-to-end encrypted messaging needs.
• To protect the service against abuse, spam, and repeated login attempts.
• To operate and secure the underlying infrastructure, including database and session storage.
• To allow registered users to create, vote on, and share polls within chat rooms, and to display poll results to room participants.
• To detect automated crawlers and bots by examining user-agent strings, in order to distinguish genuine visitors from automated traffic.
• To facilitate GIF, meme, and sticker search and trending content by forwarding a customer identifier and your search query (if any) to the Klipy API, and to store these messages in the database as part of chat and direct message history.
• To record and review user reports submitted by registered users, and to allow site administrators to investigate and resolve reported violations.
• To apply blocks between users, and to alert site administrators when a block is made so they can check for abuse.
• To collect and review general product feedback submitted through the feedback form.
• To send push notifications (via Firebase Cloud Messaging) alerting you to new chat messages or direct messages when the app is in the background or closed, if you have granted notification permission.
• To operate live Audio Rooms, including issuing time-limited access tokens for the Agora real-time voice service, tracking your role in a room while connected, and allowing a room's host to manage participants (mute, remove, change role, or end the room).
• To let room hosts moderate their rooms, including pinning a message and deleting other users' messages in that room.
• To process payments for Paid Rooms and manage room access, subscriptions, and host payouts, through our payment processor, Stripe.

3. Google, Apple, and Facebook sign-in

Roomie offers sign-in through Google, through Sign in with Apple, and through Facebook Login.

• Google: Roomie receives your email address, name, Google account identifier, and the address of your Google profile picture from Google.
• Apple: Roomie receives your Apple account identifier and, on your first sign-in only, the email address you chose to share with Roomie (which may be an Apple private relay address) and your name.
• Facebook: Roomie requests only your public profile and email address. It receives your Facebook account identifier (specific to Roomie), your first name, your email address if your Facebook account has one and you allow it, and your Facebook profile picture. Roomie does not post to Facebook or read your friends, posts, or other Facebook activity, and the app does not send analytics or advertising identifiers to Meta.
• Each sign-in method is its own Roomie account. Signing in with Google, Apple, or Facebook never joins an existing Roomie account that happens to use the same email address; a separate account is created instead. Accounts that were linked to more than one method before October 3, 2026 keep working with each of those methods.
• The first time you use a method, a new Roomie account is created and marked as verified automatically. The first word of the name Google, Apple, or Facebook provides is used as your first name. No username is created for you; the app asks you to choose one.
• When you sign in with Google and your Roomie account has no profile photo, Roomie downloads a copy of your Google profile picture and stores it on Roomie's servers as your profile photo. Google's generated placeholder images (an initial on a coloured background) are skipped. A photo you have already chosen is never replaced, and you can change the imported photo at any time. The same applies to your Facebook profile picture when you sign in with Facebook; Facebook's default silhouette is skipped.
• Roomie stores which authentication methods are associated with your account (local password, Google, Apple, Facebook, or a combination).

4. Your profile

Registered accounts have a profile made up of a username, first name, date of birth, gender (male or female), and a profile photo.

• Profile completion is required. Until your profile has all five details, you can sign in, view content, edit your profile, report or block users, and delete your account, but you cannot send messages, upload images or audio, react to or pin messages, create or join rooms, join Audio Rooms, take part in Q&A, or create or vote in polls. Guests are not affected.
• Age: Roomie is only for people aged 18 or over. Your date of birth is used to check this, and an account with a date of birth under 18 is refused. Your date of birth and gender cannot be changed after they are set; if either is wrong, contact us (see Contact).
• What other users see: Your username, first name, age (calculated from your date of birth — the date itself is never shown to other users), gender, profile photo, optional location, the rooms you host, when your account was created, and your online status (unless you hide it).
• People lists only include registered accounts that have a username and a profile photo.
• Profile photos are uploaded to and stored on Roomie's servers (up to 4 MB) and are deleted when you delete your account.
• Location (optional): If you grant the app location permission, the app uses your device's approximate location to find the city you are in. This conversion happens on your device; only the city, region, and country are sent to Roomie, never your coordinates. Your city is shown on your profile, next to your name in people lists, and on the People map, and you can clear it at any time.
• Online status: By default other users can see whether you are online and when you were last seen. You can hide this in your settings.
• Blocking: When you block someone, neither of you can send direct messages to or otherwise interact with the other, and you are hidden from each other's presence. Blocks are visible to site administrators, who are notified so they can check for abuse.
• Profile reminder email: If your account is missing a username or profile photo, Roomie may send you a single email listing what is missing. It is sent at most once per account.

5. Cookies, devices, and notifications

Roomie currently uses a session cookie named chat.sid to keep authenticated sessions active. The current implementation configures this cookie as HttpOnly, Secure, SameSite, and with a maximum lifetime of about 24 hours. On the native apps this cookie is stored on your device so you stay signed in between sessions.

Devices: One account can be signed in on up to three devices at a time. For each device Roomie stores a device identifier, its push notification token, the platform, the app version, the session it is signed in with, and when it was last used. You can see your devices in the app and sign any of them out remotely. A device that has not been used for 30 days is removed automatically.

Notifications: The app may ask your permission to send notifications. Roomie delivers push notifications through Firebase Cloud Messaging (FCM), a service operated by Google. When permission is granted, your device generates an FCM registration token that is sent to and stored on Roomie's servers and linked to your account so we can notify you of new chat messages or direct messages while the app is in the background or closed. For chat room messages and unencrypted direct messages, limited details — such as the sender's username and a short preview of the message text (or an indication that an image, GIF, or voice message was sent) — pass through Google's FCM infrastructure to your device in readable form. For end-to-end encrypted direct messages, the notification carries only the sender's username and the message in encrypted form; your device decrypts it to show a preview, and neither Roomie nor Google can read it. Your tokens are removed when you delete your account, and you can revoke notification permission at any time through your device settings.

6. Chat content and direct messages

Messages sent in Roomie chat rooms are user-generated content. Messages may be shown to other users in the same room and may also be included in room history returned by the application. Chat room messages are not end-to-end encrypted.

Room moderation: The host of a room can pin one message as a banner at the top of the room, which records who pinned it and when, and can delete any message in that room. You can delete your own messages. A message deleted by the host is shown to room members as removed by the host.

Polls are created by registered users within chat rooms. A poll's question, options, vote tallies, and the creator's display name are visible to all users in the room. Each user's vote is recorded by their user identifier and is stored in the database. Polls can be shared externally via a unique URL; when a social-media crawler visits the share link, Roomie serves Open Graph metadata (title, description, and a dynamically generated image) derived from the poll data.

Under the current implementation, guest messages expire automatically after about 24 hours. When a guest message expires its content is erased, but the message record (the guest's display name, the time it was sent, and any reactions) is kept so the conversation still reads in order; room members see it as an expired guest message. Messages associated with registered accounts are not automatically deleted by the current code and may remain stored until they are manually removed or the system changes.

Direct messages (DMs) are private, one-to-one messages exchanged between two registered users. DMs sent from current app versions are end-to-end encrypted (see Section 7). DMs sent before end-to-end encryption was introduced, or from older app versions, are stored as readable text and are visible only to the sender and the intended recipient in the app. The current implementation records whether a message has been delivered to the recipient's active socket session and whether the recipient has opened the conversation thread (read receipt). Guest users cannot send or receive direct messages. The conversation history API currently returns up to 200 of the most recent messages per thread; older messages beyond that limit may not appear in the UI but may remain stored in the database.

7. End-to-end encrypted direct messages

Direct messages sent from current versions of the Roomie apps are end-to-end encrypted. Each message is encrypted on the sender's device so that only the sender and the recipient can read it.

• What Roomie can read: Roomie stores the encrypted message and cannot read its contents, including any images or voice messages attached to it. Roomie can still see who sent the message, who received it, when it was sent, delivered, and read, and the approximate size of the encrypted data.
• Keys: Each account has an encryption key pair and a signing key pair, created on your device. Roomie stores your public keys, and keeps every public key you have ever published so that older messages can still be verified.
• PIN and key backup: To let you read your messages on a new device, your device encrypts your private keys with a key derived from a PIN you choose, and uploads that encrypted backup to Roomie. Roomie never receives your PIN or your private keys in readable form, and cannot recover your PIN for you.
• Lockout: After 10 wrong PIN attempts, the backup is locked permanently. The only way forward is to reset your encryption keys, after which messages encrypted with your old keys can no longer be read on any new device.
• Older messages and app versions: DMs sent before encryption was introduced stay stored as readable text. App versions that do not support encryption show a placeholder instead of encrypted messages.
• Reports: Because Roomie cannot read encrypted messages, it can only review their content if a participant in the conversation shares it with Roomie, for example in the details of a report.

8. Paid Rooms and Payment Processing

Roomie allows hosts to create rooms that require payment to join, either as a one-time charge or a recurring monthly or yearly subscription ("Paid Rooms"). All payment processing is handled by Stripe, Inc., a third-party payment processor, using Stripe Checkout and Stripe Connect.

• Payment card and bank details are not handled by Roomie. When you pay to join a Paid Room, you are redirected to a Stripe-hosted checkout page in your device's browser, outside of the Roomie app, where you enter your payment details directly to Stripe. When a host sets up payouts, they provide identity and bank account details directly to Stripe through Stripe's own onboarding pages. Roomie's servers never receive, process, or store this information.
• What Roomie does store: Your room membership status, a Stripe customer identifier and, for subscriptions, a Stripe subscription identifier, so Roomie can determine whether you have access to a Paid Room and, for hosts, whether their Stripe Connect account is enabled to receive payouts.
• Payment confirmations are delivered to Roomie's servers by Stripe through webhook notifications, which Roomie uses to grant or revoke room access automatically — for example, when a payment succeeds or a subscription is cancelled.
• If you cancel a recurring subscription through "Manage Subscription" in the app, you are directed to a Stripe-hosted billing portal to do so; Roomie is notified of the cancellation by Stripe and updates your room access accordingly.
• Data you provide to Stripe is processed under Stripe's Privacy Policy, not this policy.

9. Data retention

• Guest accounts are configured to auto-delete after about 24 hours.
• Guest chat messages have their content erased after about 24 hours; a placeholder with the guest's display name, the time sent, and any reactions remains in the room.
• Registration verification records and password reset records are temporary and are currently deleted after they expire, which is configured for about 30 minutes.
• Registered account records (including your profile details, location, and encryption keys and key backup), non-guest chat history, and poll data (including votes) are retained until removed by the operator or changed by future product updates, except for unused accounts as described below.
• Direct messages between registered users, including encrypted messages and their encrypted attachments, are not automatically deleted and may remain stored indefinitely until removed by the operator or changed by future product updates. This applies to both messages you have sent and messages others have sent to you.
• Voice message audio files sent in chat rooms or unencrypted direct messages are automatically deleted from the server after 90 days from the date they were uploaded, regardless of whether the associated message still exists. Voice messages sent in encrypted direct messages are stored as encrypted attachments and follow the direct message rule above.
• Device records are removed after 30 days without use, when you sign the device out, or when you delete your account.
• Audio Room participation data (your role and session token) is transient and tied to your live connection; it is not retained once you leave, the host ends the room, or the room's session time limit (approximately one hour) is reached. No audio content from Audio Rooms is recorded or stored.
• Session records are stored in Redis with a current time-to-live of about 24 hours.
• Paid Room membership records, Stripe customer and subscription identifiers, and host Stripe Connect account status are retained for as long as the associated account or room membership exists, or as required to comply with financial recordkeeping obligations.

The server runs a periodic cleanup process (currently every 60 seconds) that hard-deletes expired guest messages, expired verification records, and expired password reset records from the database.

If you use the in-app account deletion feature, the current implementation deletes your registered account record from the database — including your profile details, location, device records, and encryption keys and key backup — deletes your profile photo file, cancels any active Paid Room subscriptions, removes your poll votes, Paid Room memberships, and blocks, ends your session, and sends a confirmation email to your registered address. Messages you previously sent in chat rooms and direct messages are not deleted: they remain stored and visible to other users, but the name shown on them is replaced with an anonymous label (such as "deleted_user_1a2b3c4d"). The same applies to polls and Q&A questions you created. Direct messages that other users have sent to you also remain stored unless removed separately by the operator.

Removal of unused accounts: To avoid holding personal data we don't need, Roomie removes registered accounts that have never been used. An account counts as unused if it was created at least six months ago and nobody has signed in to it since it was created. Before removing an unused account, Roomie sends one warning email to the address registered to it, giving the removal date, which is at least 14 days after the email is sent. Signing in to the account once before that date cancels the removal, and you don't need to do anything else. Roomie checks again on the removal date and does not remove an account that has been signed in to since the warning was sent. If nobody signs in, the account is deleted in the same way as an in-app account deletion (described above). It cannot be recovered afterwards, but you can register again with the same email address at any time.

10. Third parties and service providers

Roomie uses third-party infrastructure and libraries to operate the service. Based on the current implementation, these include:

• Email delivery infrastructure used to send verification, password reset, profile reminder, account deletion, and unused-account warning emails.
• MongoDB for account, message, room, and token storage.
• Redis for session and presence storage.
• Socket.IO for real-time communication.
• Google OAuth for optional sign-in via Google accounts, including the profile picture Roomie copies when you sign in with Google.
• Apple for optional Sign in with Apple. Data Apple shares with Roomie is described in Section 3; Apple's handling of your data is subject to Apple's Privacy Policy.
• Meta (Facebook) for optional Facebook Login. Data Facebook shares with Roomie is described in Section 3; Meta's handling of your data is subject to Meta's Privacy Policy.
• Your device's operating system location and geocoding services (Google Play services on Android, Apple's location services on iOS), which the app uses on your device to turn your approximate location into a city name, if you choose to add your location. These services are subject to their providers' own privacy policies.
• Maps (Google Maps Platform on Android, Apple Maps on iOS) for the map banners on profiles and the People map. To draw them, the app sends the city, region, and country being shown — yours or another member's — to the map provider, which turns it into approximate map coordinates and returns the map. These requests are made from your device, so the provider also receives its IP address; your account details and your device's own coordinates are not sent. This data is processed under Google's Privacy Policy or Apple's Privacy Policy.
• Firebase Cloud Messaging (Google) for delivering push notifications. Your devices' notification registration tokens and the notification content (the sender's username and either a short message preview or, for encrypted direct messages, the encrypted message) are transmitted through and processed by Google under Google's Privacy Policy.
• Klipy for GIF, meme, and sticker search and display, including sponsored content shown in the picker. When you use the picker, a customer identifier (your account ID or username) and any search query you enter are sent to the Klipy API. Media files are loaded directly from static.klipy.com. Data sent to Klipy is processed under Klipy's own privacy policy.
• Stripe for payment processing, subscription billing, and host payouts related to Paid Rooms. When you pay for or manage a Paid Room, your payment details are sent directly to and processed by Stripe under Stripe's Privacy Policy. Roomie does not receive or store your payment card or bank account details.
• Agora for real-time voice transmission in Audio Rooms. While you are connected to an audio room, your voice audio is routed through Agora's infrastructure to other participants; this audio is not recorded or stored by Roomie. Data processed by Agora in connection with this feature is subject to Agora's own privacy policy.

11. Security

Roomie uses password hashing, session cookies, security headers, request sanitization, and rate limiting as part of its current security controls. Direct messages sent from current app versions are end-to-end encrypted, and private encryption keys are only stored on Roomie's servers in a form encrypted with your PIN (see Section 7). Chat room messages are not end-to-end encrypted. No method of storage or transmission is completely secure, so Roomie cannot guarantee absolute security.

12. Your choices and rights

Depending on your location, you may have rights to request access to personal data, correction of inaccurate data, deletion, restriction, objection, or data portability. You can also clear the app's stored data, including cookies, through your device settings at any time, although doing so may sign you out or reset parts of the user experience.

Profile: You can change your username, first name, and profile photo, add or clear your location, and hide your online status in the app. Your date of birth and gender cannot be changed in the app once set; to correct them, contact us (see Contact). Location permission is optional, and you can revoke it at any time through your device settings.

Account deletion: Registered users can request account deletion from the in-app profile/settings modal. Guest users do not have a registered account and therefore do not have an account to delete through this feature (guest identifiers are designed to expire automatically).

13. Age requirement

Roomie is only for people aged 18 or over. Registered users must give their date of birth, and Roomie refuses accounts whose date of birth shows they are under 18. Guests must also be 18 or over to use the Service. If you believe someone under 18 is using Roomie or has provided personal information, contact the site operator so the account can be reviewed and removed where appropriate.

14. Changes to this policy

This policy may be updated from time to time to reflect changes in the service, legal requirements, or data handling practices. The effective date at the top of this page will be updated when material changes are made.

15. Contact

For privacy questions or requests, contact the site operator at info@mail.roomieverse.net.

Account deletion request: Request that your Roomie account and associated data be deleted.

Deletion policy page: How to request account deletion and what data is deleted or retained.