Privacy Policy

Introduction

Welcome to Roomn, a study buddy matching and social study application developed by Hedefa. Roomn connects students with compatible study partners, provides collaborative study tools, and builds an engaging community around academic achievement.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Roomn mobile application and associated services. We are committed to protecting your privacy and handling your data with transparency and care.

By using Roomn, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the application.

This Privacy Policy is effective as of April 15, 2026.

Scope

This Privacy Policy applies to:

• The Roomn iOS application available on the Apple App Store
• The roomn.app website and all associated web pages
• All users globally, regardless of geographic location

This Privacy Policy does not apply to third-party services, websites, or applications that may be linked from within the Roomn app. We encourage you to review the privacy policies of any third-party services you access through or in connection with Roomn.

Data We Collect

We collect several categories of information to provide and improve the Roomn experience. Below is a comprehensive breakdown of the data we collect, organized by type.

3.1 Account Data

• Email address
• Password (hashed via Supabase Auth — we never store or have access to your plaintext password)
• Google Sign-In OAuth token (if you choose Google authentication)
• Apple Sign-In identifier (if you choose Sign in with Apple)
• Username
• Authentication identifier (auth_id)

3.2 Profile Data

• First name / display name
• Date of birth (used for age gating and age display)
• Gender
• School or university
• City (self-reported by you — not derived from GPS or location services)
• Bio / about me text
• Subjects of study
• Hobbies and interests
• Profile photos (stored in the Supabase profiles storage bucket)
• Preview photos

3.3 User-Generated Content

• Chat messages (text and images stored in the chat-media bucket), including reactions, edits, deletions, and replies
• Community feed posts (Study Space, Question, Rant, and Forfeit post types)
• Post images (stored in the post-images bucket)
• Comments on posts
• Classroom memberships and activity
• Study session records (duration, subject, timestamp)
• Virtual pet state and progression data
• Reports submitted against other users or content

3.4 Device & Technical Data

• Apple Push Notification service (APNs) device token
• Device model and iOS version
• App version and build number
• IP address (collected by Supabase, Cloudflare, RevenueCat, and PostHog as part of standard service operations)
• Crash logs and diagnostic data

3.5 Usage & Behavioral Data

• Swipe interactions (likes, passes)
• Match data
• Study hours, streaks, and heatmap data
• Screen views and feature interactions (collected via PostHog)
• Feature flag exposure data (collected via PostHog)

3.6 Subscription & Purchase Data

• RevenueCat anonymous user ID
• Subscription status and entitlement (roomn Pro)
• Product identifiers (roomn_premium_monthly, roomn_premium_annual)
• Receipt validation data

3.7 AI-Generated Content

• Weekly report cards generated from your aggregated study data
• Inputs sent to Cloudflare Workers AI (Llama 3.1 8B model) for report generation
• AI-generated outputs, stored in our database and linked to your user account

How We Use Your Data

We use the information we collect for the following purposes:

1. Providing the core service — enabling study buddy matching, chat, classrooms, study sessions, the community feed, and profile functionality.
2. Account management — authentication, password resets, and account deletion.
3. Personalization — discovery ranking, recommended classrooms, and virtual pet progression.
4. AI report cards — generating weekly study summaries via Cloudflare Workers AI.
5. Push notifications — sending match alerts, message notifications, classroom activity updates, and study reminders.
6. Subscriptions and billing — managing premium entitlements through RevenueCat and Apple.
7. Safety and moderation — reviewing reported content, enforcing community rules, and banning users who violate our terms.
8. Analytics and product improvement — understanding feature usage and improving the app through PostHog analytics.
9. Legal compliance — responding to lawful requests and enforcing our Terms of Service.
10. Communications — sending critical service messages. We do not send marketing communications unless you have explicitly consented.

Legal Bases for Processing (EU/UK Users)

For users in the European Union and United Kingdom, we rely on the following legal bases under GDPR:

• Contract — processing necessary to provide the core Roomn service as described in our Terms of Service.
• Legitimate interest — safety and moderation, analytics, fraud prevention, and service improvement.
• Consent — optional features and marketing communications (where applicable).
• Legal obligation — compliance with law enforcement requests and applicable laws.

On-Device Processing

Certain features in Roomn leverage on-device processing to protect your privacy:

• Chat message translation uses Apple's Translation framework (available on iOS 18 and later). All translation is performed locally on your device and is not sent to Roomn's servers or any third party.
• Language detection uses Apple's NLLanguageRecognizer, which operates entirely on-device.

These on-device features mean that the content of your messages is never transmitted to external servers for translation or language identification purposes.

Third Parties & Sub-Processors

We work with the following third-party service providers to operate Roomn. Each provider receives only the data necessary to perform their specific function.

AI Disclosure

Roomn uses artificial intelligence to enhance your study experience. Here is a full disclosure of how AI is used within the app:

• What it does: Generates weekly report cards that summarize your study habits, progress, and patterns.
• Model: Llama 3.1 8B, hosted via Cloudflare Workers AI.
• Inputs: Aggregated study metadata only — including duration, subjects studied, and streak data. We do not send your chat messages, posts, or profile content to the AI model.
• Outputs: The generated report is stored in our database and displayed only to you (the generating user).
• Model training: Cloudflare Workers AI does not train on customer inputs. [CONFIRM: Verify this claim with Cloudflare before publishing.]
• Opt out: You can opt out by simply not using the weekly report feature. No AI processing occurs unless you actively request a report.
• Human review: AI-generated reports are not reviewed by humans unless flagged for safety concerns.

Children & Minors

Protecting the privacy of young people is especially important to us.

• Minimum age: You must be at least 13 years old to create an account on Roomn. Users under 13 are strictly prohibited from using the app.
• Age verification: Date of birth is collected during onboarding and enforced via an age gate. Users who do not meet the minimum age requirement are prevented from completing registration.
• Under-13 accounts: If we discover that an account belongs to a child under 13, we will immediately delete the account and all associated data.
• Parents and guardians: If you believe your child under 13 has created a Roomn account, please email [email protected]. We will delete the account and all associated data within 30 days.

COPPA Compliance

Roomn does not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

GDPR-K (Age of Digital Consent)

In the European Union and member states, the age of digital consent varies between 13 and 16. Users below the applicable local age of digital consent require verifiable parental permission. Roomn does not currently support a parental consent verification flow; therefore, users in those jurisdictions who are below the local digital consent age should not use the app without parental supervision.

UK Age-Appropriate Design Code

Roomn is designed with the following principles from the UK Age-Appropriate Design Code in mind:

• Data minimization — we collect only what is necessary
• High-privacy defaults for all users
• No profiling of minors for advertising purposes
• No nudge techniques designed to encourage users to weaken their privacy settings

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Deletion — request deletion of your personal data. You can delete your account directly within the app.
• Portability — request your data in a structured, commonly used, machine-readable format.
• Objection — object to the processing of your data based on legitimate interests.
• Restriction — request that we restrict the processing of your data in certain circumstances.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Lodge a complaint — you have the right to lodge a complaint with your local Data Protection Authority (DPA).

To exercise any of these rights, you can use the in-app account deletion feature or email us at [email protected]. We will respond to your request within 30 days.

Data Retention

We retain your data according to the following guidelines:

• Active accounts: Your data is retained for as long as your account remains active.
• Deleted accounts: When you delete your account, all associated data is hard-deleted within 30 days.
• Database backups: Backups are retained for up to [CONFIRM] days before being overwritten.
• Chat messages: Retained until either party deletes them or until the associated account is deleted.
• Reported content: May be retained for up to 12 months after content or account deletion, for the purpose of safety investigations.
• Legal holds: Data may be retained longer than the periods listed above if required by law or in connection with legal proceedings.

Data Location & Transfers

Your data may be stored and processed in the following locations:

• Primary infrastructure: Supabase, hosted in [CONFIRM region].
• Sub-processor locations: Cloudflare, RevenueCat, PostHog, Apple, and Google operate infrastructure in the United States and other regions.

International Transfers

• EU/UK users: Where data is transferred outside the EEA or UK, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR.
• Saudi Arabia users: Your data may be processed outside the Kingdom of Saudi Arabia by our sub-processors listed in Section 6.

Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest: Data stored in Supabase is encrypted at rest.
• Password hashing: Passwords are hashed using industry-standard algorithms (bcrypt/argon2) via Supabase Auth. We never store plaintext passwords.
• OAuth authentication: Social sign-in (Google, Apple) uses secure OAuth flows, so we never handle your third-party credentials.
• Row-level security: All database tables use Supabase Row-Level Security (RLS) policies to ensure users can only access their own data.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

Push Notifications

Roomn may send push notifications for the following events:

• New study buddy matches
• New messages in your conversations
• Classroom activity and updates
• Study reminders
• Weekly report availability

You can disable push notifications at any time through your iOS Settings. Your device token is stored in our device_tokens database table and is deleted when you log out or delete your account.

Location Data

Roomn uses self-reported city information only. We want to be clear about what we do and do not collect:

• We do not use GPS or any device location services.
• We do not collect background location data.
• We do not collect precise or approximate device location.

The city you enter in your profile is used solely to help connect you with nearby study buddies and is displayed on your profile. You can change or remove your city at any time through your profile settings.

Photos & Media

Roomn allows you to upload photos and images in several contexts:

• Profile photos and preview photos — stored in the Supabase profiles storage bucket.
• Chat images — stored in the Supabase chat-media storage bucket.
• Post images — stored in the Supabase post-images storage bucket.

You can delete your own media at any time. All media associated with your account is permanently removed when you delete your account.

Content Moderation

To maintain a safe and respectful community, Roomn provides content moderation tools and processes:

• Users can report other users, messages, posts, and comments that violate our community guidelines.
• All reports are reviewed by the Roomn team.
• When a violation is confirmed, the offending content is removed. Repeat offenders may be permanently banned from the platform.
• Report data is retained for the purposes of ongoing and future safety investigations.

California Privacy (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

• Identifiers — name, email address, username, auth identifiers
• Commercial information — subscription status, purchase history
• Internet or electronic network activity — app usage data, feature interactions, analytics events
• Geolocation data — coarse, self-reported city only (not precise location)
• User-generated content — messages, posts, comments, photos
• Inferences — study patterns, matching preferences derived from your activity

Your California Rights

• Right to know — request details about what personal information we have collected about you.
• Right to delete — request deletion of your personal information.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale/sharing — we do not sell or share your personal information for cross-context behavioral advertising.
• Non-discrimination — we will not discriminate against you for exercising your privacy rights.

EU/UK GDPR

For users in the European Union and the United Kingdom, the following additional information applies under the General Data Protection Regulation (GDPR) and UK GDPR:

• Data Controller: Hedefa is the data controller responsible for your personal data.
• Legal bases: Our legal bases for processing are detailed in Section 4 of this policy, including Contract, Legitimate Interest, Consent, and Legal Obligation.
• Data Protection Officer: Given our current scale of operations, we are not required to appoint a Data Protection Officer. For all privacy-related inquiries, please contact [email protected].
• Right to complain: You have the right to lodge a complaint with your local supervisory authority (Data Protection Authority) if you believe your data has been processed unlawfully.

Saudi Arabia PDPL

For users in the Kingdom of Saudi Arabia, the following information is provided in accordance with the Personal Data Protection Law (PDPL):

• Controller identity: Hedefa is the entity responsible for the processing of your personal data.
• Processing purposes: Your data is processed for the purposes outlined in Section 4 of this policy.
• Cross-border transfers: Your personal data may be transferred and processed outside the Kingdom of Saudi Arabia by our sub-processors listed in Section 6. These transfers are made in accordance with applicable data protection requirements.
• Your rights under PDPL: You have the right to access, correct, and request deletion of your personal data, as well as the right to be informed about how your data is used.
• Contact for PDPL requests: Please email [email protected] for any requests or inquiries related to your rights under PDPL.

Note: The scope and application of PDPL provisions should be confirmed with local legal counsel before publication. [CONFIRM]

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• Notification of material changes: If we make material changes to this policy, we will notify you through an in-app notification and, where possible, via email to the address associated with your account.
• Last updated date: The "Last updated" date at the top of this policy reflects the most recent revision.
• Continued use: Your continued use of Roomn after the effective date of any changes constitutes your acceptance of the updated policy, where legally permitted. Where legal requirements mandate explicit consent for certain changes, we will seek that consent before the changes take effect.

Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us:

• Privacy inquiries: [email protected]
• General support: [email protected]
• Mailing address: [Legal entity address]

We aim to respond to all inquiries within 30 days of receipt.