Privacy Policy

1. Who is responsible

This Policy covers the RoomMate 0.0.1 beta for Android and iOS and its public pages.

Young Jun Chi is the individual operator and data controller. The registered address is Stieltjesweg 12, 2628 CK Delft, Netherlands. For privacy questions or requests, contact support@roommate.ac.

2. What we use and why

Accounts and the features you choose

We use the following data to provide the service under our contract with you, or to take steps you request before joining:

• Account details: your email, password hash, verification and session records, policy records and dated 18+ statement.
• Feature data: profiles, memberships, posts, comments, images, reviews, listings, messages, votes, searches, favourites, listing views and notifications.
• Study data: selected courses and saved grades. Timetables and what-if grades are stored on your device per account; saved grades also go to the service. Calendar exports send selected meeting details to your chosen calendar, as explained in section 5.

Account and security data is needed for access. Optional content, profile and study data is needed only for the features you choose. Signup does not collect a display name or ask for OpenAI sharing permission. You can add an optional display name later in Profile.

The 18+ statement does not collect your birth date, identity documents or biometric age estimates. Credible age concerns may require proportionate evidence and human review.

Safety, support and legal obligations

Security and safety data includes IP addresses, device/app/network information, failed logins, request and error logs, reports, blocks, moderation records, your content-moderation sharing choice, appeals and support correspondence.

Our legitimate interests are preventing fraud and abuse, securing the service, handling complaints fairly and protecting legal claims. Applicable legal duties also apply where required. Section 4 explains the separate permission required before sharing content with OpenAI.

For optional Ko-fi support, we use contact details, messages and payment/refund/dispute records for our legitimate interests in administering support and resolving problems, and for accounting or tax obligations where applicable.

We also handle information needed for valid authority requests under applicable legal obligations, or to protect vital interests in an emergency where the legal conditions are met.

Sources and device storage

Data comes from you, your device and activity, service providers, other users' content or reports, Ko-fi and lawful authority requests. Course information comes from public TU Delft Study Guide and TimeEdit sources. Share only necessary personal information, especially sensitive data or allegations about others.

We do not use your data for advertising, sell personal data or track you across websites. RoomMate does not operate its own behavioural analytics. Google's sign-in software has its own data handling, including SDK analytics, as explained in section 5. The app stores sign-in and feature data on your device; public pages store your theme choice.

We do not request precise device location. Photos can contain location and other metadata that reaches the server before removal from the stored image.

Reports provided by Apple and Google

Google Play makes install and usage statistics available to us. Its Android vitals diagnostics use eligible devices whose users share usage and diagnostics data with Google.

During TestFlight testing, Apple automatically collects and shares crash logs and usage information with us; you cannot opt out while using TestFlight. Reports can include device and app details and names or email addresses from invitations or feedback. Feedback and screenshots you choose to submit are also shared.

We use platform reports for our legitimate interests in fixing faults, improving reliability and responding to feedback. We review TestFlight reports in App Store Connect without routine exports. Necessary support or privacy case copies follow the limits in section 8.

See Apple's TestFlight notice and Google's Privacy Policy for their own processing and controls.

3. Who can see your information

Other users and anonymous display

Community posts, comments, course reviews and listings are visible to other RoomMate users who have access to those features. Posts and comments show your display name unless you choose anonymous display. Your display name and avatar, where provided, appear in listing conversations.

Anonymous contributions and course reviews hide your account identity from peers. RoomMate retains an internal account link for safety, blocking, moderation and lawful requests. Reporting does not automatically identify the reporter or give access to a hidden author's identity.

Listing messages are for their participants; grades and account controls are private to your account.

Uploaded images have public links: anyone with a link can open them outside RoomMate. People may also keep copies or screenshots of content they can see.

Authorised access and disclosures

Necessary authorised access may include messages, reports, moderation records and hidden account links for support, safety and lawful requests. We do not continuously read every contribution.

TU Delft receives mailbox messages and delivery metadata, not other RoomMate activity merely because you use its email service. Authorities, courts, emergency services and professional advisers may receive necessary information where there is a valid legal basis.

Sections 4–7 explain content checks, calendar destinations, service providers and optional support payments.

4. Content checks and your sharing choice

When checks happen

Local word and phrase checks and OpenAI's automated text and image moderation can refuse content before RoomMate publishes it, delivers it to another user or saves the change you requested.

Signup does not submit a display name to OpenAI or ask for a moderation sharing choice. When you first use a feature that requires an OpenAI check, the app explains what will be shared and why, and asks for your permission unless you already have a saved choice covering that check.

If you allow sharing, we remember the choice for your account. It covers the text and photos needed to check content you submit through RoomMate: display names and study programmes, community details, posts and comments, course reviews, listing details and messages, and new post, listing and profile photos. Making a listing active may check its stored text.

We do not continuously send your saved content or message history to OpenAI. Existing account-wide choices remain subject to their recorded scope and your withdrawal. Earlier permissions limited to a display-name check or individual submission authorise only those checks; they do not become account-wide permission.

What is shared

We send the text or photo needed for the check without adding your account or university identifier, email, password, verification code or message history. The content itself can contain personal information about you or others.

New photos for posts, listings and avatars are checked one at a time. We resize each photo and remove embedded metadata, then send the same photo that will be uploaded if it passes. Everything visible in the image is shared with OpenAI, including people, writing or personal details. Existing photos are not retrospectively checked or labelled approved.

Declining or withdrawing

You can review or withdraw permission in Settings → Data and privacy → Content moderation. Withdrawal stops future checks. A check already in progress may finish, and content already sent to OpenAI cannot be recalled.

If you decline or withdraw, submissions that need an OpenAI check cannot be completed unless you later allow sharing. You can keep editing. If checking is temporarily unavailable, follow the displayed wait and try again later. Reading, reports, appeals, privacy requests and account deletion do not require an OpenAI check.

Withdrawal does not remove existing RoomMate content. Use the relevant feature's removal control or delete your account if you want it removed. We ask again before sharing with a different provider or materially changing the data shared or the purpose.

The safety purposes and legitimate interests described in section 2 apply. The separate sharing permission is not inferred from accepting the Terms or Community Rules, acknowledging this Policy, or continuing to use RoomMate.

Limits and records

Checks can miss violations or refuse acceptable content. Image checks cover a narrower range of harmful material than text checks and do not assess every rule or its context.

You can edit refused content or contact support for human review; share only the details needed. A refusal does not itself suspend your account. We keep no separate screening copy of refused text or photos and no individual refusal record. Section 8 explains the limited records kept for approved photos and your sharing choice.

5. Calendar connections and copies

Google Calendar

Google Calendar connection is separate from signing into RoomMate. If you connect it, RoomMate receives the selected Google account's ID and email to identify the connection and destination. Google's sign-in software can also return a profile name and photo link; this feature does not use them or load that photo.

Google also processes information through its sign-in software under its own privacy terms. On iOS, its SDK privacy declaration includes names, email addresses, phone numbers, account and device identifiers, approximate location, usage data and other data. The declared purposes include app functionality and analytics; the purposes differ by data type. Google declares that this SDK data is not used for tracking. Google's sign-in privacy guidance also describes IP-derived general location for fraud prevention. These provider-side declarations are separate from the account information that RoomMate itself receives and uses as described above.

You authorise RoomMate to create and manage a dedicated RoomMate calendar. This permission does not give access to arbitrary existing Google calendars. Connecting may create that calendar before you save any meetings.

You choose the quarter and whether to include personal events, then review and save the export. Copies contain course or personal-event titles and course codes, dates, start/end times, rooms or locations, instructor names and saved details. Those details can contain personal information about you or others. RoomMate adds opaque identifiers to recognise its copies and reads exported meetings back for updates or removal.

Updates are manual and one-way, from RoomMate to the calendar. Return to the export to review and save changes. Signing in does not enable automatic updates when RoomMate opens or while it is closed. Your calendar provider controls how its calendar appears on other devices.

Calendar data goes directly between your device and Google, without passing through RoomMate's servers. Google's sign-in software manages its authorisation credentials on the device. RoomMate does not receive your Google password or send Google credentials to its servers. Your device keeps connection and export records, including the destination, copied meeting details and identifiers needed for updates and removal. RoomMate does not add invitations or use calendar data for advertising.

A direct Apple Calendar account connection is not available in this version.

Existing phone-calendar exports and calendar files

Exports made with an earlier phone-calendar option can still be managed from their saved RoomMate export record. Calendar permission lets RoomMate list writable calendars and account names and check its copied meetings before changing them. Finding its copies can involve reading other entries in the selected calendar and time period on your device; those entries are not exported or sent to RoomMate's servers.

A local calendar stays on the phone. An account calendar's provider controls syncing and access on other devices. Earlier calendar-file sharing sent the selected meeting details to the app or recipient you chose. Imported file copies cannot be updated or removed through RoomMate.

This version does not offer new phone-calendar exports or calendar-file sharing. Existing cache copies are described in section 8.

Removing copies and revoking access

Calendar copies remain outside RoomMate. Logout, RoomMate account deletion, app removal or revoking calendar access does not delete exported calendars or events.

While the local export record and calendar access remain available, Remove this export can remove meetings managed by RoomMate. It preserves meetings whose exported title, description, location or times were changed, or which were moved to another calendar. A change only to reminders or other calendar settings does not protect a meeting from removal. Remove other copies directly in your calendar app.

Use Disconnect Google Calendar or Google Account access controls to revoke RoomMate's Google access. After restarting RoomMate, you may need to reconnect the same Google account to use the in-app disconnect control. Google Account controls remain available without reconnecting in RoomMate. For a phone calendar, revoke permission in device settings. Revoking access stops future calendar access; it does not recall existing copies.

An in-app account deletion clears RoomMate's local export records on that installation. Removing app data or uninstalling can also remove those records. Without them, use your calendar app to remove remaining copies.

6. Providers and overseas processing

Providers receive the data needed for their services when you use the app, send email or access our domain:

• Supabase Pte. Ltd. stores account details, content, images and related records, with primary project hosting in Ireland. The provider is based in Singapore. Privacy contact · Subprocessors.
• Railway Corporation hosts the application and temporary service records in the Netherlands, and handles application data and request/error logs. It also processes data in the United States. Privacy contact · Subprocessors.
• Plus Five Five, Inc. (Resend) sends account verification and recovery email, processing email addresses, message content and delivery records. Messages are sent from Ireland; email data is stored in the United States. Privacy contact · Subprocessors.
• Google Cloud EMEA Limited (Google Workspace) provides support email, processing correspondence, attachments and delivery information. Google uses global facilities, including the United States. Privacy contact · Subprocessors and locations.
• OpenAI provides automated text and image moderation on our behalf through its API. The selected project uses global processing, which can involve the United States and other countries outside the EEA. We do not promise EU-only processing. OpenAI's data-processing terms identify OpenAI Ireland Ltd. for EEA customer data and provide applicable transfer safeguards. Privacy contact · Data-processing terms · Subprocessors.
• Namecheap, Inc. provides domain resolution through its global DNS network, processing DNS requests and related network information. Privacy contact · Service privacy details.

Providers may use the subprocessors linked above for relevant services; not every listed provider function receives your data. Personal data may also be accessed from South Korea or processed outside the European Economic Area (EEA) as described above.

Apple and Google process testing and distribution data under the platform notices linked in section 2. Google Calendar and other calendar destinations receive the meeting details described in section 5 under their own privacy notices, account settings and processing locations. These services are separate from Google Workspace support email. RoomMate does not promise that exported calendar copies remain in the EEA.

The EU's South Korea adequacy decision covers qualifying transfers to South Korea. Supabase's standard data-processing terms include EU Standard Contractual Clauses for applicable transfers, as does Resend's DPA. Transfers outside an adequacy decision's scope require another lawful transfer mechanism and any required safeguards.

Contact support@roommate.ac for transfer information and copies of applicable safeguards.

7. Optional Ko-fi support

The support link opens ko-fi.com/roommatejun externally after confirmation, without adding a RoomMate account identifier or tracking parameter. Ko-fi and its payment provider receive browser/network information and handle payments under their own notices.

Depending on your choices and payment settings, the operator may receive your display name, email, message, amount, currency, support status and transaction, refund or dispute details. Supporter data is not matched to RoomMate accounts or used to give app benefits or favourable treatment.

Use the providers' controls for their records and monthly-support cancellation. RoomMate account deletion does not do either.

8. Retention and deletion

Account and feature data

Account and feature data normally remains while your account is active. Delete your account through Home profile avatar → Profile → Advanced settings → Delete account, or email support@roommate.ac with Account deletion.

Account deletion removes your account, profile, posts, comments, reviews, listings, listing messages and grades. Communities you created may remain after their creator-account link is removed. Stored images are removed through later cleanup, with retries if removal fails.

Necessary records may be retained or detached from the account for unresolved reports, appeals or disputes, security investigations, legal duties or claims. Detached records are not necessarily anonymous. A limited block entry may remain until the blocking user removes it or deletes their account.

Expiring and operational records

• Verification: codes normally expire after 15 minutes and incomplete registrations after 24 hours. Expiry does not mean immediate deletion.
• Unattached uploads: these become eligible for cleanup after 24 hours. Eligibility does not mean immediate deletion.
• Approved photos: a restricted record links the account and destination to the checked image's digital fingerprint and size, screening and permission versions, model and approval time. It contains no additional photo copy or classifier scores and prevents unapproved uploads from being attached elsewhere. It is removed with the upload record after image cleanup, or earlier when the account is deleted.
• Moderation sharing choice: we retain its scope version, granted or withdrawn status, and latest recorded grant and withdrawal times for the account. This record contains no submitted text or photos. Withdrawal changes the record to prevent future checks; account deletion removes it.
• Routine support mail: deleted 90 days after resolution. Account deletion does not automatically remove support mail.
• Minimum privacy-request and completed moderation evidence: retained for six calendar months after closure or final appeal.
• Necessary longer retention: ongoing restrictions, unresolved safety work, disputes or legal holds are reviewed every three months. We delete retained evidence within 30 days after the reason ends, once its ordinary retention period has also ended.
• Supporter records: retained for administration, unresolved refunds or disputes, and applicable accounting, tax or legal-claim periods.

Calendar records and older cache files

Section 5 explains local export records and calendar copies outside RoomMate. External copies do not disappear when your RoomMate account or local records are deleted.

Earlier calendar-file sharing could leave a copy in RoomMate's device cache, including after cancellation. These older files can remain until the device cache is cleared or the app is removed. Removing the sharing option or deleting your RoomMate account does not itself clear them. Earlier app versions tried to remove files more than 24 hours old on a later share; this was not a deletion deadline, and that sharing option is no longer available in this version. Copies received by another app remain under that app's controls.

Provider records and other copies

Apple retains TestFlight feedback for one year and may keep crash and usage data until bugs are resolved, under its own notice. These are Apple's periods; RoomMate's support and privacy case limits apply to our necessary case copies. RoomMate account deletion does not itself delete Apple's or Google's records.

OpenAI's published moderation-endpoint controls specify no use for model training and no abuse-monitoring or application-state retention of submitted content. Optional data sharing is disabled for our project. Service/account and usage metadata are separate from submitted content. Our quota history contains only timing and reserved-cost information, without text, photos or account identifiers. We do not send TestFlight reports or feedback to OpenAI. OpenAI's endpoint data controls explain the provider's current processing.

Resend keeps email and delivery logs for 30 days on our plan, with seven-day backups. Other people's copies and provider recovery copies may remain after active records are deleted.

We use restricted access and account security controls to protect retained data.

9. Your rights and requests

Subject to applicable conditions, you can request access, a copy, correction, deletion, restriction or portability. You can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it without affecting earlier lawful processing.

Email support@roommate.ac; no sign-in is needed. We may request proportionate information to verify you or someone acting for you. Rights, deletion and available appeals remain accessible during account restrictions or if you decline an update.

Automated checks for expired verification, excessive requests or app tampering can refuse verification, delay requests or restrict access. You can request human review by email.

You may complain directly to a competent authority, including the Netherlands' Autoriteit Persoonsgegevens. Material privacy changes receive notice where required. A policy update does not retroactively authorise a new purpose or legal basis.