RoomsNmates Privacy Policy

Updated September 26, 2026 · Connected beta, version 0.4.1

This policy explains how RoomsNmates handles information in its adult-only roommate and room-finding app. It describes the current United States private beta, not features planned for a later release.

Who operates RoomsNmates

RoomsNmates is operated by Tony Gonzalez, an individual, using the RoomsNmates app name. For privacy questions, account help, safety reports, or requests about your information, contact [email protected].

Information we collect

• Account information: Your email address, account identifier, email-confirmation status, account status, and authentication-related records. Supabase Auth processes your password for authentication; do not send it to support.
• Adult eligibility and agreement records: A birth date is submitted during connected-account onboarding to check that you are at least 18. The application’s account database records the adult declaration, the accepted terms version, and acceptance time, rather than retaining that birth date as an account field.
• Profile information: Your chosen name, city, housing budget, routine, biography, and whether your profile is discoverable.
• Room listings and photos: Listing titles, descriptions, city, rent, selected amenities, listing status, and photos you choose to upload.
• Communications and activity: Message content, sender and recipient identifiers, associated room-listing information, timestamps, favorites, and account-access status.
• Safety and support information: Blocks, reports and their details, support correspondence, moderation actions, deletion requests, and related operational records.
• Technical information: Hosting and authentication services may process IP addresses, request metadata, timestamps, errors, and security logs when you use connected features.

The current app does not request precise GPS location, contacts, microphone access, or advertising identifiers. City information is supplied by you, not obtained through GPS. The photo picker gives the app access to the file you choose, rather than general access to your photo library.

Do not upload identity documents, financial account details, or another person’s private information. Do not place an exact residential address in a public profile or listing.

Why we use information

We use information to create and authenticate accounts, check adult eligibility, show profiles and room listings, deliver messages, save favorites, and apply access settings. We also use it to review listings and reports, enforce blocks and community rules, prevent abuse, troubleshoot problems, respond to support and privacy requests, and meet applicable legal obligations.

Providing information needed for an account or feature is necessary to use that account or feature. You can choose whether to make your profile discoverable and whether to submit a room listing or photo.

Who can access information

• Other eligible members: Discoverable profiles and approved listings are available to eligible members through the app. Information you choose to disclose to another person may be copied or saved by that person.
• Conversation participants: Messages are intended for their sender and recipient, subject to the app’s message-access rules. Both hosts and seekers require active Premium access to read incoming message content, including inquiries about their own room. Unsubscribed recipients receive a locked-message indicator, not a message-body preview. Withholding a message from the interface does not mean the service has not stored it.
• The operator and authorized personnel: Account support, technical operations, moderation, and safety investigations may require access to information, including relevant messages and reports. Messages are not end-to-end encrypted.
• Service providers: RoomsNmates uses Supabase for authentication, its database, and uploaded-photo storage; Brevo for account authentication and password-reset emails; and Google Play and Google Cloud services for subscription payment processing, verification, and billing notifications. Support email is handled through Gmail. Providers process information needed to deliver these services.
• Legal or safety recipients: Information may be disclosed when reasonably necessary to comply with applicable law or valid legal process, investigate abuse, or protect rights and safety.

Safety reports and private account records are not displayed as public profiles or listings. The beta does not sell personal information, share it for cross-context behavioral advertising, or include advertising or third-party analytics SDKs.

Device storage and security

The fictional design-preview mode is separate from connected accounts. Its sample people and images are not real member profiles; local preview drafts and preferences may be stored in app-private Android storage. Connected mode does not import those sample profiles into the live service.

The current connected app keeps its login session in memory rather than intentionally persisting it on the device. It does not save your authentication password in app storage. Leaving or restarting the app may require signing in again.

Connections to the backend use HTTPS, and access permissions are checked on the server. Uploaded photos use private storage with short-lived access links and are re-encoded by the app before upload. These safeguards do not guarantee complete security or prevent an authorized recipient from saving information.

The Supabase project is configured in a US East region. That configuration does not mean every provider, support operation, or technical log is processed exclusively in that region.

Retention

Account information and associated content are generally retained while your account remains active and as needed to provide the service. Routine verified in-app deletion requests are processed automatically, with manual review for exceptions; hiding an account is not the same as deleting its stored information.

Limited information may need to be retained after deletion when justified for security, fraud prevention, a specific dispute, or a legal obligation. Such retention should be limited to the information and period needed for that purpose. Provider logs and backups may remain until their applicable retention or backup cycles expire; deletion from active systems does not imply immediate erasure from every backup.

Contact the privacy email if you need information about the handling of a particular request or any retention exception. The operator has committed to the deletion timeframe below; the beta’s detailed retention schedule for exceptional records, provider logs, and backups still needs to be finalized before public launch.

Your choices and privacy requests

You can edit your profile and listing information, change profile visibility, and use the app’s blocking and reporting controls. Blocking cannot erase screenshots or information someone has already received.

The app’s Settings provides a core-account-data export. This is not necessarily a complete response to a privacy access request; contact support for broader access, correction, or deletion requests.

Depending on where you live and which laws apply, you may have additional rights concerning your personal information. Contact [email protected] to exercise applicable rights or question a decision about your request. Reasonable verification of account ownership may be needed, but do not email passwords or identity documents.

Privacy, safety, and account-deletion requests do not require a paid subscription.

Request account and data deletion

You can request deletion without reinstalling the app or buying a subscription:

1. Email [email protected], preferably from the address used for your RoomsNmates account.
2. Use the subject RoomsNmates account deletion.
3. State that you want your RoomsNmates account and associated data deleted. If you cannot use your account email, explain that you need another way to verify ownership.

You can also request deletion in the connected app’s Settings after confirming your account password and typing DELETE. An in-app request hides the profile and listings immediately. An automatic worker checks for requests every five minutes, removes eligible account data, verifies removal, and retries temporary failures; this is not a guarantee of completion in five minutes. Requests involving safety reports, staff accounts, or repeated cleanup failures go to the operator for review. A review flag is not itself a lawful reason to keep all data indefinitely.

We will complete verified account-deletion requests within 30 calendar days after verifying account ownership, or sooner if applicable law requires. We will seek only the information reasonably needed to verify ownership and will not use verification to unnecessarily delay a request. Any applicable legal deadline that runs from receipt of the request still applies.

Routine automatic deletion removes the authentication account and associated profile, listings, uploaded photos, favorites, messages involving the account, blocks, entitlement records, invitation, and associated app audit records. Support correspondence, safety evidence, provider backups, and logs require separate review where they are not removed with the account. Email-only requests require manual ownership verification and operator handling.

The app shows automatic completion status while your current session remains valid. If you leave the app, contact support with your request reference; email confirmations are handled manually, not by an automatic email service. We will confirm completion and explain any applicable retention exception, unless prohibited by law. The 30-day commitment covers processing the request and deleting eligible information from active systems; it does not promise immediate erasure of backup copies before their applicable cycles expire.

A restricted deletion receipt keeps the request reference, account identifier, processing status, and timestamps for up to 30 days after completion, then is automatically removed. The contact email is kept only for follow-up and removed when completion is viewed in the app or an email confirmation is recorded, and no later than receipt expiry. Unfinished requests remain tracked until resolved rather than silently expiring.

Copies independently saved by other members may remain outside our control. Contact support for request status; do not send your password or government ID.

Adults only

RoomsNmates is intended only for people aged 18 and older. Its birth-date declaration is not independent identity or age verification.

If you believe someone under 18 is using the service, report the account in the app or contact support. The operator must investigate and address access and associated information as appropriate.

Payments and subscription information

Google Play processes Premium subscription payments. RoomsNmates does not receive payment-card details. To verify purchases and manage access, we process purchase tokens, product and plan identifiers, an account-linked obfuscated identifier, subscription status, expiry and acknowledgement information, and billing notifications. These records are processed using Supabase and Google services and retained as needed for access management, fraud prevention, refunds, disputes, and legal obligations.

Premium unlocks incoming messages for both hosts and seekers on the subscribed account. Browsing and posting one room remain free. Privacy requests, safety reports, blocking, and deletion never require a subscription. Deleting your RoomsNmates account does not cancel Google Play billing; cancel separately in Google Play subscriptions. Material changes will be communicated through an updated notice and additional notice or consent where required.

Contact

RoomsNmates · Tony Gonzalez, individual operator
Privacy, support, and safety: [email protected].

This policy describes information practices. It is not a guarantee of another member’s identity, a background check, or a guarantee of personal safety.