ROUNDMATE — PRIVACY POLICY
Effective July 27, 2026
We respect your privacy. This policy describes what data Roundmate collects, how we use it, who we share it with, and your choices. Plain-English where possible; legal-English where necessary.
1. INFORMATION WE COLLECT
1.1 Account info you give us:
- Display name
- Username
- Email address (sign-in)
- Optional: profile bio, location label, avatar
1.2 Content you create:
- Drink logs (drink, rating, note, tags, photo, visibility, timestamp)
- Manual check-ins ("rounds") — drink, glass type, coordinates only when you choose map sharing, optional photo, optional caption — automatically expires in 30 minutes
- Cheers, short replies, friend requests, and social activity history
1.3 Device + technical info:
- Device model + operating-system version (for crash diagnostics)
- A device push token (for notifications; removed when you sign out or delete your account)
- Crash, error, and app-session diagnostics. When you are signed in, diagnostics may include your internal user ID so we can investigate account-specific failures. Default personal-information capture is off.
- Precise or approximate foreground location only when you authorize it and actively use venue discovery, attach a location to a journal entry, or choose map sharing for a live round. A shared live-round pin uses the current coordinates supplied by your device. We never run a continuous background location ping.
1.4 Optional contact discovery:
- If you choose "Find friends from contacts," the App reads phone numbers only, normalizes and hashes them on your device, and sends only those hashes for a one-time match.
- Address-book names, raw phone numbers, email addresses, and other contact fields are not uploaded. Submitted contact hashes are used to return matches and are not stored as your contact list.
1.5 We do NOT collect:
- Biometric data
- Financial data
- Health data of any kind (we do not measure intoxication)
- Browsing history outside the App
- Contents of any other app
2. HOW WE USE YOUR INFORMATION
2.1 To run the App — show your content, deliver notifications, sync your journal across your devices.
2.2 To diagnose crashes, failed requests, and reliability problems. We do not use this information for advertising or sell it.
2.3 To enforce the Terms — including detecting fraud, abuse, underage-account attempts, and content that promotes dangerous drinking.
2.4 To send notifications you've explicitly opted into (e.g. account updates, replies, and your own check-in reminders).
3. WHO WE SHARE IT WITH
3.1 Friends you've approved — they see your logs (per your visibility setting) and your live rounds.
3.2 Service providers (Apple APNs and Google Firebase for push notifications; Supabase for authentication, storage, and sync; Sentry and Firebase Crashlytics for diagnostics) — strictly to operate and stabilize the App.
3.3 Legal compliance — if required by law, court order, or to protect the safety of any person, we may disclose information as legally required.
3.4 We do NOT sell, rent, or trade your personal information.
3.5 Sponsored content. Roundmate may show clearly-labeled sponsored content — a Featured drink in Discover, a Featured venue on the map, or a brewery-partnered round skin. Every sponsored placement carries a visible "Featured" badge.
3.6 We do NOT use personalized advertising. Sponsored content is the same for every user who sees it — we never let sponsors target you based on what you drink, where you go, or who your friends are. We do NOT share personally-identifying information with advertisers.
4. LIVE BROADCAST PRIVACY
4.1 Manual check-ins ("rounds") are visible only to friends you've approved and only when you choose to share one. They are not public. They are not crawled or indexed.
4.2 A private timer never shares your location with friends. A map check-in shares a precise foreground pin only for that one 30-minute window. Roundmate does not offer automatic check-ins.
4.3 Coordinates attached to a map check-in are deleted with the check-in at the 30-minute mark.
4.4 Round photos are stored in private object storage. When a round ends or expires, its photo is queued for deletion. Failed storage deletions are retried automatically.
5. CHILDREN'S PRIVACY
Roundmate is intended for users of legal drinking age. We do not knowingly collect personal information from anyone under that age. If you believe a minor has provided us with information, please contact us at privacy@roundmate.app and we will promptly investigate and delete it. Child sexual abuse and exploitation is prohibited; see our Child Safety Standards at https://roundmate.vercel.app/child-safety.
6. YOUR CHOICES
- You can edit or delete any log from your journal at any time.
- You can end any live broadcast at any time, instantly clearing its location, photo, and visibility to friends.
- You can block another user, which immediately hides their visible content from your feed and sends a moderation notice to Roundmate.
- You can revoke notification permission in your device settings.
- You can revoke location or contacts permission in your device settings.
- You can request a copy of all data we hold about you, or its deletion, by emailing privacy@roundmate.app. We will respond within 30 days, as required by applicable law (GDPR, CCPA, LFPDPPP).
7. SECURITY
We use industry-standard practices to protect your data, including TLS for data in transit and at-rest encryption on our servers. No method of transmission or storage is 100% secure. You are responsible for keeping your account credentials confidential.
8. INTERNATIONAL USERS
Roundmate is operated from Mexico and the United States. By using the App, you consent to your information being processed in those countries. We comply with the EU General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) where applicable.
9. CHANGES
We may update this Policy. Material changes will be announced before they take effect. Continued use after a change indicates acceptance.
10. SUBPROCESSORS
We use the following service providers ("subprocessors") to operate the App. Each is contractually bound to handle your data only as needed to deliver the service:
- Apple Inc. (United States) — APNs push delivery + iCloud crash diagnostics
- Supabase Inc. (United States) — authentication, primary database, realtime sync, edge-function compute (located in us-east-1)
- Functional Software, Inc. / Sentry (United States) — iOS crash diagnostics and stability monitoring
- Google LLC / Firebase (United States) — Android push delivery and crash diagnostics
- Vercel Inc. (United States) — marketing site + email-confirmation landing page (standard web request logs and static-asset delivery)
Adding or replacing a subprocessor that materially affects your data will be announced via in-app notice before it takes effect.
11. CCPA — CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act (as amended by CPRA) gives you specific rights:
- Right to know what personal information we collect about you
- Right to delete your personal information
- Right to correct inaccurate personal information
- Right to opt out of the "sale" or "sharing" of personal information — Roundmate does NOT sell or share your personal information for cross-context behavioral advertising. There is nothing for you to opt out of.
- Right to limit the use of sensitive personal information. Precise location is used only to provide the location feature you request; it is not used to infer characteristics or for advertising.
- Right to non-discrimination for exercising your CCPA rights.
To exercise any of these rights, email privacy@roundmate.app. We will verify your identity (typically by confirming control of the email on file) and respond within 45 days.
12. GDPR — EU / EEA / UK RESIDENTS
If you are in the EU, EEA, or UK, the General Data Protection Regulation (and the UK GDPR) gives you these specific rights:
- Access — get a copy of your data
- Rectification — correct inaccurate data
- Erasure ("right to be forgotten")
- Restriction of processing
- Data portability — receive your data in a machine-readable format
- Object to processing
- Lodge a complaint with your supervisory authority (e.g. the ICO in the UK, CNIL in France, AEPD in Spain)
Our lawful basis for processing your personal data is your consent (when you sign up + grant permissions) and the performance of our contract with you (operating the App).
13. ACCOUNT DELETION + DATA RETENTION
13.1 You can delete your account at any time in the App from Settings > Account > Delete account. If you cannot access the App, email privacy@roundmate.app from the email address on the account, with subject "Delete my account."
13.2 In-app deletion runs after you confirm the request and deletes your account, profile, journal logs, friendships, live rounds, device tokens, and uploaded photos. Limited social records may be deleted or de-identified where needed to preserve another user's conversation integrity. Verified email deletion requests are completed within 7 days.
13.3 We may retain de-identified aggregate statistics that cannot reasonably be linked back to you. We may retain limited records required by law, fraud prevention, or a legal hold for as long as the applicable obligation requires.
13.4 Push-delivery operational records are retained for no more than 30 days and store a one-way token fingerprint rather than the raw device token. Social inbox history remains available until it is deleted under our operational retention rules or account-deletion process. Expired live-round rows are deleted, not archived.
14. WHAT WE DO NOT COLLECT (EXPLICITLY)
To remove ambiguity in regulated jurisdictions:
- We do NOT collect biometric identifiers as defined by Illinois BIPA, Texas CUBI, or similar laws.
- We do NOT use facial recognition, fingerprint scanning, voice prints, or behavioral biometrics.
- We do NOT use third-party advertising trackers, web beacons, or fingerprinting libraries.
- The marketing site (roundmate.vercel.app) does not set advertising cookies. Its hosting provider may process standard request details such as IP address, browser type, and timestamps for security and delivery logs.
15. CONTACT
privacy@roundmate.app — for any privacy question, request, or concern.