Effective August 28, 2026 · Last updated August 2026
Plain English: Your writing never leaves your browser. We don’t collect it, store it, or see it. We collect the minimum needed to run your account and your subscription — your email and payment status — and nothing more. We never sell your data, and we never use your writing to train AI (it never reaches us in the first place). Full legal detail follows.
Contents: 1. Information We Collect · 2. How We Use Your Information · 3. Legal Bases (GDPR) · 4. Cookies and Tracking Technologies · 5. What RoomyType Never Sees (and the Voice Dictation Exception) · 6. Sub-Processors · 7. How We Share Information · 8. Data Retention · 9. Your Rights and Choices · 10. California Residents (CCPA / CPRA) · 11. European / UK / Swiss Users (GDPR) · 12. International Data Transfers · 13. Latin America · 14. Children’s Privacy · 15. Security · 16. Third-Party Links and AI Services · 17. Do Not Track / GPC · 18. Biometric and Voice Data · 19. Future Features · 20. Data Breach Notification · 21. Changes to This Policy · 22. Contact
We collect information in three ways: information you provide directly, information generated automatically when you use the Service, and information we receive from the services that process your payment and email.
Account registration:
Extension settings (stored on your device):
Payment information:
Communications:
On our website (roomytype.com):
Through the Chrome Web Store, once you install the Extension:
| Purpose | What This Covers |
|---|---|
| Account & Subscription | Create and maintain your Account, authenticate your identity, verify that your subscription is active, and keep your plan status current |
| Payment Processing | Route your payment through Stripe and apply the correct plan to your Account |
| Transactional Email | Send account confirmations, receipts, test-drive and renewal reminders, and security alerts |
| Customer Support | Respond to your questions or issues |
| Product Improvement | Understand aggregated, anonymized usage of our website and, if enabled, the Extension |
| Voice Dictation | Enable optional dictation via your browser’s built-in speech recognition; the audio is handled by your browser, not by us (see Section 5) |
| Security & Fraud Prevention | Detect abuse of accounts and protect the integrity of the Service |
| Legal Compliance | Meet our legal, tax, and regulatory obligations |
What we do NOT do: We do not use your data to serve ads. We do not sell your personal information. We do not, and cannot, use your writing to train any AI model — your writing never reaches our servers in the first place. We do not share your information with data brokers or advertising networks.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data only where we have a valid legal basis:
| Legal Basis | When It Applies |
|---|---|
| Contractual Necessity (Art. 6(1)(b)) | Creating your Account and processing your payment: required to deliver the Service you purchased |
| Legitimate Interests (Art. 6(1)(f)) | Fraud prevention, website analytics, and product improvement, where our interests do not override your rights |
| Legal Obligation (Art. 6(1)(c)) | Tax, accounting, and other regulatory requirements |
| Consent (Art. 6(1)(a)) | Optional marketing emails and, where applicable, optional analytics cookies |
You may withdraw consent at any time where consent is the legal basis. Withdrawal does not affect the lawfulness of prior processing.
| Category | Purpose |
|---|---|
| Strictly Necessary | Authentication/session state and checkout session state. Required for operation; cannot be disabled. |
| Analytics | We use Google Analytics to understand aggregated site traffic: pages visited, general location (from IP address), device and browser type, and referring site. Google Analytics does not receive anything you write in the Extension’s panel, which never reaches our servers at all. |
| Third-Party | Google sign-in session tokens and Stripe checkout / fraud-detection tokens, governed by those services’ own policies. |
The Extension itself does not use cookies. It stores settings and Account status using chrome.storage.local, a browser storage mechanism that keeps data on your own device. This data is not a cookie, is not transmitted to us, and is not accessible to us.
This section exists because it is the most important thing we can tell you: the text you write in RoomyType’s panel is processed entirely inside your own browser. It is never transmitted to, stored on, or logged by any server we operate. There is no server for it to go to.
Specifically, RoomyType does not receive, store, transmit, or have any access to:
This is a deliberate architectural choice, not a policy we could quietly change. RoomyType has no back end for your typed writing to travel to.
Voice dictation works differently from typed text, and we want to be direct about that rather than let it blend into the claim above. If you use voice dictation, your spoken audio does leave your device.
When you dictate instead of type, RoomyType activates your browser’s built-in speech recognition (the Web Speech API). In Chromium-based browsers such as Google Chrome, your browser transmits your spoken audio to its vendor’s speech-recognition service (Google’s, in Chrome’s case) to convert it into text, under that vendor’s own privacy terms. RoomyType does not operate or contract for that service, does not receive the audio, and the browser vendor is not our sub-processor. Dictation itself sends nothing to roomytype.com. Once the audio is converted into text, that resulting text behaves exactly like typed text: it is inserted into the panel and stored locally only. We do not receive, see, or retain the audio or the transcribed text on our servers at any point.
If you prefer that no audio ever leave your device, simply type instead of using the dictation feature; typing is unaffected by any of this and remains fully local as described above.
The following companies process limited data on our behalf, or independently under their own privacy policies, in connection with operating RoomyType:
| Service | What It Handles |
|---|---|
| Supabase Inc. | Our backend. Handles account authentication (Google sign-in and email / magic link) and stores your email address and subscription status. Verifies whether your subscription is active. Never receives the content you write. |
| Vercel Inc. | Website and serverless API hosting for roomytype.com, including our license-verification endpoint. Standard server logs: IP address, browser type, pages visited. |
| Google Analytics (Google LLC) | Aggregated website usage analytics: pages visited, general location from IP address, device/browser type, referring site. Governed by Google’s own privacy policy. Never receives the content you write, which never reaches our servers. |
| Stripe Inc. | All payment processing. We receive your email address and subscription status only. Card details never touch our systems. |
| Plunk | Email delivery and marketing, on Plunk’s cloud infrastructure. Stores your email address, subscription status, and message engagement. Unsubscribe available in every marketing email. |
| Google (Sign-in / OAuth) | Only if you choose to sign in with Google. Authenticates you and returns your email address to our Supabase backend. Configured by us through Google Cloud Console and governed by Google’s own privacy policy. Does not receive the content you write. |
| Google (Chrome Web Store) | Distribution of the Extension. Install counts, ratings, crash reports, and anonymous usage statistics. Google does not provide us with user emails. |
| Your browser’s speech service (e.g., Google, in Chrome) | Voice dictation only, and only if you use it. Your browser’s built-in speech recognition (Web Speech API) transmits your spoken audio to the browser vendor’s speech service to transcribe it, under the vendor’s own terms. This is NOT a sub-processor we operate or contract for; RoomyType never receives the audio or the transcript. |
Each sub-processor listed above is contractually obligated to protect your data and use it only as necessary to provide the services they deliver to us. The browser speech service is an exception: it is not our sub-processor but your browser’s own built-in service, governed by your browser vendor’s terms. We will update this list when sub-processors are added or removed.
We do not sell your personal data. We share information only in these circumstances:
| Circumstance | Detail |
|---|---|
| Sub-Processors | Sharing with the sub-processors listed in Section 6, strictly as necessary to deliver the Service. |
| Legal Requirements | We may disclose your information if required by law, court order, subpoena, government request, or regulatory requirement. Where permitted by law, we will notify you before complying. |
| Protection of Rights | Where we reasonably believe it is necessary to protect the rights, property, or safety of Renderal Studio LLC, our users, or the public. |
| Business Transfers | In a merger, acquisition, asset sale, or reorganization, your information may be transferred. We will notify you at least 30 days before your personal data becomes subject to a different privacy policy, and you may delete your Account before the transfer. |
| With Your Consent | We may share information with third parties with your explicit prior written consent. |
| Data Type | Retention |
|---|---|
| Your writing | Not applicable — we never receive or store it. It stays on your device, in your browser, only. |
| Voice dictation audio | Not retained by us at all — we never receive it. Your browser transmits the audio to its vendor’s speech service to transcribe it; any retention of that audio is governed by your browser vendor’s policies, not ours. |
| Account & email | Retained while your Account/subscription is active, and for a reasonable period afterward for support and billing history, then deleted on request or after account closure, except where a longer period is required by law. |
| Local Extension settings | Stored only on your device via chrome.storage.local. Deleted when you remove the Extension or clear its storage. We have no copy. |
| Payment records | Retained as required by Stripe and applicable financial and tax regulations, typically 7 years. |
| Website server logs | Retained briefly in raw form for operational purposes, then in aggregated or anonymized form for up to 24 months. |
| Email correspondence (support) | 3 years from your last communication with us. |
You may request deletion of your Account and associated data at any time. See Section 9. Retention periods may be extended only where required by applicable law.
| Right | What It Means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Correction | Request correction of inaccurate or incomplete personal data |
| Deletion | Request deletion of your personal data, subject to legal retention obligations |
| Portability | Request your data in a structured, machine-readable format |
| Objection | Object to certain types of processing, including direct marketing |
| Restriction | Request that we limit processing of your data in certain circumstances |
| Withdraw Consent | Withdraw consent where consent is the legal basis for processing |
| Opt Out of Marketing | Unsubscribe from marketing emails via the link in any email |
To exercise any right, email hello@roomytype.com, subject line “Privacy Request: [Right You Are Exercising].” We will respond within 30 days (45 days for complex requests, with notice). We may verify your identity before processing. We will not discriminate against you for exercising your privacy rights.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you specific additional rights.
| Category | Examples |
|---|---|
| Identifiers | Email address, Account ID, IP address |
| Commercial Information | Purchase history, plan selected, transaction records |
| Internet / Network Activity | Website usage data, browser and device info |
We do not collect your writing, so it is not among the categories above. It never reaches us.
Renderal Studio LLC does not sell personal information under the CCPA/CPRA, and does not share personal information for cross-context behavioral advertising. No opt-out is required because no sale or sharing occurs.
Email hello@roomytype.com, subject line “CCPA Request.” We will respond within 45 days, with up to a 45-day extension for complex requests. California residents may designate an authorized agent with written authorization.
If you access RoomyType from the EEA, United Kingdom, or Switzerland, the following additional protections apply under the GDPR, UK GDPR, and Swiss nFADP.
Renderal Studio LLC, operating RoomyType, is the data controller for personal data collected through the Service. Contact: hello@roomytype.com. Mailing address: P.O. Box 1413, Simi Valley, CA 93062.
RoomyType is operated from the United States. If you access the Service from outside the United States, your personal data (limited to your email, Account, and payment status — never your writing) will be transferred to, stored, and processed in the United States and other countries where our sub-processors operate.
For transfers from the EEA, UK, or Switzerland to the United States, we rely on appropriate safeguards where our sub-processors require them, which may include Standard Contractual Clauses (SCCs), UK IDTAs or the UK Addendum, or the EU-U.S. Data Privacy Framework (DPF) where the applicable sub-processor is actively certified under it.
For users in Brazil, we process personal data consistent with the Lei Geral de Proteção de Dados (LGPD); Brazilian users have rights closely mirroring those in Sections 9 and 11. For users in Mexico, we process personal data consistent with the LFPDPPP. For users in other Latin American jurisdictions, we comply with applicable local data protection law.
The Service is not directed to and is not intended for use by children under the age of 13, and we do not knowingly collect personal information from anyone under 13. In compliance with the Children’s Online Privacy Protection Act (COPPA), if we become aware that we have inadvertently collected personal information from a child under 13, we will delete it from our systems as promptly as possible.
If you are between 13 and 18 years of age (or under the age of majority in your jurisdiction), you may use the Service only with the consent and involvement of a parent or legal guardian, who must make any purchase on your behalf, as described in the Terms of Service. Where local law sets a higher minimum age to use an online service or to consent to data processing, we apply that higher age.
If you believe we may have collected information from a child under 13, contact us immediately at hello@roomytype.com.
We implement commercially reasonable technical and organizational security measures designed to protect your personal data from unauthorized access, loss, misuse, alteration, disclosure, or destruction. Our security measures include:
No security system is impenetrable. We cannot guarantee that unauthorized third parties will never be able to defeat our security measures. In the event of a data breach, see Section 20.
RoomyType is designed to work alongside third-party AI chat interfaces, including Anthropic’s Claude, OpenAI’s ChatGPT, and Google’s Gemini. Once you use RoomyType’s send feature to place your text into one of these services’ input fields, that service’s own privacy policy governs the handling of that text. Renderal Studio LLC is not affiliated with these services, does not receive any confirmation of what you sent, and does not receive or process their responses.
Our website and Extension may also contain links to other third-party websites or services. We are not responsible for the privacy practices, content, or security of those third parties. We encourage you to review their privacy policies directly.
Some browsers include a “Do Not Track” (DNT) feature. We do not currently respond to DNT browser signals, as there is no uniform industry standard for what DNT requires.
We do honor the Global Privacy Control (GPC) signal where technically feasible. In jurisdictions where GPC is legally required to be honored, such as California under the CPRA, we treat a valid GPC signal as an opt-out of any data sharing for cross-context behavioral advertising. We do not conduct cross-context behavioral advertising.
RoomyType does not collect, process, or store biometric identifiers or biometric information as defined under applicable law, including the Illinois Biometric Information Privacy Act (BIPA), the Texas CUBI Act, or the Washington My Health My Data Act. We do not collect or create facial recognition data, voiceprints, fingerprints, or any other biometric identifier.
Voice dictation specifically: when you dictate, your spoken audio is handled by your browser’s built-in speech-recognition service to convert speech to text (see Section 5). RoomyType never receives that audio, does not create or store a voiceprint, and does not perform any biometric processing on your voice. The audio is used by your browser only to produce text, which is then stored locally on your device.
RoomyType is an evolving product. Before implementing any new use of your data that is materially different from what this Policy describes, we will: (a) update this Privacy Policy and notify you; (b) obtain your consent where required by applicable law; and (c) provide you the opportunity to opt out before new processing begins.
Voice dictation, described in Section 5 and Section 6, is a current feature, not a future one; its data flow is fully described there. Potential future features under consideration include saved snippets, a prompt journal or history you can save to your own device, and multiple draft tabs — all designed, consistent with our architecture today, to live on your device rather than on our servers. If any future feature offers optional cloud sync or backup, it would use our existing backend (Supabase), and we will update this Policy before the feature ships.
In the event of a data breach that materially affects your personal data, we will:
If you disagree with a material change, you may cancel your Subscription and delete your Account before the change takes effect.
| Topic | Contact |
|---|---|
| General Privacy Inquiries | hello@roomytype.com |
| Data Deletion Requests | hello@roomytype.com, Subject: “Data Deletion Request” |
| CCPA Requests | hello@roomytype.com, Subject: “CCPA Request” |
| GDPR / International Requests | hello@roomytype.com, Subject: “GDPR Request: [Right]” |
| DMCA / Copyright Notices | hello@renderalstudio.com, Subject: “DMCA Takedown Notice” |
| Legal Entity | Renderal Studio LLC (California) |
| Mailing Address | P.O. Box 1413, Simi Valley, CA 93062 |