← Back to Home

Roost — Privacy Policy

Effective Date: July 22, 2026  |  Last Updated: August 25, 2026

1. Introduction

Good Egg LLC, a Virginia limited liability company ("we," "us," "our," or "Company"), respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, share, and protect your information when you use the Roost mobile application and related services (collectively, the "Service").

By using the Service, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree, do not use the Service.

1.1 Data Controller

The data controller for your personal information is:

Good Egg LLC
Virginia, United States
Email: contact@roostsocial.app

A postal address is available on request. EU/EEA and UK Data Protection Representative: We have appointed DataRep (Data Protection Representative Limited, trading as DataRep) as our Data Protection Representative under Article 27 of the GDPR (for the EU/EEA) and under the UK GDPR / Data Protection Act 2018 (for the United Kingdom). You may exercise all rights described in this Policy by contacting us at the email above or by contacting our Representative directly — see §12.3 (EU/EEA) and §13 (United Kingdom) for DataRep's contact details. We will respond within 30 days.

2. Information We Collect

2.1 Account Information

When you create an Account, we collect:

  • Name: First and last name (from your authentication provider or as you enter it).
  • Email address: From your Google or Apple Sign-In account.
  • Username: Chosen by you during onboarding.
  • Profile photo/avatar: Your selected pigeon avatar.
  • Phone number: Collected during onboarding and verified via a one-time SMS code (see §2.2). We use your phone number for account verification, account recovery, and to help prevent abuse; we do not send marketing SMS.
  • Date of birth: Full date of birth (month, day, year) collected during onboarding. We use it to confirm you meet the 18+ minimum age requirement (see §9) and as a secondary record alongside your 18+ attestation. We do not display your date of birth to other users.

2.2 Authentication Data

The Service supports two authentication methods: Sign in with Apple and Sign in with Google. Whichever you choose, we receive:

  • A stable account identifier from Apple or Google used to recognize you on return visits.
  • Basic profile information — typically your name and email address. If you use Sign in with Apple, you may choose Apple's "Hide My Email" option, in which case we receive a private relay address rather than your real email.
  • Authentication tokens for secure session management.

We do not receive your Apple or Google password, and we do not post to, read from, or otherwise act on your Apple or Google account outside of the sign-in exchange.

Note: We do not receive or store any biometric data (such as Face ID or fingerprint data). Biometric authentication, if used to unlock your device or confirm sign-in, is handled entirely by your device.

Phone-number verification: To confirm ownership of the phone number you provide during onboarding, we send a one-time numeric code. In most regions this code is delivered by SMS using Firebase Phone Authentication (a Google service — see §4.2). In certain regions we instead deliver the code through the Telegram app using the Telegram Gateway (see §4.2); where we do, your phone number is shared with Telegram for the sole purpose of delivering that code, and the code is generated and sent by Telegram — Roost never receives it. The code is used solely to verify the number; we do not use it for marketing or other communications. Standard message and data rates from your carrier may apply to SMS delivery.

2.3 Consent and Compliance Data

  • Age verification confirmation (18+ attestation).
  • Date of birth (as a secondary age-verification record — see §2.1 and §9).
  • Terms of Use acceptance timestamp and version.
  • Privacy Policy acceptance timestamp and version.
  • Location data consent record.

2.4 Location Information

We collect precise GPS location data from your device. This is essential to the core functionality of the Service.

Specifically, we collect:

  • GPS coordinates: Real-time latitude and longitude for calculating pigeon flight paths and delivery times.
  • City information: Derived from GPS coordinates using geocoding services (Mapbox and Stadia Maps).
  • Location accuracy metadata: Precision and timing of location readings for quality assurance.

How location is shared with other users:

  • Your location is not continuously visible to friends. Friends only see location information through pigeon interactions — specifically, the endpoint of a flight on the map when you send or receive a pigeon.
  • The precision of that endpoint matches the setting you choose in Settings > Location Privacy: precise, city-level (approximate), or hidden.
  • Flight paths reveal general geographic direction between sender and recipient but otherwise use obfuscated intermediate points.

2.5 Messages and Communications

Messages are stored in plaintext. The Service does not currently offer end-to-end encryption. Data is encrypted at rest (via Firebase/Google Cloud encryption) and encrypted in transit (TLS), but message content is readable by authorized backend systems for the purpose of service delivery and legal compliance.

We store and process:

  • Message content: Text of messages sent through the Service.
  • Media files: Photos and other media shared in messages. When you send a photo, the app accesses your device's camera or photo library only after you grant the standard operating-system permission prompt (iOS or Android) and only for photos you affirmatively select or capture — we do not scan, index, or read your photo library otherwise. Before upload, we strip EXIF metadata (including embedded GPS coordinates, capture timestamps, and camera/device identifiers) from the photo so that recipients and our servers cannot derive your location or device details from the file itself. Images you send are automatically checked for known child sexual abuse material (CSAM) as described in §3.2; this check applies only to the images you affirmatively send through the Service, not to your photo library.
  • Voice notes (audio recordings): Short audio recordings you record and send through the Service. Recording a voice note requires microphone access, which the app requests through the standard operating-system permission prompt (iOS or Android); we access your microphone only while you are actively recording a voice note, and only after you grant that permission. Voice notes are stored and delivered on the same basis as other media (encrypted at rest and in transit — see §4.2 and §6). Unlike photos, we do not strip embedded metadata from audio files. Your device may generate a text transcript of a voice note on your device for display and accessibility; this transcription is performed locally on your device and the audio is not sent to a third-party transcription service. We store and process voice notes as message content for delivery and playback only — we do not analyze them to create a voiceprint or other biometric identifier, and we do not use them to identify or authenticate you (see §10.3).
  • Message metadata: Timestamps, delivery status, read receipts.
  • Conversation data: Participant lists and conversation history.
  • Flight data: Real-time tracking data for message delivery via virtual pigeons.

2.6 Social and Interaction Data

  • Friend connections and friendship status (pending, accepted, blocked).
  • Blocked user lists.
  • User reports for content or conduct violations.

2.7 App Usage and Analytics

  • Device information: Device type, operating system version, app version.
  • Usage patterns: Features used, session frequency, time spent in app (collected in aggregate).
  • Performance data: Limited app exception and performance signals (via Firebase Analytics).
  • In-app purchase history: Transaction records and Virtual Items owned.
  • Subscription status and entitlement data: For auto-renewing subscriptions ("Roost Supporter") and one-time founding-supporter purchases ("Founders Club"), we process the product identifier, platform (iOS/Android), subscription status (active, in grace period, cancelled, on hold, paused, or expired), renewal and expiry dates, the store-provided original transaction ID (Apple) or purchase token (Google Play), and — for founding supporters — founder status and the date support began. We use this to provide and validate your supporter benefits.
  • Pigeon data: Virtual pigeon collection, stats, and training activities.

2.8 Technical Data

  • Device identifiers: Unique device ID for push notification delivery.
  • Network information: IP address (for security monitoring and fraud prevention).
  • Push notification tokens: For delivering notifications to your device via Apple Push Notification service (APNs) on iOS or Firebase Cloud Messaging (FCM) on Android.

3. How We Use Your Information

3.1 Core Service Functionality

  • Location services: Calculate pigeon flight paths, delivery times, and map rendering.
  • Messaging: Deliver and store messages between users via virtual pigeons.
  • Social features: Connect users, manage friendships, enable communication.
  • Account management: Authenticate users, maintain profiles, process settings changes.

3.2 Safety and Security

  • Fraud prevention: Detect unauthorized access and suspicious activity.
  • Content moderation: We use automated systems — including third-party AI moderation (OpenAI) — together with human review to screen message, profile, and pen-pal content for safety violations (such as threats, hate speech, self-harm, and sexual content involving minors), to review reported content, and to enforce our community guidelines. Only the content itself is sent to our moderation provider; no account identifiers (name, email, user ID, or device ID) are transmitted. Content sent for moderation is used only to screen for policy violations and is not used to train the moderation provider's models.
  • Detection of child sexual abuse material (CSAM): Images sent through the Service are automatically checked against industry databases of known CSAM using Microsoft's PhotoDNA service. PhotoDNA compares a mathematical hash (a "fingerprint") of an image against the hashes of previously identified illegal images; it is not a general-purpose classifier and does not interpret the subject of your photos. Only the image content is sent to Microsoft for this check — no account identifiers are transmitted. If an image is identified as known CSAM, we act on it immediately (see §3.5), preserve the required evidence, and report it to the National Center for Missing & Exploited Children (NCMEC) as required by U.S. law (see §4.4). We may not notify you of such a report.
  • Safety features: Enable blocking, reporting, and user protection.
  • Security monitoring: Protect against technical attacks and unauthorized data access.

3.3 Service Improvement

  • Analytics: Understand usage patterns to improve features (data is aggregated and anonymized where possible).
  • Performance optimization: Identify and fix bugs and performance issues.
  • Feature development: Inform design of new features based on aggregate usage data.

3.4 Legal Compliance

  • Enforce our Terms of Use.
  • Respond to valid legal process (subpoenas, court orders, law enforcement requests).
  • Maintain records as required by applicable law.

3.5 Automated Decision-Making

We do not engage in solely automated decision-making that produces legal effects concerning you or similarly significantly affects you. Automated systems we do use (such as content-safety moderation, spam detection, abuse signals, and rate limiting) are reviewed by humans before they result in account actions such as suspension or removal.

Exception for known illegal content. The one exception is the detection of known child sexual abuse material (CSAM). Where an automated check identifies an image as known CSAM — a match against verified hashes of previously identified illegal images (see §3.2) — we remove the content and suspend the associated Account immediately, without prior human review, because U.S. law requires us to act on and report such material once it is detected and prohibits us from leaving it accessible. This is the only category of automated decision that can result in an immediate account action without prior human review. If you believe your Account was suspended in error, you may contact us at contact@roostsocial.app.

3.6 Promotional and Marketing Use of Public Profile Information

We may use your public profile information — specifically your username, the names you give your pigeons, your public bio, your pigeon stats and collection (where not hidden in your privacy settings), and your selected pigeon avatar — in marketing and promotional materials for the Service, including social media posts, advertising, press, and our own websites. This use is further described in Section 5.3 of our Terms of Use.

  • Legal basis (EEA/UK): Our legitimate interest in promoting the Service (GDPR Art. 6(1)(f) and its UK GDPR equivalent).
  • Scope limit: We use this information only to promote Roost itself; we do not sell or sublicense it to third parties for their marketing.
  • Attribution: We may use this content with or without attribution, at our discretion.
  • Your right to object: You may opt out at any time, free of charge, by emailing contact@roostsocial.app. On receiving your request we will stop new promotional uses and make commercially reasonable efforts to remove existing materials we control. We cannot guarantee removal of materials already re-shared by third parties beyond our control.
  • Account deletion: Deleting your Account also triggers cessation of promotional use; we will remove materials still under our control.
  • Excluded from promotional use: Your private messages, photo or media uploads, friends list, precise location, and your real name as supplied by your authentication provider are not used for promotional purposes.

4. How We Share Your Information

4.1 With Other Users

The following information may be visible to other Service users:

  • Your username and profile information.
  • Your location as revealed through pigeon flight endpoints, at the precision level you choose.
  • Messages you send to them.
  • Your pigeon collection and stats (if not hidden in privacy settings).
  • Your online status (when enabled).
  • Supporter recognition (optional). If you subscribe to Roost Supporter or become a founding supporter, you can choose whether to display a supporter or founder badge on your public profile (on by default; you can turn it off) and whether to appear on the public Founders wall (off by default; you opt in). When enabled, that badge or Founders-wall placement is visible to other users. These are display choices only and do not change what data we collect.

4.2 Sub-Processors

We share information with the following sub-processors who help us operate the Service. Each is bound by contractual obligations to protect your information and to use it only for the purposes we instruct.

Sub-Processor Data Shared Purpose
Google Firebase / Google Cloud Authentication data, user profiles, text messages, analytics, exception/performance signals, push notification tokens, phone numbers (for verification) Database, authentication, analytics, exception/performance monitoring, serving Roost's static asset catalog (bird art, game assets), push notification routing (FCM → APNs for iOS; FCM direct delivery for Android), backend compute, phone-number verification via Firebase Phone Authentication (one-time SMS codes)
Telegram (Telegram Gateway) Phone number (in E.164 format) of users who verify their number in specific regions where we deliver the verification code through Telegram instead of SMS. No account identifiers (no name, email, or user ID). Delivery of one-time phone-verification codes via the Telegram app in selected regions, using the Telegram Gateway API. Telegram generates and delivers the code to the user's Telegram account; Roost does not receive the code itself.
Mapbox GPS coordinates, device type Map rendering, geocoding, location search
Stadia Maps City names and coordinates. No account identifiers. Geocoding (alternate provider to Mapbox).
Apple Authentication tokens, purchase transactions, push tokens Sign-In with Apple, App Store, in-app purchases and subscriptions (App Store; server validation and App Store Server Notifications for subscription lifecycle), push notification delivery to your device (APNs)
Google Authentication tokens, basic profile (name, email) Sign in with Google (OAuth) for Account creation and login
Google Play / Google Play Billing Purchase transaction records, Play Billing order IDs, app installation identifiers Android in-app purchases and subscriptions (Play Billing; server validation, refund handling, Real-Time Developer Notifications for subscription lifecycle, and Play Integrity checks)
OpenAI Message, profile, and pen-pal letter text; community-art images. No account identifiers (no name, email, user ID, or device ID). Automated content-safety moderation.
Microsoft (PhotoDNA) Image content of photos sent through the Service. No account identifiers. Automated detection of known child sexual abuse material (CSAM) by hash matching.

We will keep this list up to date and will notify users of material changes to our sub-processors through the Service or by email.

4.3 Analytics and Diagnostic SDKs

We use Firebase Analytics to understand product usage and to collect limited exception and performance signals. The SDK collects device identifiers and app events linked to a pseudonymous installation identifier rather than your real name. You can limit this collection through iOS App Tracking Transparency (ATT) on iOS, or by deleting/resetting your advertising ID and using the Ads Privacy controls on Android, in addition to your device's privacy settings.

4.4 Legal Requirements

We may disclose your information when required or permitted by law:

  • In response to valid legal process (subpoenas, court orders, search warrants).
  • To comply with regulatory requirements.
  • To protect the rights, property, or safety of Good Egg LLC, our users, or the public.
  • To prevent fraud, abuse, or illegal activity.
  • In connection with legal proceedings involving us.
  • To report apparent child sexual abuse material (CSAM), together with the associated content and account information, to the National Center for Missing & Exploited Children (NCMEC) via its CyberTipline and, through NCMEC, to law enforcement, as required by 18 U.S.C. § 2258A.

When we detect or are made aware of apparent CSAM, U.S. law requires us to report it to NCMEC and to preserve the reported content and associated account records for a defined period. We are generally prohibited from notifying the account holder that such a report has been made.

4.5 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the successor entity, subject to the same privacy protections described in this Policy. We will notify you of any such transfer.

4.6 We Do Not Sell or Share Your Personal Information for Advertising

We do not sell, rent, or trade your personal information to third parties for their marketing purposes, and we do not "share" personal information for cross-context behavioral advertising as defined by the CCPA/CPRA.

5. Data Retention

5.1 Retention Periods

Data Type Retention Period
Account profile data Until Account deletion
Messages and media Until deleted by sender or recipient, or Account deletion
Precise GPS coordinates Until Account deletion (required for flight path calculation depending on your privacy level)
City-level location Until Account deletion (required for flight path calculation depending on your privacy level)
Analytics data Aggregated and anonymized; retained indefinitely for business analysis
Exception / performance signals (Firebase Analytics) Retained per Firebase Analytics defaults (up to 14 months)
Purchase transaction records 7 years (legal/tax compliance)
Subscription & founder records (status, entitlement, store transaction ID / purchase token) Retained as needed for tax, accounting, fraud prevention, refund handling, and legal compliance (consistent with purchase transaction records above); otherwise deleted or anonymized when no longer required.
Consent records 7 years after Account deletion (legal compliance)
Content-moderation records (flagged content, moderation decisions, and safety-review notes) Kept only as long as necessary for the safety, enforcement, and legal-defense purposes for which they were created; may be retained after Account deletion where necessary to protect users, enforce our Terms of Use, or comply with law, and are deleted or de-identified when no longer needed for those purposes.
CSAM reports and preserved evidence Where we detect and report apparent child sexual abuse material, we preserve the reported image and the associated account records in a restricted-access location for at least the period required by 18 U.S.C. § 2258A (currently one year), and may retain them longer where required for legal process. This retention survives Account deletion.

5.2 Account Deletion

When you delete your Account:

  • Most personal data is deleted within 30 days.
  • Data may persist in encrypted backups for up to 90 days.
  • Certain records are retained as required by law (see table above).
  • Messages already delivered to other users remain in their conversations until they choose to delete them.

To request deletion, see Delete Your Account for in-app and email instructions.

6. Data Security

6.1 Security Measures

We implement industry-standard security measures to protect your data:

  • Encryption at rest: All data stored in Firebase/Google Cloud is encrypted at rest using AES-256.
  • Encryption in transit: All data transmitted between your device and our servers uses TLS 1.2+.
  • Access controls: Database access is restricted to authorized systems and personnel via Firebase Security Rules and IAM policies.
  • Authentication security: OAuth 2.0 via Apple and Google; no passwords stored.
  • Monitoring: Automated security monitoring for anomalous access patterns.

6.2 Security Limitations

No system is completely secure. Despite our efforts, we cannot guarantee absolute protection against all security threats, unauthorized access, or data breaches. You use the Service at your own risk regarding data security.

6.3 Data Breach Response

In the event of a data breach affecting your personal information:

  • We will investigate and contain the breach promptly.
  • We will notify affected users without unreasonable delay, including information about what data was involved and recommended protective steps.
  • We will notify relevant supervisory authorities within the timeframes required by applicable law, including (where applicable) within 72 hours under GDPR/UK GDPR, and within the notification windows required by US state attorneys general, the UK ICO, Brazil's ANPD, Australia's OAIC, Canada's OPC, and other competent authorities.
  • We will document the breach and our response for compliance purposes.

7. Your Privacy Rights and Choices

7.1 In-App Privacy Controls

  • Location sharing: Control who sees your location and at what precision (Settings > Location Privacy).
  • Profile visibility: Manage what information is visible to other users.
  • Blocking: Block other users from contacting or finding you.
  • Notifications: Control notification types and frequency via device settings and in-app preferences.
  • Promotional opt-out: Opt out of marketing or social-media use of your public profile information by emailing contact@roostsocial.app (see §3.6).

7.2 Location Data

You can control location access through your device's system settings. Note: Disabling location services will prevent core Service functionality (flight path calculation and message delivery simulation).

If you previously granted location consent, you may withdraw it at any time by disabling location permissions in your device settings. Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal.

7.3 Account Deletion

You may delete your Account at any time through Settings > Delete Account. See Section 5.2 for details on what happens to your data.

7.4 Universal Data Subject Rights

Regardless of where you live, you may request to exercise the following rights regarding your personal data, and we will honor them to the extent required by applicable law:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate or incomplete information.
  • Deletion: Request deletion of your personal information.
  • Portability: Request a copy of your data in a portable, machine-readable format.
  • Restriction: Request that we limit how we process your data.
  • Objection: Object to certain types of data processing (e.g., processing based on legitimate interests).
  • Withdraw consent: Where processing is based on consent, withdraw your consent at any time.
  • Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at contact@roostsocial.app. We will respond within 30 days (or sooner if required by applicable law). We may need to verify your identity before fulfilling certain requests.

8. International Data Transfers

The Service uses Google Firebase, which operates on Google Cloud infrastructure. Your data is stored and processed in the United States and may be processed in other countries where Google maintains data centers.

For users in the European Economic Area, United Kingdom, Brazil, or other jurisdictions with data transfer restrictions:

  • We rely on Standard Contractual Clauses (SCCs), the UK Addendum, and other approved transfer mechanisms to provide an adequate level of protection for international data transfers.
  • Google Cloud maintains compliance with applicable data protection frameworks.

By using the Service, you acknowledge and consent to the transfer of your data to the United States and other jurisdictions as described above.

9. Children's Privacy

The Service is not intended for anyone under 18 years of age (or the higher minimum age required by your local law). We do not knowingly collect personal information from anyone under this age.

  • We require age verification (18+ confirmation) during Account creation, and we also collect your full date of birth at onboarding as a secondary age-verification record (see §2.1 and §2.3). Both records are retained to support enforcement of the 18+ minimum.
  • We comply with the Children's Online Privacy Protection Act (COPPA) in the United States, GDPR Article 8 in the European Union (which sets digital consent age at 16, or as low as 13 depending on the member state), the Age Appropriate Design Code in the United Kingdom, Brazil's LGPD child-protection provisions, and similar laws in other jurisdictions.
  • If we discover that a user under the applicable minimum age has created an Account, we will promptly terminate the Account and delete all associated data.
  • We use automated hash-matching (Microsoft PhotoDNA) to detect known child sexual abuse material (CSAM) in images sent through the Service. When such material is detected, we remove it, disable the responsible Account, preserve the evidence, and report it to NCMEC as required by law (see §3.2, §3.5, and §4.4).
  • Parents or guardians who believe their child has provided information to us should contact us immediately at contact@roostsocial.app.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

10.1 Your California Rights

  • Right to Know: Request what personal information we collect, use, and disclose.
  • Right to Delete: Request deletion of your personal information.
  • Right to Correct: Request correction of inaccurate personal information.
  • Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No opt-out is necessary.
  • Right to Limit Use of Sensitive Personal Information: See Section 10.2.
  • Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights.

We will respond to verifiable California requests within 30 days (the statute allows 45).

10.2 Sensitive Personal Information

Under the CPRA, precise geolocation data is classified as "sensitive personal information." We collect precise geolocation solely to provide core Service functionality (pigeon flight path calculation and message delivery). We do not use precise geolocation for profiling, advertising, or any purpose unrelated to Service operation. You may limit the use of your precise geolocation by adjusting your device's location settings or your in-app privacy controls.

10.3 Categories of Personal Information Collected

Category (CCPA) Examples Collected?
IdentifiersName, email, username, phone number, date of birthYes
Commercial informationPurchase history, Virtual ItemsYes
Internet/network activityApp usage, session dataYes
Geolocation dataGPS coordinates, cityYes
Sensory dataPhotos, voice notes (audio recordings), and other media in messagesYes
InferencesUsage preferencesYes (limited)
Biometric dataFingerprints, face data, voiceprintsNo (voice notes are stored as audio content only and are not analyzed to create a voiceprint)
Financial informationPayment card numbersNo (handled by Apple App Store on iOS or Google Play Billing on Android)

11. Other U.S. State Privacy Rights

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, or another U.S. state with a comprehensive consumer privacy law, you may have rights similar to those described in Section 7.4, including rights to access, correct, delete, and obtain a portable copy of your personal data, and (where applicable) to opt out of targeted advertising, sale of personal data, and certain profiling. We do not engage in sale of personal data, targeted advertising based on personal data, or profiling with legal or similarly significant effects. To exercise your rights, email contact@roostsocial.app.

12. European Data Protection (EU/EEA GDPR)

If you are located in the European Economic Area (EEA), the following provisions apply.

12.1 Legal Basis for Processing

Processing Activity Legal Basis
Account creation, messaging, core featuresContract performance (Art. 6(1)(b))
Precise GPS location collectionConsent (Art. 6(1)(a)), explicit and withdrawable
Push notifications (service-related)Contract performance / consent
Analytics and performance monitoringLegitimate interest (Art. 6(1)(f))
Security monitoring and fraud preventionLegitimate interest (Art. 6(1)(f))
Content-safety moderation (automated screening + human review)Legitimate interest (Art. 6(1)(f)); and legal obligation (Art. 6(1)(c)) for detecting and reporting child sexual abuse material
Legal compliance and record-keepingLegal obligation (Art. 6(1)(c))

12.2 Your GDPR Rights

You have the rights listed in Section 7.4, plus the right to lodge a complaint with your national supervisory authority. A directory of EU supervisory authorities is available from the European Data Protection Board.

12.3 EU/EEA Representative

We have appointed DataRep (Data Protection Representative Limited, trading as DataRep) as our Representative in the EU/EEA under Article 27 of the GDPR. DataRep maintains a contact location in each of the 27 EU member states as well as Norway, Iceland, and Liechtenstein. You may contact our Representative in relation to the processing of your personal data:

Please address all correspondence to "DataRep" (not to Roost or Good Egg), or it may not reach the Representative. You may also contact us directly at contact@roostsocial.app, and you retain the right to lodge a complaint with your national supervisory authority (see §12.2). We will respond within 30 days.

13. United Kingdom Data Protection (UK GDPR)

If you are located in the United Kingdom, your rights under the UK GDPR and the Data Protection Act 2018 substantially mirror those described in Section 12, including rights of access, rectification, erasure, restriction, portability, and objection. The supervisory authority is the Information Commissioner's Office (ICO), to whom you have the right to lodge a complaint. We have appointed DataRep (Data Protection Representative Limited, trading as DataRep) as our UK Representative under Article 27 of the UK GDPR. You may contact our UK Representative by email at datarequest@datarep.com (please quote "Roost; Good Egg" in the subject line), online at www.datarep.com/data-request, or by mail at DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom — addressing all correspondence to "DataRep." You may also contact us directly at contact@roostsocial.app.

14. Canada (PIPEDA and Quebec Law 25)

If you are located in Canada, you have rights under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and, if you are a Quebec resident, under Quebec's Law 25 (Act respecting the protection of personal information in the private sector). These include rights of access, correction, deletion, and withdrawal of consent. Complaints can be directed to the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec.

15. Australia (Privacy Act and APPs)

If you are located in Australia, you have rights under the Privacy Act 1988 and the Australian Privacy Principles (APPs), including rights of access and correction. Complaints can be directed to the Office of the Australian Information Commissioner (OAIC).

16. Brazil (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including rights to confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and withdrawal of consent. Complaints can be directed to the Autoridade Nacional de Proteção de Dados (ANPD). To exercise your rights, contact contact@roostsocial.app.

17. Other Jurisdictions

If you are located in a jurisdiction with its own comprehensive data protection law — including Japan (APPI), South Korea (PIPA), India (DPDPA), South Africa (POPIA), Switzerland (FADP), Singapore (PDPA), or elsewhere — you may have rights substantially similar to those described above. You may exercise any such rights by contacting us at contact@roostsocial.app, and we will respond within the timeframe required by applicable law (and in any event within 30 days).

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through:

  • In-app notifications.
  • Email to the address associated with your Account.

Continued use of the Service after notification constitutes acceptance of the updated Privacy Policy. If you do not agree, you must stop using the Service and delete your Account. Previous versions of this Policy are available upon request.

19. Contact Information

For privacy-related questions, data access requests, or to exercise your privacy rights, contact us at:

Email: contact@roostsocial.app

Response time: We respond to privacy requests within 30 days (or sooner if required by applicable law).

20. Version History

Previous versions of this Privacy Policy are published here for reference. The version effective today is the one above; archived versions are clearly labeled as superseded.

21. Artist Program and Future Art Challenges

If you apply to the Roost Artist Program or later choose to enter a Roost Community Art Challenge, we collect additional information beyond what is described elsewhere in this Policy. Artist registration is an application only; it is not a Challenge entry or an artwork submission.

Information collected at artist registration. We collect your legal name, chosen public credit name, contact email, verified phone number, country, portfolio or social link, and whether you opt in to showing your Roost @username with future artwork. We use this information to review your application, verify eligibility, contact you about the Artist Program, and administer rights matters if you later submit art. We also record an audit trail of your acceptance of the Artist Agreement, including its version, URL, content hash and scope, the acceptance timestamp, your IP address, user-agent string, and client/platform.

Portfolio review and public information. Providing a portfolio or social link permits Roost to access and review material available at that link only for the artist-application process. Registration alone does not give Roost a license to portfolio artwork and does not make the link public. If Roost later displays an approved or winning Submission, the public attribution may include your chosen public credit name and your Roost @username only if you opted in. We do not publicly display your legal name, contact details, country, portfolio link, IP address, or user-agent merely because you register.

Information collected at a future submission. Before accepting artwork for a future Challenge, Roost will present separate Official Rules and round-specific details. If you choose to submit after accepting them, we collect the artwork images, the bird and Challenge they are for, your per-piece originality confirmation, and a snapshot of the rights and rules facts in effect at submission. During moderation we may compute a SHA-256 fingerprint of each image for provenance and duplicate detection.

Retention and account deletion. If you delete your Account before any of your artwork is approved or selected, your artist registration and submissions are deleted, subject to records we must retain for legal or security purposes. If your art is approved or selected for use, we delete contact data that is no longer needed but may retain a minimal license-defense record: your legal name, the accepted agreement and submission facts, image fingerprints, and Challenge, skin, and submission identifiers. That retained record does not include your email, phone number, IP address, user-agent, or portfolio submission history.

Legal basis. We process registration information to review and administer your Artist Program application and to perform the Artist Agreement (for EEA/UK users: contract performance, GDPR Art. 6(1)(b), and legitimate interests, Art. 6(1)(f)). If you later submit artwork, we process the submission to administer the Challenge and to establish, exercise, and defend the rights you grant. We retain assent and license records only for as long as needed for those purposes or as required by law. The Artist Agreement is published at /legal/artist-agreement. Registration is not acceptance of any future Challenge Official Rules.

BY USING THE ROOST SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND CONSENT TO THE COLLECTION AND USE OF YOUR INFORMATION AS DESCRIBED HEREIN.