← Back to Home

Roost Privacy Policy

Effective Date: September 26, 2026  |  Last Updated: September 26, 2026

1. Introduction

Good Egg LLC, a Virginia limited liability company ("we," "us," "our," or "Company"), respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, share, and protect your information when you use the Roost mobile application and related services (collectively, the "Service").

By using the Service, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree, do not use the Service.

1.1 Data Controller

The data controller for your personal information is:

Good Egg LLC
Virginia, United States
Email: contact@roostsocial.app

A postal address is available on request. EU/EEA and UK Data Protection Representative: We have appointed DataRep (Data Protection Representative Limited, trading as DataRep) as our Data Protection Representative under Article 27 of the GDPR (for the EU/EEA) and under the UK GDPR / Data Protection Act 2018 (for the United Kingdom). You may exercise all rights described in this Policy by contacting us at the email above or by contacting our Representative directly. See §12.3 (EU/EEA) and §13 (United Kingdom) for DataRep's contact details. We will respond within 30 days.

2. Information We Collect

2.1 Account Information

When you create an Account, we collect:

  • Name: First and last name (from your authentication provider or as you enter it).
  • Email address: From your Google or Apple Sign-In account.
  • Username: Chosen by you during onboarding.
  • Profile photo/avatar: Your selected pigeon avatar.
  • Phone number: Collected during onboarding and verified via a one-time code (see §2.2). We use your phone number for account verification, account recovery, and to help prevent abuse. If you turn on "Let people who have my number find me," we also use it so that people who have your number saved in their contacts can find you on Roost (see §2.9). We send you marketing text messages only if you separately opt in (see §3.7).
  • Date of birth: Your birthday, collected during onboarding (adults may give the month and year only). We use it to confirm you meet our minimum age of 13 (see §9), to determine whether a parent or guardian's consent is needed, to keep pen-pal matching within age groups, and to keep sponsored content away from users under 18. We do not display your date of birth to other users.
  • Device age range (optional): On supported devices, you may also choose to share an age range from your device (Apple's Declared Age Range or Google Play Age Signals). These services give us an age range, not your birthday. We use it only to check that it is consistent with the birthday you enter; it never replaces your birthday.

2.2 Authentication Data

The Service supports two authentication methods: Sign in with Apple and Sign in with Google. Whichever you choose, we receive:

  • A stable account identifier from Apple or Google used to recognize you on return visits.
  • Basic profile information, typically your name and email address. If you use Sign in with Apple, you may choose Apple's "Hide My Email" option, in which case we receive a private relay address rather than your real email.
  • Authentication tokens for secure session management.

We do not receive your Apple or Google password, and we do not post to, read from, or otherwise act on your Apple or Google account outside of the sign-in exchange.

Note: We do not receive or store any biometric data (such as Face ID or fingerprint data). Biometric authentication, if used to unlock your device or confirm sign-in, is handled entirely by your device.

Phone-number verification: To confirm ownership of the phone number you provide during onboarding, we send a one-time numeric code. In most regions this code is delivered by SMS using Firebase Phone Authentication (a Google service; see §4.2). In certain regions we instead deliver the code through the Telegram app using the Telegram Gateway (see §4.2); where we do, your phone number is shared with Telegram for the sole purpose of delivering that code, and the code is generated and sent by Telegram; Roost never receives it. The code is used solely to verify the number; we do not use it for marketing or other communications. Standard message and data rates from your carrier may apply to SMS delivery.

2.3 Consent and Compliance Data

  • Age record: your date of birth or device age range, the age group it places you in, and how it was determined (see §2.1 and §9).
  • For users aged 13 to 15, a record of parent or guardian consent (see §9).
  • Terms of Use acceptance timestamp and version.
  • Privacy Policy acceptance timestamp and version.
  • Location data consent record.
  • Your analytics and crash-reporting choice (see §4.3).
  • Your optional email and text-message marketing choices, the wording you were shown, and when you gave or withdrew consent (see §3.7).
  • Records of privacy and legal requests you make, such as opt-outs, data-export requests, and deletion requests, so that we can honor them (see §7).

2.4 Location Information

With your permission, we collect precise GPS location data from your device. This is essential to the core functionality of the Service.

Specifically, we collect:

  • GPS coordinates: Real-time latitude and longitude for calculating pigeon flight paths and delivery times.
  • City information: Derived from GPS coordinates using geocoding services (Mapbox and Stadia Maps).
  • Location accuracy metadata: Precision and timing of location readings for quality assurance.
  • Home location (optional): If you use Home mode, the place you choose as your Home.

How location is shared with other users:

  • City on your profile: Your profile shows a city-level label (for example, "Brooklyn, NY"). It follows your device's location, or shows your Home location if you use Home mode. Other users who view your profile can see it. Your precise coordinates are never shown on your profile.
  • Where your pigeons take off and land: Friends can see where the pigeons you send take off and where pigeons sent to you land. How precise that point is depends on your Location Precision setting and your friendship tier. With Precise selected, Close Friends may see your exact location and other friends see a location rounded to an approximate area. With City Level selected, everyone, including Close Friends, sees only your city center.
  • Home mode and Close Friends: If you set a Home location, other users see your Home location instead of your live location. By default, Close Friends continue to see your live location while you are in Home mode; you can turn this off in Settings.
  • Private flights: You can make your flights private so they do not appear in your friends' flight summaries.
  • Flight paths reveal general geographic direction between sender and recipient but otherwise use obfuscated intermediate points.

2.5 Messages and Communications

Messages are stored in plaintext. The Service does not currently offer end-to-end encryption. Data is encrypted at rest (via Firebase/Google Cloud encryption) and encrypted in transit (TLS), but message content is readable by authorized backend systems for the purpose of service delivery and legal compliance.

We store and process:

  • Message content: Text of messages sent through the Service.
  • Media files: Photos and other media shared in messages. When you send a photo, the app accesses your device's camera or photo library only after you grant the standard operating-system permission prompt (iOS or Android) and only for photos you affirmatively select or capture; we do not scan, index, or read your photo library otherwise. Before upload, we strip EXIF metadata (including embedded GPS coordinates, capture timestamps, and camera/device identifiers) from the photo so that recipients and our servers cannot derive your location or device details from the file itself. Photos and drawings you send are automatically checked for known child sexual abuse material (CSAM) and screened by automated moderation for other harmful imagery, as described in §3.2. These checks apply only to images you choose to send through the Service, not to your photo library.
  • Voice notes (audio recordings): Short audio recordings you record and send through the Service. Recording a voice note requires microphone access, which the app requests through the standard operating-system permission prompt (iOS or Android); we access your microphone only while you are actively recording a voice note, and only after you grant that permission. Voice notes are stored and delivered on the same basis as other media (encrypted at rest and in transit; see §4.2 and §6). Unlike photos, we do not strip embedded metadata from audio files. Your device may generate a text transcript of a voice note on your device for display and accessibility; this transcription is performed locally on your device and the audio is not sent to a third-party transcription service. We store and process voice notes as message content for delivery and playback only; we do not analyze them to create a voiceprint or other biometric identifier, and we do not use them to identify or authenticate you (see §10.3).
  • Message metadata: Timestamps, delivery status, read receipts.
  • Conversation data: Participant lists and conversation history.
  • Drawings: Drawings you create and send in the app are stored, delivered, and checked in the same way as photos.
  • Flight data: Real-time tracking data for message delivery via virtual pigeons.
  • Translation: Where the app offers to translate a message, translation happens on your device; the message text is not sent to us or to a translation service for this purpose.

2.6 Social and Interaction Data

  • Friend connections and friendship status (pending, accepted, blocked), including the friendship tier you choose (for example, Close Friends).
  • Your pen-pal profile and letters, if you use pen pals. Pen-pal matching uses your age group (see §9).
  • Blocked user lists.
  • User reports for content or conduct violations.

2.7 App Usage and Analytics

  • Device information: Device type, operating system version, app version.
  • Usage patterns: Features used, session frequency, time spent in app (collected in aggregate).
  • Performance and crash data: Crash reports and limited performance signals (via Firebase Crashlytics and Firebase Analytics; see §4.3).
  • In-app purchase history: Transaction records and Virtual Items owned.
  • Subscription status and entitlement data: For auto-renewing subscriptions ("Roost Supporter") and one-time founding-supporter purchases ("Founders Club"), we process the product identifier, platform (iOS/Android), subscription status (active, in grace period, cancelled, on hold, paused, or expired), renewal and expiry dates, the store-provided original transaction ID (Apple) or purchase token (Google Play), and (for founding supporters) founder status and the date support began. We use this to provide and validate your supporter benefits.
  • Pigeon data: Virtual pigeon collection, stats, and training activities.

2.8 Technical Data

  • Device identifiers: Unique device ID for push notification delivery.
  • Network information: IP address (for security monitoring and fraud prevention).
  • Push notification tokens: For delivering notifications to your device via Apple Push Notification service (APNs) on iOS or Firebase Cloud Messaging (FCM) on Android.

2.9 Contacts and Finding Friends

Checking your contacts is optional. If you choose "Check my contacts" (during sign-up or in Settings), the app reads the names and phone numbers in your address book on your device and turns each one into a scrambled code (a salted, keyed hash) before anything leaves your device. We never receive, store, or display your contacts' names or numbers in readable form, and we cannot turn the codes back into names or numbers.

  • Phone matches: A contact appears as "already on Roost" only if that person verified their phone number on Roost and turned on "Let people who have my number find me." That setting is off by default.
  • Name matches: A contact may appear under "Might be them" when the name in your contacts matches the name on a Roost profile. Only people whose Public profile setting is on can be matched by name. Adding someone still sends an ordinary friend request that they can decline.
  • What we keep: By default, we keep nothing from your address book after the check finishes. If you turn on Keep my contacts synced, we store the scrambled codes (never names or numbers) so we can tell you when a contact joins. Turning that setting off, choosing Delete synced contacts, or deleting your Account removes them.
  • People who are not on Roost: The codes may be derived from information about people who do not use Roost. We use them only to find matches for you, keep them only while "Keep my contacts synced" is on, and cannot identify those people from them.
  • We do not use your contacts for advertising, do not sell or share them, and never message your contacts on your behalf. Invitations are sent from your own phone, only when you choose to send one.

How others can find you. Other users can find you by your exact @username (unless you have blocked them), by name (only while Public profile is on), and by phone number (only if you turned on "Let people who have my number find me"). When someone finds you through their contacts, their friend request tells you so, and you can decline, ignore, or block them as usual.

2.10 Invitations to People Not Yet on Roost

You can send a message to a friend who is not on Roost yet (an "Invite Flight"). When you do, we store your message, the name you enter for your friend, and a keyed hash of their phone number (never the number itself). We use the hashed number only to deliver the invitation to the right person and to prevent abuse. Anyone signed in to Roost who opens the invitation link can see a preview with your first name, username, avatar, the bird carrying the message, and the first 80 characters of your message, so only share the link with the person you are inviting. An invitation that is not claimed within 14 days expires.

3. How We Use Your Information

3.1 Core Service Functionality

  • Location services: Calculate pigeon flight paths, delivery times, and map rendering.
  • Messaging: Deliver and store messages between users via virtual pigeons.
  • Social features: Connect users, manage friendships, enable communication, help you find people you already know (§2.9), and deliver invitations (§2.10).
  • Age-appropriate experience: Apply the minimum age, parental consent, and protections for users under 18 described in §9.
  • Account management: Authenticate users, maintain profiles, process settings changes.

3.2 Safety and Security

  • Fraud prevention: Detect unauthorized access and suspicious activity.
  • Content moderation: We use automated systems, including third-party AI moderation (OpenAI), together with human review to screen message, profile, and pen-pal text, and photos and drawings sent in chats, for safety violations (such as threats, hate speech, self-harm, graphic violence, and sexual content involving minors), to review reported content, and to enforce our community guidelines. Depending on the result, an individual photo or drawing may be blocked, removed, or queued for review, and flagged content may be seen by our human safety reviewers. Only the content itself is sent to our moderation provider; no account identifiers (name, email, user ID, or device ID) are transmitted. Content sent for moderation is used only to screen for policy violations and is not used to train the moderation provider's models.
  • Detection of child sexual abuse material (CSAM): Images sent through the Service are automatically checked against industry databases of known CSAM using Microsoft's PhotoDNA service. PhotoDNA compares a mathematical hash (a "fingerprint") of an image against the hashes of previously identified illegal images; it is not a general-purpose classifier and does not interpret the subject of your photos. Only the image content is sent to Microsoft for this check; no account identifiers are transmitted. If an image is identified as known CSAM, we act on it immediately (see §3.5), preserve the required evidence, and report it to the National Center for Missing & Exploited Children (NCMEC) as required by U.S. law (see §4.4). We may not notify you of such a report.
  • Safety features: Enable blocking, reporting, and user protection.
  • Security monitoring: Protect against technical attacks and unauthorized data access.

3.3 Service Improvement

  • Analytics: Understand usage patterns to improve features (data is aggregated and anonymized where possible).
  • Performance optimization: Identify and fix bugs and performance issues.
  • Feature development: Inform design of new features based on aggregate usage data.

3.4 Legal Compliance

  • Enforce our Terms of Use.
  • Respond to valid legal process (subpoenas, court orders, law enforcement requests).
  • Maintain records as required by applicable law.

3.5 Automated Decision-Making

We do not engage in solely automated decision-making that produces legal effects concerning you or similarly significantly affects you. Automated systems we do use (such as content-safety moderation, spam detection, abuse signals, and rate limiting) are reviewed by humans before they result in account actions such as suspension or removal. Automated image screening can block or remove an individual photo or drawing; that decision affects only that item, not your Account.

Exception for known illegal content. The one exception is the detection of known child sexual abuse material (CSAM). Where an automated check identifies an image as known CSAM (a match against verified hashes of previously identified illegal images; see §3.2), we remove the content and suspend the associated Account immediately, without prior human review, because U.S. law requires us to act on and report such material once it is detected and prohibits us from leaving it accessible. This is the only category of automated decision that can result in an immediate account action without prior human review. If you believe your Account was suspended in error, you may contact us at contact@roostsocial.app.

3.6 Promotional and Marketing Use of Public Profile Information

We may use your public profile information (specifically your username, the names you give your pigeons, your public bio, your pigeon stats and collection (where not hidden in your privacy settings), and your selected pigeon avatar) in marketing and promotional materials for the Service, including social media posts, advertising, press, and our own websites. This use is further described in Section 5.3 of our Terms of Use.

  • Legal basis (EEA/UK): Our legitimate interest in promoting the Service (GDPR Art. 6(1)(f) and its UK GDPR equivalent).
  • Scope limit: We use this information only to promote Roost itself; we do not sell or sublicense it to third parties for their marketing.
  • Attribution: We may use this content with or without attribution, at our discretion.
  • Your right to object: You may opt out at any time, free of charge, by emailing contact@roostsocial.app. On receiving your request we will stop new promotional uses and make commercially reasonable efforts to remove existing materials we control. We cannot guarantee removal of materials already re-shared by third parties beyond our control.
  • Account deletion: Deleting your Account also triggers cessation of promotional use; we will remove materials still under our control.
  • Excluded from promotional use: Your private messages, photo or media uploads, friends list, precise location, and your real name as supplied by your authentication provider are not used for promotional purposes.

3.7 Marketing Emails and Text Messages

Marketing messages are optional, and we send them only if you opt in. You can choose separately whether to get occasional news about Roost by email and by text message (SMS), during sign-up, during pen-pal setup, or in Settings > Notifications > Hearing from Roost. We keep a record of your choice, the wording you agreed to, and when you gave or withdrew consent.

You can change your mind at any time in the same place, by replying STOP to any of our marketing text messages, or by using the unsubscribe link in any marketing email. Message and data rates may apply to text messages. Messages about your Account, such as verification codes and safety notices, are not marketing and are not affected by this choice.

4. How We Share Your Information

4.1 With Other Users

The following information may be visible to other Service users:

  • Your username and profile information.
  • Your city-level location label and where your pigeons take off and land, as described in §2.4.
  • Whether other users can find you by name or phone number, as described in §2.9.
  • Previews of invitations you send to people not yet on Roost, as described in §2.10.
  • Messages you send to them.
  • Your pigeon collection and stats (if not hidden in privacy settings).
  • Your online status (when enabled).
  • Supporter recognition (optional). If you subscribe to Roost Supporter or become a founding supporter, you can choose whether to display a supporter or founder badge on your public profile (on by default; you can turn it off) and whether to appear on the public Founders wall (off by default; you opt in). When enabled, that badge or Founders-wall placement is visible to other users. These are display choices only and do not change what data we collect.

4.2 Sub-Processors

We share information with the following sub-processors who help us operate the Service. Each is bound by contractual obligations to protect your information and to use it only for the purposes we instruct.

Sub-Processor Data Shared Purpose
Google Firebase / Google Cloud Authentication data, user profiles, text messages, analytics, crash reports and performance signals, push notification tokens, phone numbers (for verification) Database, authentication, analytics (Firebase Analytics), crash reporting (Firebase Crashlytics), exception/performance monitoring, serving Roost's static asset catalog (bird art, game assets), push notification routing (FCM → APNs for iOS; FCM direct delivery for Android), backend compute, phone-number verification via Firebase Phone Authentication (one-time SMS codes)
Telegram (Telegram Gateway) Phone number (in E.164 format) of users who verify their number in specific regions where we deliver the verification code through Telegram instead of SMS. No account identifiers (no name, email, or user ID). Delivery of one-time phone-verification codes via the Telegram app in selected regions, using the Telegram Gateway API. Telegram generates and delivers the code to the user's Telegram account; Roost does not receive the code itself.
Mapbox GPS coordinates, device type Map rendering, geocoding, location search
Stadia Maps City names and coordinates. No account identifiers. Geocoding (alternate provider to Mapbox).
Apple Authentication tokens, purchase transactions, push tokens Sign-In with Apple, App Store, in-app purchases and subscriptions (App Store; server validation and App Store Server Notifications for subscription lifecycle), push notification delivery to your device (APNs)
Google Authentication tokens, basic profile (name, email) Sign in with Google (OAuth) for Account creation and login
Google Play / Google Play Billing Purchase transaction records, Play Billing order IDs, app installation identifiers Android in-app purchases and subscriptions (Play Billing; server validation, refund handling, Real-Time Developer Notifications for subscription lifecycle, and Play Integrity checks)
OpenAI Message, profile, and pen-pal letter text; photos and drawings sent in chats; community-art images. No account identifiers (no name, email, user ID, or device ID). Automated content-safety moderation.
KLIPY GIF search text and a pseudonymous identifier (a one-way hash derived from your account, which does not contain your name, email, or user ID). For adults who see sponsored GIFs: device details (operating system and version, device make and model, language, app version, and screen size) and your device's web-view user-agent. See §4.7. GIF search and sharing; delivery of sponsored GIFs.
Microsoft (PhotoDNA) Image content of photos sent through the Service. No account identifiers. Automated detection of known child sexual abuse material (CSAM) by hash matching.

We will keep this list up to date and will notify users of material changes to our sub-processors through the Service or by email.

4.3 Analytics and Diagnostic SDKs

We use Firebase Analytics (from Google) to understand how the app is used and Firebase Crashlytics to diagnose crashes and performance problems. If you are in the EU/EEA or the United Kingdom, analytics and crash reporting stay off unless you turn them on. Elsewhere they are on by default. Wherever you are, you can turn them on or off at any time in Settings > Analytics & Crash Reporting. While they are on, app events and crash reports include device information (such as device model, operating system, and app version) and are linked to your Roost account identifier so we can investigate problems; they do not include the content of your messages. We do not use analytics or crash data for advertising.

4.4 Legal Requirements

We may disclose your information when required or permitted by law:

  • In response to valid legal process (subpoenas, court orders, search warrants).
  • To comply with regulatory requirements.
  • To protect the rights, property, or safety of Good Egg LLC, our users, or the public.
  • To prevent fraud, abuse, or illegal activity.
  • In connection with legal proceedings involving us.
  • To report apparent child sexual abuse material (CSAM), together with the associated content and account information, to the National Center for Missing & Exploited Children (NCMEC) via its CyberTipline and, through NCMEC, to law enforcement, as required by 18 U.S.C. § 2258A.

When we detect or are made aware of apparent CSAM, U.S. law requires us to report it to NCMEC and to preserve the reported content and associated account records for a defined period. We are generally prohibited from notifying the account holder that such a report has been made.

4.5 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the successor entity, subject to the same privacy protections described in this Policy. We will notify you of any such transfer.

4.6 We Do Not Sell or Share Your Personal Information for Advertising

We do not sell, rent, or trade your personal information to third parties for their marketing purposes, and we do not give advertisers your name, email address, messages, contacts, or location. The only advertising in the Service is sponsored GIFs, described in §4.7. Some of that activity may be considered "targeted advertising" or "sharing" under certain U.S. state privacy laws; §4.7 explains how to opt out.

4.7 GIFs and Sponsored GIFs

GIF search in Roost is provided by KLIPY. When you search for or share a GIF, KLIPY receives your search text and a pseudonymous identifier: a one-way hash derived from your account. The identifier does not contain your name, email, or user ID, but it is not anonymous, because it stays the same each time you use GIF search.

Sponsored GIFs. Adults who do not have Roost Supporter or Founders Club benefits may see sponsored GIFs in GIF search results. To choose and show them, KLIPY also receives device details (operating system and version, device make and model, language, app version, and screen size) and your device's web-view user-agent. Sponsored GIFs are displayed in an in-app web view that may connect directly from your device to KLIPY and its advertising partners, which receive your IP address when the content loads. Sponsored GIFs are never shown to users under 18 or to users whose age we do not know.

Your choices. Subscribing to Roost Supporter removes sponsored GIFs. You can also opt out of sponsored GIFs by emailing contact@roostsocial.app with the subject "Opt out of sponsored GIFs." KLIPY's handling of this information is also governed by KLIPY's own privacy policy.

5. Data Retention

5.1 Retention Periods

Data Type Retention Period
Account profile data Until Account deletion
Messages and media Until deleted by sender or recipient, or Account deletion
Precise GPS coordinates Until Account deletion (required for flight path calculation depending on your privacy level)
City-level location Until Account deletion (required for flight path calculation depending on your privacy level)
Analytics data Aggregated and anonymized; retained indefinitely for business analysis
Exception / performance signals (Firebase Analytics) Retained per Firebase Analytics defaults (up to 14 months)
Purchase transaction records 7 years (legal/tax compliance)
Subscription & founder records (status, entitlement, store transaction ID / purchase token) Retained as needed for tax, accounting, fraud prevention, refund handling, and legal compliance (consistent with purchase transaction records above); otherwise deleted or anonymized when no longer required.
Consent records 7 years after Account deletion (legal compliance)
Age and parental-consent records Until Account deletion
Synced contact codes (§2.9) Only while "Keep my contacts synced" is on; deleted when you turn it off, choose "Delete synced contacts," or delete your Account
Invitations to people not yet on Roost (§2.10) Expire if not claimed within 14 days; the invitation record stays in the sender's message history until the sender deletes their Account
Download My Data files Up to 30 days after the file is ready, then deleted
Sign-up and phone-verification diagnostics Up to 30 days
Crash reports (Firebase Crashlytics) Up to 90 days
Content-moderation records (flagged content, moderation decisions, and safety-review notes) Kept only as long as necessary for the safety, enforcement, and legal-defense purposes for which they were created; may be retained after Account deletion where necessary to protect users, enforce our Terms of Use, or comply with law, and are deleted or de-identified when no longer needed for those purposes.
CSAM reports and preserved evidence Where we detect and report apparent child sexual abuse material, we preserve the reported image and the associated account records in a restricted-access location for at least the period required by 18 U.S.C. § 2258A (currently one year), and may retain them longer where required for legal process. This retention survives Account deletion.

5.2 Account Deletion

When you delete your Account:

  • Most personal data is deleted within 30 days.
  • Data may persist in encrypted backups for up to 90 days.
  • Certain records are retained as required by law (see table above).
  • Messages already delivered to other users remain in their conversations until they choose to delete them.

To request deletion, see Delete Your Account for in-app and email instructions.

6. Data Security

6.1 Security Measures

We implement industry-standard security measures to protect your data:

  • Encryption at rest: All data stored in Firebase/Google Cloud is encrypted at rest using AES-256.
  • Encryption in transit: All data transmitted between your device and our servers uses TLS 1.2+.
  • Access controls: Database access is restricted to authorized systems and personnel via Firebase Security Rules and IAM policies.
  • Authentication security: OAuth 2.0 via Apple and Google; no passwords stored.
  • Monitoring: Automated security monitoring for anomalous access patterns.

6.2 Security Limitations

No system is completely secure. Despite our efforts, we cannot guarantee absolute protection against all security threats, unauthorized access, or data breaches. You use the Service at your own risk regarding data security.

6.3 Data Breach Response

In the event of a data breach affecting your personal information:

  • We will investigate and contain the breach promptly.
  • We will notify affected users without unreasonable delay, including information about what data was involved and recommended protective steps.
  • We will notify relevant supervisory authorities within the timeframes required by applicable law, including (where applicable) within 72 hours under GDPR/UK GDPR, and within the notification windows required by US state attorneys general, the UK ICO, Brazil's ANPD, Australia's OAIC, Canada's OPC, and other competent authorities.
  • We will document the breach and our response for compliance purposes.

7. Your Privacy Rights and Choices

7.1 In-App Privacy Controls

  • Location sharing: Choose Precise or City Level location precision, set a Home location, choose whether Close Friends see your live location while you are in Home mode, and make your flights private (see §2.4).
  • Contacts and discoverability: Check or sync your contacts, delete synced contacts, turn Public profile on or off, and choose whether people who have your number can find you (see §2.9).
  • Analytics and crash reporting: Turn them on or off in Settings > Analytics & Crash Reporting (see §4.3).
  • Marketing: Opt in to or out of marketing emails and text messages in Settings > Notifications > Hearing from Roost (see §3.7).
  • Sponsored GIFs: Opt out as described in §4.7.
  • Profile visibility: Manage what information is visible to other users.
  • Blocking: Block other users from contacting or finding you.
  • Notifications: Control notification types and frequency via device settings and in-app preferences.
  • Promotional opt-out: Opt out of marketing or social-media use of your public profile information by emailing contact@roostsocial.app (see §3.6).

7.2 Location Data

You can control location access through your device's system settings. Note: Disabling location services will prevent core Service functionality (flight path calculation and message delivery simulation).

If you previously granted location consent, you may withdraw it at any time by disabling location permissions in your device settings. Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal.

7.3 Account Deletion

You may delete your Account at any time through Settings > Delete Account. If you can no longer use the app, email privacy@roostsocial.app from the email address associated with your Account and ask us to delete it (see roostsocial.app/delete-account). To protect your Account, we will confirm that the request comes from that address and may ask for more information before deleting anything. See Section 5.2 for details on what happens to your data.

7.4 Universal Data Subject Rights

Regardless of where you live, you may request to exercise the following rights regarding your personal data, and we will honor them to the extent required by applicable law:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate or incomplete information.
  • Deletion: Request deletion of your personal information.
  • Portability: Request a copy of your data in a portable, machine-readable format.
  • Restriction: Request that we limit how we process your data.
  • Objection: Object to certain types of data processing (e.g., processing based on legitimate interests).
  • Withdraw consent: Where processing is based on consent, withdraw your consent at any time.
  • Non-discrimination: We will not discriminate against you for exercising your privacy rights.

Download your data: You can request a copy of your data in the app under Settings > Download My Data. When your copy is ready, it is available to download for 30 days.

To exercise any of these rights, contact us at contact@roostsocial.app. We will respond within 30 days (or sooner if required by applicable law). We may need to verify your identity before fulfilling certain requests.

8. International Data Transfers

The Service uses Google Firebase, which operates on Google Cloud infrastructure. Your data is stored and processed in the United States and may be processed in other countries where Google maintains data centers.

For users in the European Economic Area, United Kingdom, Brazil, or other jurisdictions with data transfer restrictions:

  • We rely on Standard Contractual Clauses (SCCs), the UK Addendum, and other approved transfer mechanisms to provide an adequate level of protection for international data transfers.
  • Google Cloud maintains compliance with applicable data protection frameworks.

By using the Service, you acknowledge and consent to the transfer of your data to the United States and other jurisdictions as described above.

9. Children's Privacy

The Service is not directed to children under 13. You must be at least 13 years old (or the higher minimum age required by your local law) to use it, and we do not knowingly collect personal information from children under 13.

  • Age check at sign-up: Everyone gives their birthday during sign-up (see §2.1). If it shows you are under 13, no Account is created.
  • Parent or guardian consent: Users aged 13 to 15 need a parent or guardian's consent to finish signing up. Users aged 16 and 17 can consent for themselves.
  • Protections for users under 18: Pen-pal matching stays within age groups (13 to 15, 16 to 17, and adults), so minors are never matched with adults as pen pals. Sponsored GIFs are never shown to users under 18 or to users whose age we do not know. The Artist Program and art challenges are open to adults only.
  • We comply with the Children's Online Privacy Protection Act (COPPA) in the United States, GDPR Article 8 in the European Union (which sets digital consent age at 16, or as low as 13 depending on the member state), the Age Appropriate Design Code in the United Kingdom, Brazil's LGPD child-protection provisions, and similar laws in other jurisdictions.
  • If we discover that a child under 13 (or under the applicable minimum age) has created an Account, we will promptly terminate the Account and delete all associated data.
  • We use automated hash-matching (Microsoft PhotoDNA) to detect known child sexual abuse material (CSAM) in images sent through the Service. When such material is detected, we remove it, disable the responsible Account, preserve the evidence, and report it to NCMEC as required by law (see §3.2, §3.5, and §4.4).
  • Parents or guardians who believe their child has provided information to us should contact us immediately at contact@roostsocial.app.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

10.1 Your California Rights

  • Right to Know: Request what personal information we collect, use, and disclose.
  • Right to Delete: Request deletion of your personal information.
  • Right to Correct: Request correction of inaccurate personal information.
  • Right to Opt-Out of Sale/Sharing: We do not sell your personal information for money. Sponsored GIFs (§4.7) may be considered "sharing" for cross-context behavioral advertising; you can opt out as described in §4.7.
  • Right to Limit Use of Sensitive Personal Information: See Section 10.2.
  • Right to Non-Discrimination: You will not be discriminated against for exercising your privacy rights.

We will respond to verifiable California requests within 30 days (the statute allows 45).

10.2 Sensitive Personal Information

Under the CPRA, precise geolocation data is classified as "sensitive personal information." We collect precise geolocation solely to provide core Service functionality (pigeon flight path calculation and message delivery). We do not use precise geolocation for profiling, advertising, or any purpose unrelated to Service operation. You may limit the use of your precise geolocation by adjusting your device's location settings or your in-app privacy controls.

10.3 Categories of Personal Information Collected

Category (CCPA) Examples Collected?
IdentifiersName, email, username, phone number, date of birth, pseudonymous identifiersYes
ContactsScrambled codes of names and phone numbers from your address book, only if you choose to check contacts (§2.9)Yes (optional)
Commercial informationPurchase history, Virtual ItemsYes
Internet/network activityApp usage, session dataYes
Geolocation dataGPS coordinates, cityYes
Sensory dataPhotos, voice notes (audio recordings), and other media in messagesYes
InferencesUsage preferencesYes (limited)
Biometric dataFingerprints, face data, voiceprintsNo (voice notes are stored as audio content only and are not analyzed to create a voiceprint)
Financial informationPayment card numbersNo (handled by Apple App Store on iOS or Google Play Billing on Android)

11. Other U.S. State Privacy Rights

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, or another U.S. state with a comprehensive consumer privacy law, you may have rights similar to those described in Section 7.4, including rights to access, correct, delete, and obtain a portable copy of your personal data, and (where applicable) to opt out of targeted advertising, sale of personal data, and certain profiling. We do not sell personal data or engage in profiling with legal or similarly significant effects. Sponsored GIFs (§4.7) may be considered targeted advertising in some states; you can opt out as described in §4.7. To exercise your rights, email contact@roostsocial.app.

12. European Data Protection (EU/EEA GDPR)

If you are located in the European Economic Area (EEA), the following provisions apply.

12.1 Legal Basis for Processing

Processing Activity Legal Basis
Account creation, messaging, core featuresContract performance (Art. 6(1)(b))
Precise GPS location collectionConsent (Art. 6(1)(a)), explicit and withdrawable
Push notifications (service-related)Contract performance / consent
Analytics and crash reportingConsent (Art. 6(1)(a)); off until you turn it on, and you can turn it off at any time in Settings
Age checks and parental consentLegal obligation (Art. 6(1)(c)) and Art. 8 GDPR
Contact matching and finding friends (§2.9)Your choice to check contacts; legitimate interest (Art. 6(1)(f)) in helping you find people you already know
Invitations to people not yet on Roost (§2.10)Contract performance for the sender (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) for the invitee's hashed phone number
Marketing emails and text messagesConsent (Art. 6(1)(a)), which you can withdraw at any time
Sponsored GIFs (§4.7)Legitimate interest (Art. 6(1)(f)) in funding the free Service
Security monitoring and fraud preventionLegitimate interest (Art. 6(1)(f))
Content-safety moderation (automated screening + human review)Legitimate interest (Art. 6(1)(f)); and legal obligation (Art. 6(1)(c)) for detecting and reporting child sexual abuse material
Legal compliance and record-keepingLegal obligation (Art. 6(1)(c))

12.2 Your GDPR Rights

You have the rights listed in Section 7.4, plus the right to lodge a complaint with your national supervisory authority. A directory of EU supervisory authorities is available from the European Data Protection Board.

12.3 EU/EEA Representative

We have appointed DataRep (Data Protection Representative Limited, trading as DataRep) as our Representative in the EU/EEA under Article 27 of the GDPR. DataRep maintains a contact location in each of the 27 EU member states as well as Norway, Iceland, and Liechtenstein. You may contact our Representative in relation to the processing of your personal data:

Please address all correspondence to "DataRep" (not to Roost or Good Egg), or it may not reach the Representative. You may also contact us directly at contact@roostsocial.app, and you retain the right to lodge a complaint with your national supervisory authority (see §12.2). We will respond within 30 days.

13. United Kingdom Data Protection (UK GDPR)

If you are located in the United Kingdom, your rights under the UK GDPR and the Data Protection Act 2018 substantially mirror those described in Section 12, including rights of access, rectification, erasure, restriction, portability, and objection. The supervisory authority is the Information Commissioner's Office (ICO), to whom you have the right to lodge a complaint. We have appointed DataRep (Data Protection Representative Limited, trading as DataRep) as our UK Representative under Article 27 of the UK GDPR. You may contact our UK Representative by email at datarequest@datarep.com (please quote "Roost; Good Egg" in the subject line), online at www.datarep.com/data-request, or by mail at DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom, addressing all correspondence to "DataRep." You may also contact us directly at contact@roostsocial.app.

14. Canada (PIPEDA and Quebec Law 25)

If you are located in Canada, you have rights under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and, if you are a Quebec resident, under Quebec's Law 25 (Act respecting the protection of personal information in the private sector). These include rights of access, correction, deletion, and withdrawal of consent. Complaints can be directed to the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec.

15. Australia (Privacy Act and APPs)

If you are located in Australia, you have rights under the Privacy Act 1988 and the Australian Privacy Principles (APPs), including rights of access and correction. Complaints can be directed to the Office of the Australian Information Commissioner (OAIC).

16. Brazil (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including rights to confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and withdrawal of consent. Complaints can be directed to the Autoridade Nacional de Proteção de Dados (ANPD). To exercise your rights, contact contact@roostsocial.app.

17. Other Jurisdictions

If you are located in a jurisdiction with its own comprehensive data protection law, including Japan (APPI), South Korea (PIPA), India (DPDPA), South Africa (POPIA), Switzerland (FADP), Singapore (PDPA), or elsewhere, you may have rights substantially similar to those described above. You may exercise any such rights by contacting us at contact@roostsocial.app, and we will respond within the timeframe required by applicable law (and in any event within 30 days).

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through:

  • In-app notifications.
  • Email to the address associated with your Account.

Continued use of the Service after notification constitutes acceptance of the updated Privacy Policy. If you do not agree, you must stop using the Service and delete your Account. Previous versions of this Policy are available upon request.

19. Contact Information

For privacy-related questions, data access requests, or to exercise your privacy rights, contact us at:

Email: contact@roostsocial.app

Response time: We respond to privacy requests within 30 days (or sooner if required by applicable law).

20. Version History

Previous versions of this Privacy Policy are published here for reference. The version effective today is the one above; archived versions are clearly labeled as superseded.

21. Artist Program and Future Art Challenges

If you apply to the Roost Artist Program or later choose to enter a Roost Community Art Challenge, we collect additional information beyond what is described elsewhere in this Policy. Artist registration is an application only; it is not a Challenge entry or an artwork submission.

Information collected at artist registration. We collect your legal name, chosen public credit name, contact email, verified phone number, country, portfolio or social link, and whether you opt in to showing your Roost @username with future artwork. We use this information to review your application, verify eligibility, contact you about the Artist Program, and administer rights matters if you later submit art. We also record an audit trail of your acceptance of the Artist Agreement, including its version, URL, content hash and scope, the acceptance timestamp, your IP address, user-agent string, and client/platform.

Portfolio review and public information. Providing a portfolio or social link permits Roost to access and review material available at that link only for the artist-application process. Registration alone does not give Roost a license to portfolio artwork and does not make the link public. If Roost later displays an approved or winning Submission, the public attribution may include your chosen public credit name and your Roost @username only if you opted in. We do not publicly display your legal name, contact details, country, portfolio link, IP address, or user-agent merely because you register.

Information collected at a future submission. Before accepting artwork for a future Challenge, Roost will present separate Official Rules and round-specific details. If you choose to submit after accepting them, we collect the artwork images, the bird and Challenge they are for, your per-piece originality confirmation, and a snapshot of the rights and rules facts in effect at submission. During moderation we may compute a SHA-256 fingerprint of each image for provenance and duplicate detection.

Retention and account deletion. If you delete your Account before any of your artwork is approved or selected, your artist registration and submissions are deleted, subject to records we must retain for legal or security purposes. If your art is approved or selected for use, we delete contact data that is no longer needed but may retain a minimal license-defense record: your legal name, the accepted agreement and submission facts, image fingerprints, and Challenge, skin, and submission identifiers. That retained record does not include your email, phone number, IP address, user-agent, or portfolio submission history.

Legal basis. We process registration information to review and administer your Artist Program application and to perform the Artist Agreement (for EEA/UK users: contract performance, GDPR Art. 6(1)(b), and legitimate interests, Art. 6(1)(f)). If you later submit artwork, we process the submission to administer the Challenge and to establish, exercise, and defend the rights you grant. We retain assent and license records only for as long as needed for those purposes or as required by law. The Artist Agreement is published at /legal/artist-agreement. Registration is not acceptance of any future Challenge Official Rules.

22. Sponsored Events and Giveaways

Some in-app events are sponsored by other companies and may include a prize drawing. Entering a giveaway is always optional: you can send a bird to the event and receive its rewards without entering. When a giveaway collects additional information, such as your legal name for prize delivery, we publish a separate privacy notice for it that explains what we collect, what the sponsor receives, and when we delete it.

BY USING THE ROOST SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND CONSENT TO THE COLLECTION AND USE OF YOUR INFORMATION AS DESCRIBED HEREIN.