Roost Privacy Policy

Effective date: August 12, 2026 · Last updated: August 12, 2026 · Previous version: June 11, 2026

What changed in this version: we added Section 5 covering the morning quest photo feature (how photos are stored, who can see them, how long we keep them, the AI caption and safety screen, and how reporting works), and we added Google and Resend to the sub-processor list.

This Privacy Policy explains how TC Fusion LLC ("TC Fusion," "we," "us," or "our") collects, uses, shares, and protects personal data when you use the Roost mobile application and related services (together, the "Service"). It also describes your rights under the EU and UK General Data Protection Regulation ("GDPR") and other applicable laws.

1. Who we are (data controller)

TC Fusion LLC is the controller responsible for your personal data under the GDPR.

• TC Fusion LLC
• 5678 Davis Ford Rd, Manassas, VA 20112, United States
• Privacy contact: privacy@tcfusion.dev

EU / UK representative. Where required under Article 27 of the EU GDPR and UK GDPR, we will appoint a representative in the EU and the UK and list their contact details here. Until then, EU and UK users may contact us at the email above for any matter relating to their personal data.

2. Scope of this policy

This policy applies to the Roost mobile app and the services it connects to. It does not cover third-party services that have their own privacy policies (such as Apple, Google, or your device's operating system), or the TC Fusion company website, which is covered by a separate website privacy policy.

3. The data we collect

We collect the following categories of personal data, mostly directly from you or generated as you use the Service:

Account & identity

• When you sign in with Apple, Google, or an email magic link, we receive an account identifier and your email address. With Apple or Google sign-in, we may receive your first/given name the first time you sign in, which we use to pre-fill your display name.
• A unique account ID we assign to you, used to associate your data across the Service.

Profile & social

• Display name and, if you choose to set one, a profile photo (avatar).
• Your time zone (used to schedule reminders and your sleep window correctly).
• Roost membership: which roost(s) you belong to, the roost name and invite code, who created it, and "kudos" (supportive gestures) sent and received between roost members.

Sleep & progress data

• Derived gameplay metrics: quality bands, Sleep Points (SP), rank and sub-rank state, your hidden baseline (a single number), streak state, and quest completions.
• Per-night numeric summaries (bedtime, wake time, duration, sleep latency, efficiency %, time awake after sleep onset, REM %, deep %, heart-rate dip %) — only if you opt in to summary sync (see Section 4).
• The source of your sleep data (Apple Health, Health Connect, or manual entry).

Morning quest photos & reactions

• The photo you take for a morning quest, along with which quest it was for, the date, whether you chose to share it and with which roost(s), and the one-sentence comment Owly generates about it. Fully covered in Section 5.
• Reactions (cheer, heart, laugh) that you leave on a roostmate's shared photo, or that they leave on yours.
• If you report a photo or a member, or someone reports you: a record of the report, including who reported whom, the reason, and a copy of what was flagged.

Device & technical

• A push notification token for your device (so we can send reminders and roost notifications), and your platform (iOS or Android).
• Basic technical identifiers necessary to operate the app and its SDKs.

Subscription & billing

• If you purchase Roost Premium, we receive your subscription status (active/expired, product, renewal date) from our payments processor. We never receive or store your full payment card details — payment is handled entirely by the Apple App Store or Google Play.

Consent records

• An append-only record of the privacy consents you give or withdraw (for example, summary sync), including the consent type, version, and timestamp. We keep this to demonstrate compliance.

Analytics, diagnostics & support

• Behavioral analytics events tied to your account ID (for example, which onboarding step you viewed, or that a paywall was shown). These never contain your sleep values, sleep summaries, or insight contents.
• Crash and error diagnostics: when the app encounters an error or crashes, we receive a technical report (such as the error type, a stack trace, and basic device and app-version information) to help us fix it. This is configured to exclude personal identifiers and sleep data — console logs are dropped because they could incidentally contain sleep values, and no session recording or performance tracing is collected.
• If you email us for support, we receive your message and contact details.

4. Your sleep & health data — how it works

Sleep and health information is "special category" data under Article 9 of the GDPR and deserves the strongest protection. Roost is built around a two-layer model:

Layer 1 — Stays on your phone, always

The detailed, sample-level recordings Roost reads from Apple Health (HealthKit) or Android Health Connect — minute-by-minute sleep stages, heart-rate series, and similar raw streams — are read on your device, used for on-device calculations, and never transmitted to our servers. We also never place this data in iCloud. To grant Roost read access to this data, you approve it through your operating system's own health-permission screen, which you can revoke at any time in your device settings.

Layer 2 — Your progress syncs (encrypted, EU servers)

From the raw data, your device computes gameplay results — quality bands, Sleep Points, ranks, streaks, and your hidden baseline. The results (not the underlying samples) are stored on our servers so your progress survives a lost or replaced phone and powers your roost. Because a long-running record of sleep quality can itself reveal information about your health, we treat this entire server-side sleep layer as Article 9 health data and protect it accordingly.

Layer 2 (optional) — Nightly summary backup

Separately and optionally, you can opt in to summary sync. When enabled, about a dozen numeric figures per night (bedtime, wake time, duration, latency, efficiency, time awake, REM/deep percentages, heart-rate dip) are backed up to our servers so your detailed history can be restored on a new device. This is:

• Off by default and requires a separate, affirmative opt-in — it is never bundled with anything else.
• Withdrawable at any time in Settings. When you turn it off, we delete those numeric summaries from our servers.

5. Morning quest photos

Roost's morning quest asks you to take one photo when you wake up: your made bed, the view out the window, the glass of water you drank, whatever the quest is. These photos are user content rather than health data, but they are pictures taken inside people's homes moments after waking, so we treat them as sensitive and have built the feature to be private first.

Camera only

A morning photo can only be taken with the live camera inside the app. There is no option to pick one from your photo library, and Roost does not read your photo library for this feature. (Your photo library is used only if you choose to set a profile picture.) Roost asks for camera permission through your operating system, and you can revoke it at any time in your device settings. Declining simply means you skip the morning photo. The rest of the app works normally, and the quest is always skippable in one tap.

Private by default

Every photo starts out visible to you alone. Sharing is a separate, deliberate choice you make on the screen after you take the photo, and you pick which of your roosts it goes to. There is no public feed, no discovery, no profiles strangers can browse, and no direct messages. The only people who can ever see a morning photo are members of a roost you chose to share it with, which is at most a handful of people you invited.

How photos are stored

• Photos are stored in a private storage area on our servers in the European Union (Frankfurt, Germany), encrypted in transit and at rest. They are never publicly accessible and never indexed by search engines.
• They are displayed only through short-lived signed links issued to you or, for a photo you shared, to your roostmates.
• Photos are never sent to our analytics or crash-reporting providers, and neither are Owly's comments.

Owly's comment and the safety screen (processing by Google)

Right after you take a morning photo, the image and the name of the quest are sent to Google's Gemini API so that Owly can write its one-sentence comment and so the photo can be automatically screened for objectionable content. This happens for every morning photo, including ones you keep entirely private, because the safety screen runs at capture.

• We send the image and the quest name only. We do not send your name, email, account ID, or any sleep or health data with it.
• Under the paid Gemini API terms that apply to our account, Google processes the image to answer that single request and does not use it to train its models.
• If the service is unavailable, Owly falls back to a pre-written comment and nothing is sent.

Owly's comment is flavour, not judgement. It never blocks your progress, and the automated safety result is separate from whether your quest counts.

Who can see a shared photo, and for how long

A photo you share is visible to the members of the roost(s) you selected for 7 days, after which it leaves the feed. Your own photos stay in your private gallery: the last 7 days on the free plan, and all of them with Roost Pro. You can delete any photo yourself at any time, which removes it from our storage and from any roost feed it appeared in.

How long we keep photos

• Free plan: photos are permanently deleted from our servers by an automated daily job 7 days after they were taken.
• Roost Pro: photos are kept in your private gallery until you delete them. If a subscription lapses, we keep them for a further 30 days before the normal 7-day rule applies again, so you don't lose your gallery over a billing hiccup.
• Deleting your account deletes all of your morning photos from our storage.

Reporting, moderation, and blocking

Even though photos only travel between people who invited each other, we moderate the feature:

• Automatic screening. Every photo is screened at upload (see above). A photo flagged as sexual, violent, hateful, or otherwise objectionable cannot be shared and is hidden on our servers.
• One-tap reporting. Any roostmate can report a photo directly from the photo itself. The first report immediately removes it from every roost feed, on our servers, before a person has looked at it. A human then reviews within 24 hours and either confirms the removal or restores it.
• What a report records. The account IDs of the reporter and the reported person, the reason, and a snapshot of what was flagged (the photo's storage location and Owly's comment) so a later edit or deletion cannot erase the evidence. Our moderation address receives an email containing a link to the photo that expires after 72 hours.
• Blocking. You can block any member. A block makes your content and theirs mutually invisible, enforced in our database rather than just hidden in the app.
• Enforcement. We may remove content and suspend or terminate accounts for objectionable content or abusive behaviour, as described in the Terms of Service.

6. How and why we use your data

7. Legal bases for processing (GDPR)

• Performance of a contract (Art. 6(1)(b)) — to provide the app, your account, and the social and subscription features you ask for.
• Consent (Art. 6(1)(a)) and explicit consent for health data (Art. 9(2)(a)) — for processing your sleep/health data, for summary sync, and for push notifications. You may withdraw consent at any time without affecting prior processing.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent fraud and cheating, moderate user-generated content and act on reports, and understand product usage through privacy-protective behavioral analytics. We balance these interests against your rights and you can object (see Section 12).
• Legal obligation (Art. 6(1)(c)) — to keep records required by law, such as tax and transaction records.

8. Sharing & sub-processors

We do not sell your personal data, and we do not use it for third-party advertising. We share data only with service providers ("sub-processors") who process it on our behalf under contract, and only as needed to run the Service:

We may also disclose data if required by law, to enforce our terms, or to protect the rights, safety, and security of our users or the public. If TC Fusion is involved in a merger, acquisition, or asset sale, personal data may be transferred, and we will notify you and honor the commitments in this policy.

9. What other people can see

Roost is social by design, but tightly scoped. Other members of your roost can see your display name, profile photo, current rank and Sleep Points, and time-related context needed for the weekly race. They cannot see your email, your raw or numeric sleep data, your baseline, or your individual night details. Profile photos are stored so they can be displayed in the app; treat your display name and photo as information visible to people you share a roost with.

They can also see any morning quest photo you chose to share with that roost, together with Owly's comment on it, for 7 days. They can react to it (cheer, heart, laugh) and they can report it. A photo you did not share is visible to nobody but you. Once shared, a photo can be viewed by people who may keep their own copy by taking a screenshot, so share what you would be comfortable with those people keeping.

10. International data transfers

Your core account and sleep data is stored in the European Union. Some sub-processors listed above are based in the United States. Where personal data of EU/UK users is transferred outside the EEA or UK, we rely on appropriate safeguards under the GDPR — such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or an adequacy decision where one applies. You can request a copy of the relevant safeguards by contacting us.

11. How long we keep your data

• We keep your account and associated data for as long as your account is active.
• Morning photos: deleted automatically 7 days after capture on the free plan; kept until you delete them with Roost Pro (plus a 30-day grace period if a subscription lapses). See Section 5.
• Moderation records: we keep reports, and the snapshot of what was reported, while your account exists and for as long as we need them to handle repeat abuse and demonstrate that we acted on reports.
• When you delete your account, we permanently erase your personal data from our systems as described in Section 12, except where we must retain limited records to meet legal obligations (e.g., transaction records) or resolve disputes.
• Behavioral analytics events are retained according to our analytics provider's retention settings and then deleted or aggregated.
• If you withdraw summary-sync consent, the numeric summaries are deleted from our servers promptly.
• Raw health data is never stored on our servers, so there is nothing for us to retain — it lives only on your device for as long as your operating system keeps it.

12. Your privacy rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Restrict or object to certain processing;
• Data portability — receive your data in a portable format;
• Withdraw consent at any time, including for health-data processing and summary sync; and
• Lodge a complaint with a supervisory authority (see Section 17).

To exercise any right, email privacy@tcfusion.dev. We respond within the timeframes required by law (generally within one month under the GDPR). We will not charge a fee or discriminate against you for exercising your rights. We may need to verify your identity before acting on a request.

13. Children

Roost is intended for users aged 16 and older. It is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child under 16 has provided us personal data, contact us and we will delete it.

14. How we protect your data

We use industry-standard measures to protect your data, including encryption in transit and at rest, strict database access controls that limit your data to you (and, for the narrow social fields above, your roost), private photo storage reachable only through short-lived signed links, an architecture that keeps raw health data off our servers entirely, and analytics and crash-reporting pipelines designed so sleep values are never sent to third parties. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

15. Automated decision-making

Roost computes ranks, Sleep Points, and quest progress automatically. These power the game and do not produce legal or similarly significant effects about you, and we do not use your data for automated decisions of that kind, nor for profiling for advertising.

Morning photos are screened automatically for objectionable content (Section 5). A flagged photo cannot be shared with a roost, but it still counts for your quest and your points, and it stays in your own gallery. If you think a photo was flagged in error, email us and a person will look at it.

16. Changes to this policy

We may update this policy as the Service evolves. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app. Continued use of the Service after an update means you accept the revised policy.

17. Contact & complaints

Questions, requests, or concerns? Email privacy@tcfusion.dev or write to TC Fusion LLC, 5678 Davis Ford Rd, Manassas, VA 20112, USA.

If you are in the EU or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority. In the EU, you can find yours via the European Data Protection Board; in the UK, the Information Commissioner's Office (ICO). We would, however, appreciate the chance to address your concern first.