Privacy policy
Roomy is built so your files stay on your Mac. This page explains the little that does leave it, who handles it for us, and how long it’s kept.
Effective ⚠ OWNER: effective date · Last updated October 2026
The short version
- Roomy scans your disk on your Mac. File names, folder paths and file contents never leave it.
- To turn on Pro, Roomy sends your license key and a hashed ID for your Mac, plus the app and macOS versions and your Mac model.
- Crash reports and anonymous usage stats are opt-in and off by default. Neither contains paths or file names.
- When you buy, we keep your email address so we can send and look up your license.
- We don’t sell or share data for advertising, and the website sets no cookies.
Who we are
Roomy is made and sold by ⚠ OWNER: seller legal name, ⚠ OWNER: seller postal address (“we”, “us”). We are the controller of the personal data described here. You can reach us at hello@roomy.app.
What the app sends, and when
| When | What is sent | Why |
|---|---|---|
| You turn on Pro (or a beta key), then about every 14 days (daily for beta keys) | License key, a hashed machine ID, app version, macOS version, Mac model, and whether you opted in to stats | To check the license is valid, keep it to 2 Macs, and switch it off after a refund |
| You turn off Pro on a Mac | Your license token and the hashed machine ID | To free that Mac’s slot |
| Roomy checks for updates and downloads its cleaning rules | App version and the ordinary details of any web request (such as your IP address) | To offer new versions and keep the list of things Roomy recognises current |
| Only if you opt in: crash reports | Apple’s MetricKit crash and hang reports: stack traces, app version, macOS version, hashed machine ID. Any text that looks like a path on your Mac is replaced with “<redacted>” before sending | To find and fix crashes |
| Only if you opt in: usage stats | That the app launched; that a scan finished (number of files, total size, how long it took); how many bytes were cleaned per rule, such as “npm cache”; app version; hashed machine ID | To learn which rules help people most |
| Only when you press Send in Send Feedback | Your message, app version, macOS version, Mac model, license status, and the size of each category Roomy found. Your hashed machine ID | To answer you and fix what you report |
The hashed machine ID is a one-way SHA-256 hash of your Mac’s hardware identifier combined with a value unique to Roomy. We can’t turn it back into the hardware identifier, and it isn’t the same ID other apps see.
You can switch crash reports and usage stats on or off at any time in Roomy’s Settings › Privacy.
What the app never sends
- File names, folder names or paths
- File contents
- The list of what is on your disk
- Anything from Mail, Messages, Photos or your Keychain
Roomy needs Full Disk Access to see all your folders. It uses that access only to read sizes and names on your Mac, to explain them to you there.
This website
- No cookies and no advertising or tracking scripts.
- Cloudflare Web Analytics counts page views without cookies and without building a profile of you.
- No third-party requests: fonts and every other file are served from this site.
- The site is hosted on Cloudflare, which processes your IP address to deliver pages and stop abuse.
When you buy Pro
Stripe handles checkout. Stripe collects your payment details, email address and billing country (for sales tax) under its own privacy policy. We never see or store your full card number.
From Stripe we keep: your email address, the Stripe customer and payment IDs, what you bought and when, and the license we issued. Your license key is stored only as a one-way hash. We send the key to your email address through Resend.
If you email us, we keep the conversation so we can help you.
Who processes data for us
| Company | What they do for Roomy | Data involved |
|---|---|---|
| Stripe | Payments, sales tax, receipts, refunds | Email, payment details, billing country, purchase |
| Supabase | Database and server functions for licenses, crash reports, stats and feedback | Email, hashed license key, hashed machine ID, the app data in the table above |
| Resend | Sending license key emails | Email address and the email we send |
| Cloudflare | Website hosting, cookieless analytics, app downloads and updates, forwarding support email | IP address, request details, support emails |
Each processor may only use the data to provide its service to us.
How long we keep it
- Purchase and license records: for as long as your license exists, and after that for as long as tax and accounting law requires. ⚠ OWNER: confirm the period for your country, often 6 to 10 years
- Machine activations: while the license is active. A Mac you deactivate is deleted after ⚠ OWNER: e.g. 12 months.
- Crash reports: ⚠ OWNER: e.g. 90 days.
- Usage stats: individual events for ⚠ OWNER: e.g. 90 days, then only daily totals with no machine ID.
- Feedback and support emails: ⚠ OWNER: e.g. 2 years, or sooner if you ask.
Your choices and rights
- Turn crash reports and usage stats off in Settings › Privacy. Nothing more is sent from then on.
- Deactivate a Mac in Settings › License.
- Email hello@roomy.app to see, correct, export or delete the personal data we hold. If we delete your purchase record, we can no longer look up or restore your license.
If you are in the EU, the UK or a place with similar laws, our legal bases are: contract for licenses and purchases, consent for crash reports and usage stats (which you can withdraw at any time), and legitimate interests for preventing license abuse and keeping our services secure. You may complain to your local data protection authority. California residents have similar rights to know and delete; we do not sell or share personal information.
Security
All traffic uses HTTPS. License keys are stored only as hashes. License tokens are signed, so the app can check them without contacting us. Our database refuses direct access, and only our own server functions can read it.
Children, international transfers and changes
Roomy isn’t directed at children under 16, and we don’t knowingly collect their data.
Our processors may handle data in the United States and other countries. Where the law requires it, transfers are covered by safeguards such as the EU Standard Contractual Clauses.
If we change this policy, we’ll update the date at the top. Significant changes will also be noted in the changelog.
Contact
Questions about privacy: hello@roomy.app. Post: ⚠ OWNER: seller legal name, ⚠ OWNER: seller postal address.