Privacy Policy

The short version

• Your tasks, notes, calendar, habits, documents, scans, vault, recordings and money records are stored on your phone. They only reach our servers when you use a feature that needs them, like a Roz AI feature or a shared list, and only the parts that feature uses.
• Our servers process a pseudonymous account, your credits and purchases, content you choose to send to an AI feature (processed and not stored; only the result is kept, for 24 hours), shared lists you create or join, your email address or Google details if you create an account, the key that encrypts your Google Drive backups if you use account-key backup, your phone's notification token, and crash reports if you switch them on.
• The free version shows ads from Google AdMob. Ad requests never include your tasks, notes, documents or money data. Roz Plus removes all ads.
• File conversion in Roz 1.3.0 runs on your phone, without uploading files to our server or a conversion service. Originals stay unchanged and each result is saved as a new file on the phone. Separate Roz AI features send content only when you choose to use them.
• We don't sell your data.

Data that stays on your phone

Roz works offline. Everything you create in the app is saved in the app's private storage on your device. Calendar events are read from your phone's calendars and stay there, unless you use a Roz AI feature that plans around them (see below).

Drive backups are encrypted on your phone before they leave it. You can use a key kept encrypted in your Roz account, so signing in lets you restore on a new phone, or protect backups with your own passphrase and recovery code, without a Roz account. In passphrase mode, neither your passphrase nor your recovery code is sent to Roz, and our server holds no key that opens those backups. The encrypted backups go directly to your own Google Drive. You can also save a backup file wherever you choose, protected with a password. Android may also back up your tasks, notes and settings to your Google account, depending on your phone's settings and Google's policies.

Some on-device features (the document scanner and text recognition) use Google Play services and are covered by Google's privacy policy.

If you link a habit to Health Connect and grant the relevant permission, Roz reads steps, exercise, sleep or mindfulness data on your phone to update that habit's check-ins. It refreshes up to the last seven days and saves the resulting amounts or completed check-ins in your local habit records. You choose which habits use this and can revoke the permissions in Android. The steps, exercise, sleep and mindfulness data Roz reads from Health Connect are never sent to our servers or to Roz AI. If you request a Roz AI weekly wellbeing review, habit completion statistics and available summaries of focus, mood, screen time and days you wrote in your journal are sent through our server to the cloud AI provider; habits linked to Health Connect are left out. Journal text is not included in this review, and habit names are included only if you choose them. The Roz AI processing terms below apply.

When you choose Product facts for a barcode, your phone sends that barcode directly to Open Food Facts and, if needed, Open Products Facts to retrieve product information. The request identifies Roz as the app; those services also receive the network information needed to answer it. No Roz account is required, and the request does not pass through our server.

When you search for free stock photos for a slide deck, your phone sends the search words you type and photo requests directly to Openverse. Openverse also receives the network information needed to answer, such as your IP address. This search does not send slide text or your Roz account and uses no Roz AI credits. The photo you select and its source and licence details are saved on your phone; attribution is included in exported files. Opening a source or licence link connects to that linked website.

Place reminders use precise location and, where Android requires it, background location to notify you when you enter or leave a place you chose. Roz keeps the saved place with the task and registers its coordinates and radius with Google Play services' geofencing service. This reminder feature does not send your location to Roz's servers.

When you save a web link as a note, your phone can fetch the page and its preview image directly from their websites to keep an article copy in the note. Those websites receive the normal network request; the page is not fetched through Roz's servers.

Recordings are saved on your phone. On supported devices, on-device transcription processes speech on the phone. Roz AI transcription sends the recording, in parts when needed, to the cloud AI service; AI summaries send the transcript. This happens when you request those actions or turn on the option to transcribe and summarise new recordings automatically. You can turn that option off in Settings.

If you pair a Wear OS watch with Roz, the phone and watch exchange the information needed for the watch's features through Google Play services' Wear OS Data Layer. This includes permitted tasks and calendar events for Today, habits and check-ins, focus-timer state, and loyalty cards or tickets with their codes. The watch keeps the latest copy so its app, tiles and complications can work when the phone is out of reach, and sends your watch actions back to the phone. Settings → Watch controls what is shown; hidden or locked spaces are excluded from the published content. Note contents and identity documents are not sent to the watch.

When you install Roz from a Roz invite or referral link, the app reads Google Play's install referrer once, on your phone, and uses nothing from it except the invite or referral code in that link.

If you turn on the Focus shield, Roz uses Android's Usage access to see which app is in front, only with the screen on and only while a focus session, a blocking schedule or a daily limit you set needs it, and Display over other apps to show its block screen over the apps you chose. For a daily limit it adds up how long that app was open today, from midnight, and blocks it at the limit until the next day. For Reports, it also reads once a day how long the apps you chose in the shield were open and how often you picked them up (filling in up to the previous 7 days from Android's own record when it starts), and keeps those daily totals for 400 days; Settings → Reports and alerts → Screen time turns this off. Only the apps you chose are looked at, never what's inside them. With Hide their notifications while they're blocked on, Roz removes new notifications from those apps while they're blocked (never calls, alarms or ongoing ones) and keeps only which app posted and how many, for one summary when the block ends, never their title or text. Those daily totals are part of your encrypted Roz backups (Google Drive or a backup file), like the rest of your data and the shield's settings; the other records (today's minutes, the hidden notifications' counts and a count of blocked attempts per app kept for 30 days) stay on your phone only. None of it is sent to our servers or to Roz AI, except the average minutes you may choose to share for a plan (see below).

If you turn on Money's auto-capture, Roz uses Android's notification access to read new notifications from the banking, wallet and SMS apps you choose (from an SMS app, only messages that look like they come from a bank), finds transactions in them and keeps each one on your phone, with the notification's text, for you to add or ignore. The Focus shield's option to hide notifications uses the same access. Roz doesn't read the content of notifications from other apps.

Data that reaches our servers, and why

• Account: each install gets an anonymous account, identified by a random install ID (not a hardware ID). Welcome credits are granted when you first create a verified account. We store only a one-way keyed hash of the install ID, plus the app version and language, and on which days the app checked in with our server, so we can count active users and see whether people come back; that record is deleted with your account.
• An account with email (optional): your email address, so you can sign in on any phone. Sign-in codes, and the codes that confirm deleting your account, are emailed from our domain's mail server (with Resend as a backup); we store a code only as a hash, it works for 10 minutes and is deleted within a day.
• Or with Google (optional): your Google account ID, verified email address and name. The same verified email reaches the same account either way, and your credits follow you across devices.
• Credits and purchases: your balance and its history, Google Play purchase tokens and order IDs, and subscription status, to verify purchases and add credits. Google Play handles payment; we never see your card.
• Roz AI features (only when you use one): the content the feature needs (text, an image, PDF pages, audio, a task list or your day's events) is sent to our server and on to the cloud AI service we use to produce the result. We never store what you send; we keep only a one-way SHA-256 hash of the request, to recognise a retry. We keep the result (for example a transcript, recognised text, a summary, a reply or a generated slide deck) for 24 hours, so a retried request gets it back without being charged twice, and delete it at the next daily clean-up after that. We also keep usage records (feature, credits charged, timing and token counts) for billing and abuse prevention.
• Plan my day creates and edits its initial plan on your phone. When you choose Adjust with Roz AI, your instructions, the plan being adjusted and the relevant tasks, timed calendar events, habits and study count are sent to Roz AI. Calendar titles and times, and location text when looked up, can also be sent when you use an AI assistant action that needs them. Local planning and local assistant actions do not send that information to Roz AI.
• Make a plan with Roz AI, in the Focus shield (only when you use it): your goal, the names and package names of the apps you pick for it, your workdays, the first day of your week and the app's language, and, only if you tick Share my usage from the last 7 days, each picked app's average minutes a day over those 7 days.
• The assistant handles supported requests on your phone. When you enable and use Roz AI, your request and the information its tools look up are sent to the AI service through our server. Besides tasks, events and notes, that can include the names of contacts with birthdays; Vault document types, titles, owners and expiry dates; your habits' names and whether they're done, and your routines (their names, number of steps and whether today's is done); your bills, transactions, budgets, savings goals and debts (with the names of the people involved); the affirmations you add or ask to see; how many study cards are due; the moods you log, and how many days you wrote in your journal with your average mood (never anything you wrote in it); and the name you gave when you started using the app. Vault numbers, notes and files, and locked notes, are never sent.
• Reflect with Roz AI is separate: only when you choose it, the selected journal entry's text and mood, with the requested language, are sent to Roz AI for a reflection. It does not send your other journal entries.
• Shared lists (only if you share or join one): the list's name, colour and icon; its tasks, assignments, sections, repeats and deadlines; task comments and their authors; members' display names; and who changed what and when. These are stored on our servers to sync with list members, until the list is deleted. Deleting a comment clears its text; a deletion marker remains so other members' devices can remove it too.
• Referrals: your referral code and which accounts redeemed it.
• Backup key (only with account-key Google Drive backup): we store the random backup key encrypted on our servers so you can restore after signing in. Passphrase-mode backup does not send us its key, passphrase or recovery code.
• Notifications: your phone's push token from Firebase Cloud Messaging, with the app's language and version and a one-way hash of your install ID, so we can send you news and messages about your account (such as credits or Roz Plus from support). A token is deleted when you sign out or delete your account, and dropped after 270 days if the app isn't opened.
• Crash reports (off by default, sent only if you switch them on): app version, Android version, device model and the technical crash details. They carry no account ID or session, and are kept for 90 days.
• Technical data: IP addresses are processed briefly for security and rate limiting (we keep only a keyed hash, deleted at the next daily clean-up after its hour ends), and server logs that never include your content.
• Exchange rates: the app downloads public currency rates from our server without your account or any personal data.

Ads in the free version

• Roz shows light ads to free users through Google AdMob. To show and measure ads, the Google Mobile Ads SDK may collect your device's advertising ID, approximate location (from your IP address), app interactions and diagnostics, under Google's policies.
• Where the law requires it (for example in the EEA, the UK, Switzerland and some US states) we ask for your consent with Google's consent tool (UMP), and you can change your choice at any time in Settings → Privacy → Ad privacy choices. You can also reset or delete your advertising ID in Android settings.
• Ad requests never include your content: no keywords from your tasks, notes, documents or money.
• Rewarded ads are optional. When you watch one to earn a credit, Google AdMob confirms it to our server with a signed message containing your pseudonymous Roz account ID and a transaction ID; we use it only to add the credit.
• Roz Plus removes all ads.

How AI processing works

Roz AI features, including cloud transcription when chosen, send the content needed for the action through our server to a third-party cloud AI provider. Under the provider's unpaid-service terms, submitted content and responses may be used to improve its products and models and may be reviewed by people. Those terms prohibit submitting personal, sensitive or confidential information. The provider's published abuse-monitoring policy says it retains prompts, context and responses for 55 days for security, policy enforcement and required legal disclosures. Authorised provider staff may review flagged content, and these security logs may be used for policy-enforcement models. Other retention and use to improve the provider's products depend on the service terms and project settings that apply.

When the app is in Arabic and your form of address is known (your choice, or a guess made on your phone from your first name), AI requests also say whether to address you in the masculine or the feminine. This is part of the AI request and is subject to the provider processing described above.

The cost of every AI action is shown before you use it. Content is sent when you choose the action or enable an automatic AI-processing option, such as transcription of new recordings.

Service providers

• Vercel: hosting.
• Elestio: database hosting.
• A third-party cloud AI provider: processes the content needed for your chosen or enabled Roz AI actions, as described above.
• Google: sign-in, Google Play payments, Google AdMob ads for free users, Firebase Cloud Messaging for notifications, Google Drive backup, geofencing, and the Wear OS Data Layer.
• Openverse: direct free stock-photo searches and image requests when you choose them in the slide editor.
• Open Food Facts and Open Products Facts: direct barcode lookups when you request product information.
• Our domain's mail server (SMTP), with Resend as a backup: delivers sign-in codes, account deletion codes and other account emails.

Where data is stored

Roz's API runs on Vercel in the Washington, D.C., United States region, and our database service is hosted through Elestio. The AI service may process data in the United States or other countries. Data you send to these services may therefore be processed outside your country.

How long we keep data

• Account data: until you delete your account.
• Account backup keys: until you delete your Roz account. Backups protected by that account key cannot then be recovered through your account. Backups protected by your own passphrase remain independent of your Roz account.
• Purchase and credit records: kept for accounting and legal obligations, and separated from your identity when you delete your account.
• AI usage records: separated from your identity when you delete your account.
• Roz AI results, with a request hash for retries: 24 hours, then deleted at the next daily clean-up. AI request content is not stored by Roz. Files converted on your phone are not stored on our servers.
• Shared lists: until the owner deletes them or deletes their account.
• Notification tokens: until you sign out or delete your account, or 270 days after the app was last opened.
• Crash reports: 90 days. Rate-limit records: deleted at the next daily clean-up after their hour ends. Email sign-in and deletion codes: a hash, valid 10 minutes, deleted at the next daily clean-up. Deletion requests sent through the website's former request form: 90 days.
• Rewarded-ad records (transaction ID and time): kept for accounting, and separated from your identity when you delete your account.
• One-way hashes of your email or Google account ID and of your install ID are kept after deletion only to prevent repeated welcome credits, sign-up and referral rewards.

Your choices and rights

• Delete your account at any time, right away: in the app (Settings → Account → Delete account), with a code we email you if your account has an email address, or on our account deletion page if you no longer have the app.
• Creating an account, crash reports, AI features and rewarded ads are all optional. Manage ad consent in Settings → Privacy, and turn notifications off in Android's settings.
• Depending on where you live (for example under the EU/UK GDPR, or the UAE or Saudi personal data protection laws), you may have the right to access, correct, delete or port your data, to object to processing, and to complain to a regulator. For requests: Email privacy@withroz.com.

Children

Roz isn't directed to children under 13 (or the minimum age in your country), and we don't knowingly collect their data. If you believe a child has sent us data, contact us and we'll delete it.

Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Device IDs and session tokens are stored only as hashes, and we keep the data we collect to a minimum.

Changes and contact

We'll post any changes on this page and update the date above. Privacy questions: privacy@withroz.com. Anything else: hello@withroz.com.