Privacy Policy

The short version. The Roomy app scans and cleans your Mac entirely on your Mac. It never sends us file names, file contents, scan results, browsing data, analytics or telemetry. It talks to our server only to activate and check your license, and then sends just your license key, an anonymous device ID, your Mac's name and the app version. On the website we collect what we need to sell and support Roomy (your email, order and license records), and, with your consent where the law requires it, Google Analytics and Google Ads measurement. We don't sell your personal information.

This summary is here to help you find your way. It isn't a substitute for the full policy below.

1. Who we are

TSOFT LLC ("we", "us" or "our"), 9169 W State St #2547, Garden City, ID 83714, USA, makes Roomy and is responsible (the "controller") for the personal information described in this policy. You can reach us about privacy at any time at [email protected].

This policy covers the Roomy app for macOS, our website, the license server the app talks to, your customer account, the emails we send and your conversations with our support team.

2. What the Roomy app sends, and what it doesn't

All scanning and cleaning happens on your Mac. The app contacts our license server only when you activate a license, deactivate a Mac, open the billing portal from the app, and to re-check your license about once a day while you use it. When it does, it sends:

• Your license key.
• A device ID. This is a one-way SHA-256 hash derived from your Mac's hardware UUID. It lets us count your activated Macs. It is not the hardware UUID itself, and the UUID can't be worked out from it.
• Your Mac's name, for example "Jane's MacBook Pro", so you can tell your Macs apart on your account page. This is sent when you activate.
• The app version, so we know which versions are in use and can keep the license server compatible.

The app may also ask our server for the current list of plans and prices. That request contains no personal information.

The app never sends file names, file paths, file contents, scan results, the list of apps you have installed, browsing data, analytics, crash reports or any other telemetry. It contains no advertising or analytics code.

Like any connection over the internet, these requests reveal your IP address to our server. We use it only for security, rate limiting and fraud prevention, as described in section 3.

On your Mac, the app keeps its own data in ~/Library/Application Support/Roomy/: license.json holds your signed license token and activity.json holds the local Activity Log of what you have cleaned. Your preferences, such as exclusions, are stored in ~/Library/Preferences/com.roomymac.Roomy.plist. None of this leaves your Mac. Our guide to uninstalling Roomy explains how to delete it.

If you give the app Full Disk Access, it can read more locations on your Mac to find caches. That access is used only on your Mac and doesn't change what the app sends.

3. Information we collect through the website and your purchase

Account and purchase information

• Your email address and, if you give it at checkout, your name.
• Your Stripe customer ID and records of your orders and subscriptions: plan, price paid, currency, dates, renewal and trial dates, status, refunds and chargebacks.
• Card details are entered directly with Stripe, our payment processor. We never see or store your card number.

License and device information

• Your license key and, for each Mac you activate, its device ID (the hash described above), device name, app version and when it was last seen by our license server.

Sign-in and support

• When you ask for a sign-in or password reset link, we record the request so we can email you a one-time link.
• If you choose a password for your account, we store only a salted, one-way hash of it. We can't see or recover your password.
• If you contact us, we keep your messages and any details you choose to share so we can help you.

Technical and security information

• Our servers log IP addresses, browser type, the pages or endpoints requested and the time of each request. We use this to run the website, limit abuse (rate limiting), prevent fraud and fix problems.

Advertising and analytics information

• If you arrive from an ad, the link may contain Google Ads click identifiers (gclid, gbraid or wbraid) and UTM tags that describe the campaign. We keep them with your visit, and with your order if you buy, so we can tell which ads lead to purchases.
• With your consent where it is required, Google Analytics 4 collects information about how you use the website, such as pages viewed, approximate location derived from your IP address, device and browser type, and how you arrived.
• With your consent where it is required, Google Ads conversion tracking tells Google when a visit from an ad leads to a download, a trial or a purchase. For purchases we send the order value in US dollars and a transaction ID. With Google's "enhanced conversions", we also send a hashed (one-way encoded) version of the email you bought with, which Google uses only to match the purchase to an ad click.

The cookies involved, and how to control them, are listed in our Cookie Policy.

4. How we use information, and our legal bases

Where the EU or UK General Data Protection Regulation (GDPR) or similar laws apply, we must have a legal basis for each use of personal information. These are ours:

Purpose	Information used	Legal basis
Selling you a license, taking payment, issuing and emailing your license key, activating and checking your license, managing your subscription and devices, letting you sign in	Account, purchase, license and device information	Performance of our contract with you
Answering your questions and handling refunds	Account, purchase and support information	Contract; our legitimate interest in helping customers
Keeping the Service secure, rate limiting, preventing fraud, license abuse and chargebacks	IP addresses, logs, license and device information, order records	Legitimate interests (protecting our customers and business)
Understanding how the website is used and improving it (Google Analytics)	Analytics cookies and usage data	Consent in the EEA, UK and Switzerland; legitimate interests elsewhere, with the right to opt out
Measuring which ads lead to downloads, trials and purchases (Google Ads, click IDs, UTM tags, enhanced conversions)	Click IDs, UTM tags, marketing cookies, order value, transaction ID, hashed email	Consent in the EEA, UK and Switzerland; legitimate interests elsewhere, with the right to opt out
Keeping tax and accounting records, and responding to lawful requests	Order and payment records	Legal obligation

We don't use your information for automated decision-making that has legal or similarly significant effects on you, and we don't build advertising profiles of you ourselves.

5. Emails we send

We send transactional emails you need in order to use what you bought: your license key, sign-in links, and important notices about your subscription, billing, security or changes to our terms. Stripe sends payment receipts and invoices on our behalf. We don't send marketing emails unless you have asked to receive them, and any marketing email will include a way to unsubscribe.

6. Who we share information with

We don't sell your personal information. We share it only with service providers that help us run Roomy, under contracts that limit how they may use it, and only as much as they need:

• Stripe: payment processing, subscriptions, receipts, the billing portal and fraud prevention.
• Google: Google Analytics and Google Ads measurement, as described above and in our Cookie Policy.
• Our cloud hosting provider: hosts the website, license server and database.
• Our email delivery provider: sends license keys and sign-in links.

We may also disclose information if the law requires it, to protect the rights, safety or property of our customers, us or others, or to a buyer or successor if our business or its assets are transferred. In that case this policy will continue to protect your information.

Google acts as an independent controller for some of the data its advertising and analytics services receive. You can read how Google uses information from sites that use its services.

7. International transfers

We are based in the United States, and our service providers, including Stripe and Google, process data in the United States and other countries. These countries may not have the same data protection laws as the country where you live. When we or our providers transfer personal information out of the EEA, the UK or Switzerland, we rely on recognized safeguards, such as the European Commission's Standard Contractual Clauses (and their UK and Swiss equivalents) or the provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, where these apply. Contact us for more information about these safeguards.

8. How long we keep information

We keep personal information only as long as we need it for the purposes above:

Information	How long we keep it
Account, license and activated device records	While your license is active, then for up to 3 years after it ends so you can return and we can handle questions, then deleted or anonymized
Order, payment, refund and invoice records	As long as tax and accounting law requires, usually up to 7 years after the transaction
Support conversations	Up to 3 years after the conversation ends
Server logs and rate-limiting data (including IP addresses)	Up to 30 days, unless needed longer to investigate a specific security or fraud issue
Ad click IDs and UTM tags	In your browser session, or for 90 days in the roomy_click cookie if you allow marketing cookies; with your order for as long as the order record
Google Analytics data	No longer than 14 months, under the retention setting we use
Data stored by the app on your Mac	Until you delete it or remove the app; it never reaches us

9. How we protect information

• All connections to the website and license server are encrypted with HTTPS (TLS).
• Card payments are handled entirely by Stripe; card numbers never touch our servers.
• Account passwords are stored only as salted, one-way hashes, never in readable form. Sign-in and password reset links are signed, work once and expire after a short time.
• License tokens are digitally signed (Ed25519), so they can't be forged, and the device ID is a one-way hash.
• We rate-limit sign-in and license requests, restrict access to personal information to people who need it, and collect as little as we can.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

10. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct information that is wrong;
• delete your information, unless we must keep it, for example for tax records;
• restrict or object to how we use it, including for analytics and advertising;
• receive it in a portable format;
• withdraw consent at any time, for example with "Cookie settings" in the website footer, without affecting what happened before.

To use any of these rights, email [email protected]. To protect you, we will confirm the request by writing to the email address on your account. We respond within one month (GDPR and UK GDPR) or 45 days (U.S. state laws), and we will tell you if we need more time. You can see your licenses and activated Macs, and deactivate Macs, yourself on your account page.

EEA, UK and Switzerland

You also have the right to complain to your local data protection authority, for example a supervisory authority in your EU country, the Information Commissioner's Office (ICO) in the UK or the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland. We would appreciate the chance to address your concern first.

California and other U.S. states

If you live in California, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the right to know, access, correct and delete your personal information, and to opt out of its "sale" or "sharing". Residents of several other U.S. states have similar rights under their state laws, including the right to appeal if we decline a request (reply to our decision to appeal).

• Categories we collect: identifiers (email, name, license key, device ID, IP address, ad click IDs); commercial information (orders and subscriptions); internet or other network activity (website usage and device information); and approximate location derived from your IP address. We collect these from you, from your use of the Service, and from Stripe and Google. We use them for the purposes in section 4 and disclose them to the service providers in section 6.
• We do not sell personal information, and we don't sell or share the personal information of anyone we know is under 16.
• Sharing for cross-context behavioral advertising. Our use of Google Ads cookies, click IDs and enhanced conversions to measure our ads may count as "sharing" under California law. You can opt out at any time by choosing Cookie settings in the website footer and turning off marketing cookies. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sharing for that browser.
• We don't collect sensitive personal information as defined by the CCPA.
• We will not discriminate against you for using your privacy rights. You can use an authorized agent to make a request; we may ask the agent for proof of your permission and ask you to confirm your identity.

11. Children

Roomy is not directed at children under 16, and we don't knowingly collect personal information from them. If you believe a child has given us personal information, please contact us at [email protected] and we will delete it.

12. Changes to this policy

We may update this policy when our practices or the law change. The date at the top of this page shows when it last changed. If we make a material change, for example collecting a new type of information from the app, we will tell you by email or in the app before it takes effect.

13. Contact us

For privacy questions or requests, email [email protected] or write to:

TSOFT LLC
Attn: Privacy
9169 W State St #2547, Garden City, ID 83714, USA

For anything else, email [email protected] or use our contact page.