Privacy Policy
Effective date: July 1, 2026
RoomKit ("we," "us") is operated by [PLACEHOLDER: Your Legal Entity Name], based in [PLACEHOLDER: State]. This policy describes what data we collect, why, and how you can control it.
What We Collect
| Data | Where stored | Why |
|---|---|---|
| Email address and password hash | Supabase auth (hosted Postgres) | Account identity and login |
| Age confirmation (checkbox, not date of birth) | Supabase auth user metadata | COPPA compliance (13+ only) |
| Room designs (style, budget, slot allocations, selected products) | Supabase database (designs table) | Core product — your saved rooms |
| Interaction events (design created, finalized, render requested, product link clicked) | Supabase database (events table) | Internal funnel analytics to improve the product |
| Product selections per slot (product ID, price, aesthetic, mood) | Supabase database (selections table) | Product recommendation improvement |
| AI-generated room renders | Server filesystem | Visual output for your design |
| Hotspot overlays (clickable product regions on renders) | Server filesystem | Interactive product identification in renders |
What We Do NOT Collect
We do not collect browsing history, device fingerprints, precise location, contacts, social media profiles, or payment information. We do not use tracking pixels, third-party analytics services (Google Analytics, Mixpanel, etc.), or advertising networks. The only cookies are Supabase authentication session cookies required for login.
Third-Party Services
We use the following services to operate RoomKit. Each receives only the data described below — none receive your email, name, or account identity.
- Amazon Associates: Product buy links include our affiliate tag. When you click a buy link, Amazon sees the click and any resulting purchase. Amazon receives the affiliate tag (site-level, not user-level) — we do not send your email, user ID, or any personal information to Amazon.
- OpenAI (gpt-image-1): Room style descriptions are sent to generate renders. No user identity, email, or account information is included in these requests.
- Anthropic (Claude): Style interpretation, composition planning, and product selection prompts are sent to Claude. No user identity, email, or account information is included in these requests.
- Supabase: Hosts our database and authentication. Supabase is the data processor; RoomKit is the data controller. Supabase's privacy policy applies to their infrastructure.
How We Use Your Data
- To generate, save, and display your room designs
- To improve product recommendations and design quality using aggregated interaction data
- To maintain your account and authenticate your sessions
We do not sell your data. We do not share your personal information with advertisers. RoomKit does not train AI models on your data. Our AI providers (Anthropic and OpenAI) do not use API inputs for model training under their current API terms.
Data Retention
Your designs and associated data persist until you delete your account. There is no automatic expiration. Render images are stored on the server and accessible via an unguessable URL (a unique ID). They are not indexed or listed publicly, but anyone with the direct URL can view them. Render images are permanently deleted when you delete your account.
Account Deletion
You can permanently delete your account and all associated data from the Account page. Deletion removes:
- Your login credentials (email and password hash) from Supabase auth
- All saved designs from the database
- All interaction events and product selection records
- All render images and hotspot overlays from the server
Deletion is permanent and cannot be undone. All data is removed in a single operation — there is no recovery period.
Children's Privacy
RoomKit is not intended for children under 13. We require age confirmation (13 or older) at signup and do not knowingly collect data from anyone under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
Changes to This Policy
If we make material changes, we will update the effective date at the top of this page. Continued use of RoomKit after a change constitutes acceptance of the updated policy.
Contact
For privacy questions or data deletion requests, email [PLACEHOLDER: privacy@yourdomain.com].