Privacy Policy

• Account — when you sign in with Google or GitHub: your name, email, and avatar.
• Profile — your handle, home region, and bio.
• Content & activity — your posts, replies, likes, follows, charity votes, disputes, and uploaded images.
• Payments — handled by Stripe. We never see or store your card number; we receive transaction confirmations and the last four digits for receipts.
• Technical — IP address, user-agent string, and request logs, used for security, rate-limiting, and abuse prevention.

To operate Roar (account creation, displaying your content, routing donations to your region), to run the AI fact-checking and content-moderation pipelines on text and uploaded images, to prevent abuse and protect the service, to communicate with you about your account, and to comply with legal obligations. We do not do behavioral ad targeting.

If GDPR or UK GDPR applies to you, we process your personal data on the following bases:

• Contract (Art. 6(1)(b)) — to provide the service when you have an account.
• Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, rate-limiting, and aggregated service analytics. You can object to processing on this basis.
• Consent (Art. 6(1)(a)) — where we ask for it explicitly (for example, optional email updates). You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with law (for example, responding to lawful requests or retaining tax records).

Posts and uploaded images are processed by automated systems for safety and fact-checking. Text is sent to Anthropic's Claude API for fact-check and moderation analysis. Images are scanned for known child sexual abuse material (CSAM) and for policy violations. Per Anthropic's API terms, API inputs are not used to train Anthropic's models. Where automated review flags content, a human moderator may review it.

We use a small set of sub-processors strictly to operate Roar. Each is bound by contract to process personal data only on our instructions.

• Supabase — database, image storage, authentication infrastructure.
• Anthropic (Claude) — fact-check and content-moderation analysis. API inputs are not used to train models.
• Stripe — payment processing.
• Upstash — rate-limiting cache.
• Vercel — application hosting and request logging.
• Sentry — error monitoring (scrubbed of personal information where possible).
• Google / GitHub — sign-in providers (we receive your name, email, and avatar from them).

We do not sell, rent, or share your personal data with advertisers or data brokers, and we do not share personal data for cross-context behavioral advertising as defined by the CCPA/CPRA.

Our infrastructure is primarily located in the United States. If you use Roar from outside the U.S., your personal data is transferred to and processed there. Where required, we rely on Standard Contractual Clauses or equivalent safeguards adopted by our sub-processors for international transfers from the EU/UK.

• Account & profile — while your account is active. When you delete your account, your account and profile are removed from the live database within 7 days and from routine backups within 30 days thereafter.
• Content (posts, replies, images) — while you have them published or your account is active. Deleted items are removed from the live database within 7 days and from backups within 30 days.
• Request logs & IP addresses — up to 90 days for security and abuse prevention; aggregated counts may be retained longer.
• Payment records — retained as required by tax and accounting law (typically 7 years), through Stripe and our finance records.
• Moderation records— where we've taken enforcement action, we retain a record of the action and the content involved for up to 2 years for safety and consistency.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data, to object to certain processing, and to lodge a complaint with your data-protection authority.

You can download all your data or permanently delete your account from Settings at any time. For other requests — including the right to know, delete, correct, opt out of sale/sharing (note: we do not sell or share), or limit use of sensitive personal information under the CCPA/CPRA — email privacy@roarloudly.com. We'll verify your identity by reference to information associated with your account and respond within the time required by law (typically 45 days for CCPA, 1 month for GDPR).

We won't discriminate against you for exercising any of these rights.

We use only essential cookies (a secure session cookie to keep you signed in). No advertising or third-party tracking cookies. See our Cookie Policy.

Roar is not directed to children under 13 (or under 16 in the EU/UK). We do not knowingly collect personal information from children under those ages. If you believe a child has provided us personal information, email privacy@roarloudly.com and we will delete it.

We use industry-standard practices to protect your data — TLS in transit, encryption at rest for our database and image storage, scoped access controls, and audit logging. No service can guarantee perfect security; if a breach affects your data, we'll notify you as required by law.

We'll note material changes here and update the "last updated" date. Questions: privacy@roarloudly.com.