Privacy Policy

Rostr is operated by ARAMI TECH LLC, a US limited liability company.

Contact: info@arami.tech

When this policy says “we”, “us”, or “our”, that’s ARAMI TECH LLC.

Direct messages and group chats use the Signal protocol family, implemented with platform-native cryptography (Apple CryptoKit on iOS, Google Tink + AndroidX Security on Android). The wire format is byte-compatible across both platforms.

• Each device generates a Curve25519 identity key pair on first launch. The private key never leaves the device; it lives in iOS Keychain (AfterFirstUnlockThisDeviceOnly) or Android Keystore (StrongBox where available).
• DM messages are encrypted with ChaCha20-Poly1305 using a per-conversation key derived from a Diffie-Hellman exchange.
• Group chats use Sender Keys: each member’s outgoing messages are encrypted with their own sender key, distributed once over the pairwise DM channel. When someone leaves the group, the sender key is rotated.
• Images, voice messages, and files in DM/group chats are also encrypted before they leave your phone. We store ciphertext blobs in Supabase Storage; the per-file key is encrypted inside the message body and only the recipient can decrypt it.
• Push notifications carry no message preview for E2EE chats, just “New message”.

Rostr’s core feature is automatic schedule extraction from a roster image. Here is exactly how the pipeline works:

• You initiate it. Tap Add Roster → Scan Screenshot. The first time you use it, iOS or Android shows the system permission prompt for Camera or Photo Library.
• One image at a time. You either capture a fresh photo or pick a single existing screenshot. The app does NOT browse your photo library; the iOS Photos Picker / Android Photo Picker hands us only the file you actually select.
• Compressed and uploaded. The image is downscaled (max 1024 px wide) and sent to our Supabase Edge Function over HTTPS.
• Read by Claude (Anthropic). The Edge Function forwards the image to Anthropic’s Claude Vision-capable model for OCR. This runs under Anthropic’s commercial API terms: no model training on API inputs, max 30-day input retention for trust & safety, then deleted.
• Schedule extracted, image deleted. The structured schedule (dates, shift times, types) is saved to your account. The original image is deleted from our Supabase Storage within 24 hours.

App Store and Play Store policies require us to filter user-generated content on broadcast surfaces. We do this in three places:

If a post or image is flagged by automated review, it is hidden from other users immediately. The author keeps their copy and sees a takedown reason.

We also rely on you. If you encounter abusive content in a DM or group chat, tap Report. Reporting unlocks a one-time decryption of THAT message and uploads the plaintext to our admin queue for human review (24-hour SLA). Reporting is the ONLY way the content of an E2EE message ever leaves your device readable.

We use two separate AI providers, each scoped to a different feature. Neither has overlapping access.

Anthropic: Roster OCR only

The image you pick to scan is sent to Anthropic, PBC under their commercial API terms:

• They do not train Claude on our API requests
• They retain inputs for max 30 days for trust & safety, then delete
• We do not use Claude.ai (consumer product, different policy)

What we send to Anthropic:

• Roster scan images for OCR (Claude Vision-capable model), image deleted from our server within 24h

OpenAI: Community Wall moderation only

For Community Wall content moderation we send certain content to OpenAI, Inc. under their Enterprise / API data policy:

• They do not train models on our API requests
• They retain inputs for max 30 days for abuse monitoring, then delete
• We do not use ChatGPT (which has a different policy)

What we send to OpenAI:

• Community Wall post text (Moderation API), hate speech and abuse detection
• Community Wall image URLs (Vision, gpt-4o-mini), abusive image detection

What we never send to either Anthropic or OpenAI:

• DM message contents
• DM image / voice / file contents
• Group chat message contents
• Your account credentials, payment information, or device identifiers

We have signed Data Processing Agreements (or have equivalent commercial terms in place) with Supabase, Google, OpenAI, Anthropic, and Apple. None of these vendors sells your data.

You can delete your account from Profile → Delete Account. Your row is soft-deleted (recoverable for 30 days), then hard-deleted along with all messages you authored. Other people’s chats with you are preserved (their content, their copy).

You have the right to:

• Access what we have on you (email info@arami.tech)
• Correct anything we have wrong
• Export your data (we’ll send a JSON dump within 30 days)
• Delete your account (in-app, instant)
• Object to ad personalization (iOS Settings → Privacy → Tracking, or Android Settings → Google → Ads)
• Lodge a complaint with your data-protection authority

EU / UK residents (GDPR)

Your legal basis under GDPR is:

• Contract for the core service (sign-in, roster, chat)
• Legitimate interest for moderation, anti-abuse, and crash logs
• Consent for ad personalization (you can withdraw anytime)

California residents (CCPA / CPRA)

We do not sell or share your personal information for cross-context behavioral advertising as defined by California law. You can request to know, delete, or correct your data via info@arami.tech.

Rostr is rated 17+. We do not knowingly collect data from anyone under 13 (US: COPPA) or 16 (EU: GDPR). If you believe a child has created an account, email info@arami.tech and we’ll delete it.

We’ll update the “Last updated” date at the top whenever we change something. Material changes (new vendors, new categories of data) get an in-app banner the next time you open the app.

If you’re an Apple App Reviewer or Google Play reviewer reading this, here’s the relevant compliance summary:

• OCR pipeline: Camera capture / Photo Library pick → image downscaled to 1024 px → HTTPS to Supabase Edge Function (ocr-roster-claude) → Anthropic Claude Vision-capable model → structured schedule returned → original image deleted from Supabase Storage within 24h. iOS uses Photos Picker; Android uses ActivityResultContracts.PickVisualMedia. Neither requires READ_MEDIA_IMAGES; the picker is out-of-process.
• UGC moderation: text + image on Community Wall are scanned via OpenAI Moderation + gpt-4o-mini Vision before publish. DM and Group chat (including voice) are E2EE; user-report is the safety net (24h SLA).
• Reporting flow: long-press any message → Report → adds row to reports table; admin reviews via dashboard within 24h.
• Block / Kick: live in-app, all surfaces.
• Encryption export compliance (iOS): Apple CryptoKit (X25519 + ChaCha20-Poly1305 + HKDF) used for end-to-end encryption of DM and group chat. Declared as ITSAppUsesNonExemptEncryption = YES; classified under ECCN 5D992.c with License Exception ENC §740.17(b)(1) (mass market, standard algorithms only). App Store Connect’s App Encryption questionnaire completed for this submission; no documentation upload required.
• Encryption export compliance (Android): Google Tink + AndroidX Security (X25519 + ChaCha20-Poly1305 + HKDF). Standard mass-market crypto only; same ECCN 5D992.c classification.
• Account deletion: Profile → Delete Account, soft delete with 30-day grace, then hard delete + cascade.