Privacy Policy
Effective date: October 10, 2026
This Privacy Policy explains how Roast (“we,” “us,” “our”) collects, uses, and protects your information. It’s written to reflect what the Service actually does — see Section 4 for the specific third-party providers involved.
1. Information We Collect
- Account information, from Google or Figma sign-in: your name, email address, and profile picture. We do not collect or store passwords. You may also set a username.
- Uploaded content: the design screenshots you upload for critique, along with the design type you select.
- Generated content: the critique reports produced from your uploads (scores, summary, strengths/issues/tips, and the AI-generated-likelihood assessment).
- Usage data: how many critiques you’ve used in a billing period, your plan tier, error and performance logs tied to your account activity, and the information needed to enforce free-tier limits.
- Payment information: handled entirely by Polar. We receive confirmation of your subscription status but never see or store your card details.
- Email engagement: if you open or click links in emails we send, our email provider records that activity.
2. How We Use Your Information
- To provide the core Service: authenticating you, processing your uploads into critiques, and displaying your report history.
- To enforce free-tier usage limits and manage your subscription.
- To send you transactional email (welcome message, subscription confirmations). Marketing email is only ever sent with your consent, and every marketing message includes a working unsubscribe link.
- To maintain and improve the Service, including diagnosing errors.
We do not sell your personal information.
3. AI Processing
When you upload a design screenshot, it is sent to Anthropic’s Claude API to generate your critique report. This is a necessary part of how the Service works. Anthropic processes this data under its own API terms; we encourage you to review Anthropic’s own privacy documentation if you have questions about their handling.
4. Third-Party Service Providers
We rely on the following providers to operate the Service. Each has access to a defined slice of your data, only as needed to perform their function:
| Provider | Purpose | Data involved |
|---|---|---|
| Google, Figma | Authentication (social login) | Name, email, profile picture |
| Supabase | Database and account storage | Account data, critique records, usage data |
| Tigris | File storage | Uploaded screenshots, generated share-card images |
| Anthropic (Claude API) | AI critique generation | Uploaded screenshots, design type |
| Polar | Payment processing, billing, tax/VAT compliance | Subscription and payment status (not raw card data) |
| SendByte | Transactional and marketing email | Email address, email engagement |
| Cloudflare | Hosting and content delivery | Standard web request data (e.g. IP address) |
| Better Stack | Error and performance logging | Account ID, error details, request metadata |
5. Data Retention and Deletion
- Your account data, uploads, and critique history are retained while your account is active. There is no time-based expiry on free-tier history.
- You can delete individual critiques at any time from your history, which also removes the stored screenshot.
- You can delete your account at any time from Settings. This permanently removes your login, profile, critique records, stored screenshots, and subscription records.
6. Your Rights
Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to certain processing. You can access and correct your name and username from Settings, delete individual critiques from your history, and delete your account entirely at any time. For anything else, contact us using the details below.
7. Cookies
The Service uses only the minimal cookies necessary for authentication (session cookies set by our auth provider). We don’t use tracking or advertising cookies.
8. Children’s Privacy
The Service is not directed at anyone under 18, and we don’t knowingly collect information from anyone under that age. If you believe a minor has provided us information, contact us and we’ll remove it.
9. International Users
The Service is operated from Nigeria. If you’re accessing the Service from elsewhere, your information will be processed in the jurisdictions where our providers operate (see Section 4), which may differ from your own country’s data protection laws.
10. Data Security
We rely on our providers’ security practices alongside reasonable measures on our end — including authenticated, owner-scoped access to all account data and abuse rate limiting on our API — but no method of transmission or storage is 100% secure, and we can’t guarantee absolute security.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We’ll post the updated version here with a new effective date.
12. Contact
Questions about this policy, or requests regarding your data? Contact us at support@roastui.com.