Roomstep – Privacy Policy
Roomstep is run by AREION QUANTUM, s.r.o., Chvalská 718/10, 198 00 Praha 14, Czech Republic, Company ID 19621809 (“we”). We are the controller of the data described here. This page says what the app sends off your phone, to whom, why, and for how long. Anything not listed here stays on your phone.
What stays on your phone
Your rooms, tasks, steps you wrote yourself, reminders, settings and the history of what you did are stored only on your phone. There are no accounts and we have no copy of them. Deleting the app deletes them.
What leaves your phone
| What | When | Who receives it | Why |
|---|---|---|---|
| A photo of a room | Only after you tap Agree, each time you ask for a plan from a photo | Our server (hosted by Cloudflare), which passes it to Claude, an AI service by Anthropic | To turn the photo into small cleaning steps |
| A random install ID (24 characters) | With each photo | Our server (hosted by Cloudflare) | To count plans per day so the service cannot be flooded |
| RevenueCat’s anonymous app user ID | Only with a plan from a photo you ask for as a Plus subscriber | Our server (hosted by Cloudflare), which asks RevenueCat whether Plus is active | So only subscribers get Plus plans |
| Usage events | When you finish steps, make a plan from a photo, accept a reminder, or open or use the Plus screen | PostHog (United States) | To see which parts of the app are used |
| Your purchase | When you buy or restore Roomstep Plus | Apple and RevenueCat | To take the payment and switch Plus on |
| Apple Search Ads attribution token | When the app starts | RevenueCat, which asks Apple | To see whether the install came from an Apple Search Ads ad |
Photos
The app asks once before the first photo and sends nothing until you agree. The photo is made smaller on your phone, sent to our server, and passed to Claude by Anthropic. Our server does not store or log the photo. Avoid photos that show people, documents or anything else you would not want to send. Without agreeing you can still use everything except plans from a photo.
The install ID
The install ID is a random string the app makes when you tap Agree. It is not your name, your Apple Account or your phone’s advertising identifier, and it changes if you reinstall the app. Our server keeps only a count of plans made per day next to it.
Usage events
An event is a name such as “session finished” with, at most, a number of steps and a few yes-or-no facts (for example, whether the set came from a photo). Events never contain a photo, the text of a step, the name of a room or task, a price, or the install ID. Each event carries a random ID that exists only while the app is open; the next time you open the app it is a new one, so your visits cannot be joined together.
Like any server, PostHog sees the IP address a request comes from. Usage events are switched on only after our PostHog project is set to discard IP addresses and not to work out a location from them; until then the app sends no usage events.
Purchases
Payments are handled by Apple. We never see your card. RevenueCat (revenuecat.com) tells the app whether a Plus subscription is active; it receives an anonymous app user ID and the purchase details from Apple. When you ask for a plan from a photo as a Plus subscriber, the app also sends that anonymous app user ID to our server, which asks RevenueCat whether Plus is active. Our server does not store it; the daily count stays next to the install ID only.
When the app starts, it also asks Apple’s AdServices framework for an attribution token and passes it to RevenueCat. Apple uses the token to say whether the install came from an Apple Search Ads ad and, if so, from which campaign, ad group and keyword; RevenueCat keeps that next to the anonymous app user ID. The token contains no name, Apple Account, advertising identifier or device identifier, and it is not used to track you across other apps or websites.
Who receives data
- Cloudflare – hosts our server, which receives the photo, the install ID and, for Plus plans, RevenueCat’s anonymous app user ID.
- Anthropic – receives the photo to write the cleaning steps, under its commercial terms for its API.
- PostHog – receives the usage events.
- RevenueCat and Apple – handle the subscription.
We do not sell data, show ads or share data with advertisers. Some of these providers are in the United States; transfers rely on their standard contractual safeguards.
How long it is kept
- Photo on our server: not kept. It is passed on and discarded.
- Install ID and daily count on our server: deleted after two days.
- RevenueCat’s app user ID on our server: not kept. It is used for the one check and discarded.
- Photo at Anthropic: Anthropic deletes API inputs within 30 days. If its safety systems flag an input as breaking its usage policy, Anthropic may keep it for up to two years.
- Usage events at PostHog: kept only as long as we need them to understand how the app is used, and then deleted.
- Purchase records at RevenueCat: as long as the subscription exists and as its own policy and tax law require.
- Data on your phone: until you delete the app.
Legal basis
Photos: your consent, given when you tap Agree. You can withdraw it by not sending further photos. Install ID: our legitimate interest in keeping the service from being flooded. Usage events: our legitimate interest in improving the app. Purchases: performing the contract you enter when you subscribe.
What we do not do
No advertising, no tracking across other apps or websites, no selling of data. The app does not read your location, contacts or health data. “ADHD” describes who the app was designed for; the app collects nothing about your health.
Your rights and deletion
Write to hello@areionquantum.com to ask what we hold, to have it corrected or deleted, or to object to its use; we will answer within one month. Since we hold only daily counts for two days and events that are not tied to you, there is usually nothing we can look up for a given person. You can also complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (uoou.gov.cz), or the authority in your country.
Children
Roomstep is not directed at children under 13, and we do not knowingly collect data from them.
This website
This website sets no cookies and loads nothing from other sites.
Changes
If the app starts sending anything else, or the AI provider changes, this page changes first and the app asks for your agreement again before the next photo.