Privacy Policy

Effective date: October 22, 2026

Roze Research Corporation ("Roze," "we," "us," or "our") provides Roze, a personal productivity application that helps people work with information from their devices and connected services. We also operate the Roze website at roze.ai.

This Privacy Policy explains what information we collect, how we use it, when we share it, and the choices available to you.

1. Information we collect

Depending on the features you use, we may collect:

Account and waitlist information: Your name, email address, account identifiers, referral source, and campaign information when you join our waitlist, create an account, or contact us.
Google Account data: Information you authorize Roze to access, including your Google profile and email address, Gmail messages, Google Calendar data, saved Google Contacts, and Google's Other Contacts.
Device and connected-service data: Information you choose to make available through device permissions or connected services, such as contacts, reminders, photos, location, motion, activity, or health information.
Financial account data: If you connect a financial account, Roze receives information about that account through Plaid Inc. ("Plaid"), our financial data-access provider. This may include the institution name, account names, types, and masked account numbers, balances, and transaction history, including merchant names, amounts, dates, and categories. Roze never receives or stores your bank login credentials; you enter them only with Plaid or your institution. Plaid's handling of your information is described in Plaid's End User Privacy Policy.
Content you provide: Messages, prompts, files, preferences, feedback, and support requests you submit to Roze.
Technical information: App version, device type, operating-system information, IP address and approximate location derived from it, feature usage, diagnostic logs, crash information, and similar technical data.
Website information: When you visit roze.ai, a random identifier stored in your browser's local storage, the pages you view, how you arrived, your browser and device type, and your IP address and the approximate location (such as city or country) derived from it.

Roze accesses connected services and device information only after you grant the relevant permission.

2. How we use information

We use information to:

Provide, maintain, personalize, and improve Roze.
Display and synchronize information from devices and connected services.
Show balances, transactions, and spending summaries for financial accounts you connect, and answer your questions about them.
Perform actions you request, such as reading or organizing email, managing calendar events, working with contacts, or accessing relevant attachments.
Provide assistant, search, and automation features.
Manage the Roze waitlist and communicate with people who request updates.
Link your visits to our website and your waitlist sign-up to your Roze account if you later create one with the same email address, so we can understand how people find Roze.
Authenticate users, protect accounts, diagnose errors, prevent abuse, and provide support.
Comply with applicable law.

Roze's servers read your Gmail messages and Google Calendar events to provide Roze features, such as answering your requests, summarizing and prioritizing email, preparing your day, and sending notifications through Apple's push notification service. This can happen while the app is not open. Roze's assistant runs on Roze's servers: when new mail arrives, it reviews it on its own to flag what needs your attention and to prepare your morning briefing.

The assistant sends or forwards email, moves email to the trash, changes labels, unsubscribes you from mailing lists, and creates, changes, responds to, or deletes calendar events only after you approve the action, either each time or through a standing permission you give it. It may save email drafts to your Gmail account for you to review.

When you use features that work with connected information, relevant information can pass through Roze's servers to our artificial-intelligence service providers, including Anthropic and TypeSafe, to provide those features. When you ask the assistant to research something, it can use Anthropic's web search and web fetch tools. This can include email, calendar information, prompts, and files you provide. Roze stores your conversations with the assistant, the notes it keeps to remember context, generated summaries, and other information derived from your data on its servers to show them in the app and to let the assistant continue its work.

When you ask the assistant to visit a website for you, it uses a cloud browser run by Kernel (onkernel.com). Information you ask it to enter on a website, which can include details from your email or calendar, passes through that service. When the assistant completes a step you approved on a website, it records the screen so you can see what it did. If you sign in to a website in the assistant's browser, the browser can keep that sign-in for later visits. Deleting your Roze account removes it.

3. Google user data

Roze's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Roze uses Google user data only to provide or improve user-facing features that are visible within Roze. In particular:

Gmail data is used to display, search, summarize, and prioritize email, to prepare your morning briefing, and to organize, draft, and send email with your approval.
Calendar data is used to display your schedule, check when you are free, and create, update, respond to, and delete calendar events with your approval.
Saved Google Contacts and Other Contacts are read to identify and suggest people relevant to your requested actions. Roze does not change your Google contacts.
Google profile information is used to identify connected accounts.
Google Drive access is limited to files Roze creates. When you ask Roze to attach a document to a calendar event, Roze uploads it to a folder named Roze in your Google Drive and lets the event's guests view it. Roze cannot see or open other files in your Drive.

Attachments that other people add to your calendar events open in your external browser, where access is controlled by the service hosting the file.

We do not sell Google user data or use it for advertising.

We do not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models, and Anthropic, which provides the assistant's model, does not use it to train its models.

We do not transfer Google user data to others except as necessary to provide or improve Roze's user-facing features, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.

People at Roze do not read Google user data unless you give us permission for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

4. How we share information

We may share information:

With service providers that process information on our behalf to operate Roze, such as infrastructure, authentication, financial data access (Plaid), artificial-intelligence processing (including Anthropic and TypeSafe), cloud web browsing for the assistant (Kernel), push notification delivery (Apple), and analytics, crash reporting, diagnostic logs, and artificial-intelligence quality monitoring (all provided by PostHog).
When you direct Roze to send information to another person or service.

We do not sell your personal information.

5. Storage and security

Information may be stored on your device and by service providers that help us operate Roze. Authentication credentials and tokens are stored using secure platform facilities where reasonably available. The access tokens Roze uses to retrieve financial account information through Plaid are encrypted and stored on Roze's servers, are never sent to your device, and are used only to retrieve the information described in this policy.

When you connect a Google account, Roze may store an encrypted, renewable Google authorization on its servers so its servers can provide features while the app is not open. Removing the Google account in Roze or revoking access in your Google Account settings ends that access.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

6. Retention

We retain information only for as long as reasonably necessary to provide Roze, fulfill the purposes described in this policy, maintain security, resolve disputes, and meet legal obligations.

Disconnecting an account stops Roze from making new requests to that account. Previously cached information may remain on your device or in retained backups until it is deleted or ages out under our retention practices.

Your conversations with the assistant and the notes it keeps are stored until you delete your Roze account. Records of the new email and calendar changes that woke the assistant are kept for 30 days. Deleting your Roze account deletes this information from Roze's servers, revokes Roze's Google access, and deletes the assistant's saved browser profile.

Waitlist information is retained while it is reasonably useful for administering the waitlist and communicating about Roze, unless you ask us to delete it.

When you join the waitlist, we keep your website identifier with your waitlist information. We also store it separately with a one-way hash of your email address and the time of your most recent sign-up. If you create a Roze account with the same email address, we use the hash to link your earlier website visits to your account, then delete the hash. Otherwise we delete it after 180 days. After a link is made, we keep the website identifier by itself, without your email address, so that it can't be linked to a second account.

7. Your choices and deletion

You can disconnect a Google Account from within Roze. You may also revoke Roze's access through your Google Account connections.

You can turn notifications off in Roze without removing your Google account. To delete your Roze account, go to Settings, then Account, then Delete account. For information held by service providers or for help with deletion, contact us using the address below.

You can disconnect a financial account at any time from Finances settings in Roze. Disconnecting revokes Roze's access through Plaid and deletes the associated access token from Roze's servers; account and transaction information cached on your device is removed with it. You can also review and manage the connections you have made through Plaid at Plaid Portal.

You can manage device permissions through your device's system settings. Deleting Roze from your device generally removes information stored only within the app's local storage, subject to device backups and information stored separately by connected services or service providers.

To unsubscribe from waitlist or marketing messages, use any unsubscribe option provided in the message or contact us.

To request access to, correction of, or deletion of information held by Roze, email support@roze.ai. We may need to verify your identity before completing a request. We will respond within 30 days, or sooner where applicable law requires.

8. Privacy rights

Depending on where you live, you may have rights concerning your personal information, including rights to access, correct, delete, restrict, or receive a copy of certain information, or to object to certain processing.

You may exercise these rights by contacting us. You also may have the right to appeal our response or contact your local privacy regulator.

9. Children

Roze is not intended for children under 13, or the minimum age required by local law. We do not knowingly collect personal information from children below that age.

10. International processing

Information may be processed in countries other than the country where you live. Where required, we use appropriate safeguards for international transfers.

11. Changes to this policy

We may update this Privacy Policy periodically. If a change materially affects how we use previously collected information, we will provide appropriate notice and obtain consent where required.

The effective date at the top of this page indicates when this Privacy Policy was last updated.

12. Contact us

For questions, concerns, or privacy requests, contact:

Roze Research Corporation
support@roze.ai
https://roze.ai