Privacy Policy

1. Information we collect

A. Account Information

When you create or use an account, we may process:

• email address;
• account identifier;
• authentication and verification status;
• subscription or entitlement status;
• account settings;
• timestamps associated with account activity.

B. Instagram Content Submitted for Analysis

When a user submits a supported public Instagram post or Reel URL, Roastagram may process information reasonably necessary to perform the requested analysis, such as:

• submitted URL;
• public Instagram username or account identifier associated with the post;
• publicly available caption or text;
• publicly available image, video or post metadata;
• other publicly accessible information reasonably necessary for the roast analysis.

Roastagram is not intended to access private Instagram accounts or bypass access controls.

C. Roast and Analysis Data

We may process:

• roast level selected;
• analysis scores;
• AI-generated observations;
• verdicts;
• roast text;
• timestamps;
• technical processing status;
• associated share identifiers or URLs where applicable.

D. Payment and Subscription Information

Payments are processed by third-party payment providers such as Stripe.

We may receive and store limited transaction information such as:

• Stripe customer identifier;
• subscription identifier;
• transaction or checkout identifier;
• purchase type;
• payment status;
• amount;
• currency;
• billing period;
• entitlement or quota information.

Roastagram does not need to store your complete payment-card number in its application database.

E. Technical and Security Information

We may collect information such as:

• IP address;
• device/browser type;
• operating system;
• approximate location derived from IP;
• language;
• timestamps;
• referral information;
• error and diagnostic data;
• session/security information;
• anti-fraud information.

F. Cookies and Similar Technologies

We may use cookies, local storage and similar technologies for:

• authentication;
• session continuity;
• security;
• fraud prevention;
• user preferences;
• pending roast continuation;
• consent preferences;
• analytics and advertising measurement where permitted.

In addition to account and technical information described in this Privacy Policy, we process content you provide or make available to Roastagram in order to use the Service.

This may include photos or screenshots you upload directly, Instagram post or Reel URLs, public Instagram profile or post information retrieved in connection with a submitted URL, optional context or instructions you provide, roast results, generated Roast Cards, and related service data.

We may also process technical information used to operate, secure and improve the Service, including browser or device information, language or locale, country-level information, visitor or session identifiers, human-verification data, consent preferences, and functional state stored through cookies or browser storage such as localStorage.

Cookies and localStorage are different browser technologies and may be used for different purposes.

We do not receive or store full payment card numbers or card security codes.

2. Information about people who are not Roastagram users

A Roastagram user may submit a publicly accessible Instagram post belonging to another person.

As a result, Roastagram may temporarily or persistently process limited publicly available information relating to a person who does not have a Roastagram account.

We process such information only in connection with providing, securing and operating the requested roast functionality and related legitimate service purposes.

Roastagram does not operate a public Roast Wall containing all submitted roasts.

If you believe your public Instagram content has been processed by Roastagram and you want us to review or remove associated data, use our Data Removal, Report Abuse or Contact page.

We may request reasonable information to verify the request and identify the relevant content.

A Roastagram user may submit a photo or other content that depicts or relates to a person who does not have a Roastagram account.

When this occurs, we may process that person's image or information only as part of providing, securing, moderating, sharing or administering the Service.

Users who submit content involving another person are responsible for complying with the Terms of Use and applicable law.

A person depicted in publicly shared Roastagram content may submit a Report / Request Removal without creating a Roastagram account.

3. How we use information

We may use information to:

• provide the Roastagram Service;
• analyze submitted public Instagram content;
• generate roast outputs;
• create and manage accounts;
• verify email addresses;
• manage subscriptions, purchases and quotas;
• continue a pending roast after signup or payment;
• provide share functionality requested by users;
• detect fraud, abuse and security threats;
• enforce Terms of Use;
• respond to support, abuse, privacy and legal requests;
• troubleshoot and improve reliability;
• understand service usage;
• comply with legal obligations;
• protect our rights, users and third parties;
• measure advertising effectiveness where permitted;
• communicate operational or account-related messages.

4. Legal bases for processing

Where data-protection law requires a legal basis, we rely on one or more of the following depending on the context:

A. Contract

Processing necessary to provide an account, requested roast, subscription, purchase or other Service requested by you.

B. Legitimate Interests

Our legitimate interests may include:

• operating the Service;
• providing requested AI analysis;
• preventing fraud and abuse;
• maintaining security;
• debugging and improving reliability;
• protecting legal rights;
• understanding service performance.

Where required, we consider whether those interests are overridden by the rights and interests of affected individuals.

C. Consent

We rely on consent where required, including for certain analytics, advertising or tracking technologies.

You may withdraw consent through available privacy/cookie controls where applicable.

D. Legal Obligation

We may process data when necessary to comply with law, tax, accounting, regulatory or valid legal-process requirements.

E. Protection of Rights

Where permitted by law, we may process information to establish, exercise or defend legal claims or protect users and third parties.

5. Meta Pixel and Conversions API

Where permitted by applicable law and your privacy choices, Roastagram may use Meta Pixel and Meta Conversions API technologies for advertising attribution, campaign measurement and related advertising purposes.

Depending on the event and available data, information sent for these purposes may include:

• event type;
• event timestamp;
• page or conversion information;
• value and currency;
• browser identifiers such as fbp/fbc where available;
• privacy-protected identifiers such as normalized and cryptographically hashed email information where appropriate.

Roastagram's implementation is intended to respect applicable consent choices.

Where opt-in consent is required, such tracking should not operate until required consent has been provided.

Where an opt-out model is legally permitted, users must be able to exercise applicable privacy choices.

Where advertising consent is required, Meta advertising technologies are activated only after the applicable consent is provided.

Information sent to Meta may include hashed email address, hashed external identifier, Meta browser identifiers such as fbp and fbc, IP address, browser User-Agent, event name, value, currency and content-name information used for advertising measurement and attribution.

Roastagram does not send your uploaded photo, generated Roast Card, roast text or submitted Instagram URL to Meta for advertising measurement.

Certain attribution information, including IP address and User-Agent information, may also be stored by Roastagram for attribution, fraud prevention, measurement and related operational purposes.

6. Email

Roastagram may use email providers such as Resend to deliver:

• verification emails;
• security messages;
• account notices;
• transactional communications;
• other Service-related messages.

We may process your email address and delivery status for these purposes.

Marketing messages, if introduced in the future, will be handled separately in accordance with applicable law and opt-out requirements.

7. Payment processing

Payments are processed through payment providers such as Stripe.

Stripe may independently process payment, billing, fraud-prevention and related information under its own privacy practices.

We receive only information reasonably necessary to confirm transactions and manage your Roastagram entitlements.

8. Security and human verification

We may use security and anti-abuse providers, including technologies such as Cloudflare Turnstile, to distinguish legitimate human use from automated or abusive activity.

Such providers may process technical information necessary to provide their security services.

9. AI service providers

To generate roast analysis and related AI output, information associated with a submitted roast may be processed by AI infrastructure or model service providers acting on our behalf or supporting Service functionality.

We seek to limit information provided to what is reasonably necessary for the requested functionality.

Do not submit private, confidential or sensitive information that is not necessary to use Roastagram.

Roastagram uses third-party service providers to process content where necessary to provide the Service.

OpenAI may receive submitted images and relevant text or context for purposes including roast generation, content moderation, face detection or crop selection, and generation or editing of Roast Card imagery.

Where enabled, the Lovable AI Gateway may receive a source image and generation instructions in connection with creation of certain share visuals.

Apify may receive an Instagram URL or username in order to retrieve publicly available Instagram information and media locations. Roastagram, rather than the user, may subsequently retrieve media from those locations for processing. Roastagram does not upload your image files to Apify as part of this flow.

The retention, security and processing practices of third-party providers may also be governed by their own applicable terms and policies. We do not make promises in this Privacy Policy about provider-side retention or model-training practices that are not controlled by Roastagram.

10. Service providers

We may disclose information to vendors that help us operate Roastagram, including providers of:

• cloud hosting;
• databases;
• authentication;
• payment processing;
• transactional email;
• security and anti-abuse;
• analytics;
• advertising measurement;
• AI inference;
• customer support;
• infrastructure monitoring.

These providers may process information subject to contractual terms and their respective legal obligations.

11. No sale for money

Roastagram does not sell personal information to third parties for monetary payment.

However, certain advertising or analytics disclosures may be considered a "sale," "sharing," targeted advertising or cross-context behavioral advertising under some privacy laws even where no money changes hands.

Where applicable law provides an opt-out right, Roastagram will honor applicable privacy choices through available consent/privacy controls.

12. Shared roast links

A user may choose to distribute a roast through a share link or share feature.

If a user shares such a link publicly, people with access to the link may be able to view the associated result.

Roastagram does not maintain a public Roast Wall or searchable public directory of all roast results.

If a shared result concerns you and you believe it should be removed, use the Report Abuse, Data Removal or Contact page.

If you choose to create or use a public Roastagram share link, anyone who possesses that link may be able to view the associated roast content and imagery.

Public share links use an opaque share identifier rather than exposing an account identifier.

Roastagram may disable or revoke a hosted public share link. When a share is revoked, the Roastagram-hosted public page and associated public media access are disabled.

Revocation cannot recall screenshots, downloads, copies, reposts or other versions that another person may already have saved or distributed outside Roastagram.

13. Data retention

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, maintaining account and transaction records, protecting the Service, preventing abuse and fraud, resolving disputes, responding to removal or legal requests, enforcing our Terms, and complying with legal obligations.

Roastagram does not promise a fixed automatic deletion period for uploaded or generated content unless a specific retention period is expressly stated in the Service.

When a user deletes an individual roast from History, Roastagram removes the user-specific roast record and associated owner-specific uploaded and Roast Card media handled by that deletion process.

Certain information may be retained for longer periods, including shared or cached technical content, billing and transaction records, security and fraud-prevention records, support and removal-request records, administrative audit records, information required for legal compliance, and information retained by third-party service providers under their own policies.

14. Data deletion

You may delete individual eligible roasts through Roast History. When the deletion completes successfully, Roastagram disables associated public access and removes the applicable user-specific roast record and owner-specific media handled by that deletion process.

You may also submit an account deletion request through the available account settings or support mechanisms. Account deletion requests are processed through Roastagram's administrative deletion process.

Account deletion does not necessarily result in the immediate deletion of every technical copy, storage object, shared or cached record, transaction record, security record, audit record or record held by a third-party service provider.

Information may remain where reasonably necessary for shared-service operation, accounting, fraud prevention, security, dispute resolution, enforcement, legal compliance, backup or technical purposes.

If you believe personal content remains available through Roastagram after a deletion or removal request has been processed, you may contact us or submit an applicable removal request.

15. Your privacy rights

Depending on where you live and applicable law, you may have rights concerning your personal information, including rights to:

• access;
• obtain information about processing;
• correct inaccurate information;
• delete information;
• restrict processing;
• object to certain processing;
• data portability;
• withdraw consent;
• opt out of certain advertising-related processing;
• appeal certain privacy decisions;
• complain to a data-protection authority.

These rights are not absolute and may be subject to legal exceptions.

Requests may be submitted through the Contact or Data Removal page.

We may need to verify your identity before fulfilling a request.

Depending on your location and applicable law, you may have rights relating to access, correction, deletion, restriction or other handling of personal information.

Roastagram provides several mechanisms for exercising relevant choices or making requests, including:

• deleting eligible individual roasts from Roast History;
• requesting account deletion;
• using the Data Removal or Contact mechanisms where available; and
• using Report / Request Removal for publicly shared Roastagram content, including where you are the person depicted in that content.

We may need information reasonably necessary to understand, verify or respond to a request. Certain information may be retained where permitted or required for legal, security, fraud-prevention, accounting, dispute-resolution or enforcement purposes.

16. European Economic Area and United Kingdom

Where the GDPR, UK GDPR or similar law applies, users may have rights including access, rectification, erasure, restriction, portability and objection.

Where processing relies on consent, consent may be withdrawn.

Where processing relies on legitimate interests, you may have the right to object in circumstances provided by law.

You may also lodge a complaint with the competent supervisory authority.

17. California and other U.S. state privacy rights

If a U.S. state privacy law applies to Roastagram and to you, you may have rights including:

• knowing/accessing certain personal information;
• deleting certain personal information;
• correcting inaccurate information;
• obtaining data portability;
• opting out of sale/sharing or targeted advertising where legally applicable;
• limiting certain uses of sensitive personal information where applicable;
• non-discrimination for exercising privacy rights.

We do not discriminate against users for exercising legally protected privacy rights.

Requests may be submitted through our Contact or Data Removal mechanisms and may be subject to verification.

Authorized agents may submit requests where permitted by applicable law and where required authorization is provided.

18. Children

Roastagram is intended for adults aged 18 or older.

We do not knowingly offer accounts or paid Roastagram services to children.

If you believe a child has provided personal information to Roastagram in violation of this Policy, contact us through the available Contact or Data Removal page.

19. International data transfers

Roastagram is operated by a U.S. company and uses service providers that may process information in the United States and other countries.

As a result, information may be transferred to jurisdictions with data-protection laws that differ from those in your country.

Where legally required, appropriate transfer mechanisms or safeguards will be used.

20. Security

We use reasonable administrative, technical and organizational measures designed to protect information against unauthorized access, loss, misuse or alteration.

However, no internet-connected service or method of electronic storage can be guaranteed to be completely secure.

You are responsible for maintaining the security of your own account credentials and devices.

21. Data breaches

If a security incident involving personal information occurs, we will investigate and provide notifications where required by applicable law.

22. Third-party websites

Roastagram may contain links to Instagram, Stripe or other third-party services.

We do not control the privacy practices of those third parties.

Their collection and processing of information is governed by their own policies.

23. Automated processing

Roastagram uses automated systems and artificial intelligence to generate entertainment-based roast analysis.

These outputs are not intended to make legal or similarly significant decisions about individuals.

Do not use Roastagram outputs as the basis for employment, credit, housing, insurance, education, medical, legal or similarly consequential decisions.

Roastagram uses automated systems and artificial intelligence to analyze submitted content and generate entertainment outputs.

As part of image processing, the Service may perform face detection and determine a face location or bounding box in order to select or crop an appropriate image area.

The current Service does not create facial embeddings or biometric templates and does not use face recognition, identity matching or biometric identification to determine who a person is.

AI-generated outputs may be inaccurate, fictional, unexpected or otherwise imperfect. Additional information about the entertainment nature of generated content is provided in our Terms of Use.

24. Do Not Track

Browser "Do Not Track" signals are not uniformly standardized.

Where required by applicable law, Roastagram will honor legally recognized opt-out preference signals to the extent applicable to the relevant processing.

25. Changes to this Privacy Policy

We may update this Privacy Policy as our Service, technologies or legal obligations change.

The current version and effective date will be displayed on this page.

Where required by law, we will provide additional notice or request consent for material changes.

26. Contact and privacy requests

Privacy questions, access/deletion requests, objections, abuse complaints and other privacy matters may be submitted through the Contact, Data Removal or Report Abuse pages available at roastagram.app.

You can also email us at hello@roastagram.app.

Data controller: Langugo LLC, 30 North Gould Street, Suite 29711, Sheridan, WY 82801, United States.

We have not appointed a data protection officer, and we do not currently operate a dedicated privacy help desk beyond the channels above.

27. Reports, Removal Requests and Enforcement Records

A person may submit a Report / Request Removal concerning publicly shared Roastagram content without having a Roastagram account.

For these requests, we may collect the requester's email address, complaint category, explanation, the relevant share reference, language or locale, submission time, request status, urgency classification, resolution time and administrative resolution notes.

Certain categories, including reports involving possible minors or intimate or sexual content, may be flagged for urgent review.

Submitting a report does not automatically remove another user's content. Roastagram reviews requests and may revoke public access, remove hosted content, remove a roast, restrict an account or take other appropriate action depending on the circumstances.

Removal-request information may be retained for as long as reasonably necessary to handle and document the request, prevent abuse, resolve disputes, enforce our Terms, protect legal rights and comply with applicable law.

Access to removal-request records is restricted to authorized operational or administrative use and relevant service providers where necessary to process the request.