Privacy Policy

1. Information we collect

A. Account Information

When you create or use an account, we may process:

• email address;
• account identifier;
• authentication and verification status;
• subscription or entitlement status;
• account settings;
• timestamps associated with account activity.

B. Instagram Content Submitted for Analysis

When a user submits a supported public Instagram post or Reel URL, Roastagram may process information reasonably necessary to perform the requested analysis, such as:

• submitted URL;
• public Instagram username or account identifier associated with the post;
• publicly available caption or text;
• publicly available image, video or post metadata;
• other publicly accessible information reasonably necessary for the roast analysis.

Roastagram is not intended to access private Instagram accounts or bypass access controls.

C. Roast and Analysis Data

We may process:

• roast level selected;
• analysis scores;
• AI-generated observations;
• verdicts;
• roast text;
• timestamps;
• technical processing status;
• associated share identifiers or URLs where applicable.

D. Payment and Subscription Information

Payments are processed by third-party payment providers such as Stripe.

We may receive and store limited transaction information such as:

• Stripe customer identifier;
• subscription identifier;
• transaction or checkout identifier;
• purchase type;
• payment status;
• amount;
• currency;
• billing period;
• entitlement or quota information.

Roastagram does not need to store your complete payment-card number in its application database.

E. Technical and Security Information

We may collect information such as:

• IP address;
• device/browser type;
• operating system;
• approximate location derived from IP;
• language;
• timestamps;
• referral information;
• error and diagnostic data;
• session/security information;
• anti-fraud information.

F. Cookies and Similar Technologies

We may use cookies, local storage and similar technologies for:

• authentication;
• session continuity;
• security;
• fraud prevention;
• user preferences;
• pending roast continuation;
• consent preferences;
• analytics and advertising measurement where permitted.

2. Information about people who are not Roastagram users

A Roastagram user may submit a publicly accessible Instagram post belonging to another person.

As a result, Roastagram may temporarily or persistently process limited publicly available information relating to a person who does not have a Roastagram account.

We process such information only in connection with providing, securing and operating the requested roast functionality and related legitimate service purposes.

Roastagram does not operate a public Roast Wall containing all submitted roasts.

If you believe your public Instagram content has been processed by Roastagram and you want us to review or remove associated data, use our Data Removal, Report Abuse or Contact page.

We may request reasonable information to verify the request and identify the relevant content.

3. How we use information

We may use information to:

• provide the Roastagram Service;
• analyze submitted public Instagram content;
• generate roast outputs;
• create and manage accounts;
• verify email addresses;
• manage subscriptions, purchases and quotas;
• continue a pending roast after signup or payment;
• provide share functionality requested by users;
• detect fraud, abuse and security threats;
• enforce Terms of Use;
• respond to support, abuse, privacy and legal requests;
• troubleshoot and improve reliability;
• understand service usage;
• comply with legal obligations;
• protect our rights, users and third parties;
• measure advertising effectiveness where permitted;
• communicate operational or account-related messages.

4. Legal bases for processing

Where data-protection law requires a legal basis, we rely on one or more of the following depending on the context:

A. Contract

Processing necessary to provide an account, requested roast, subscription, purchase or other Service requested by you.

B. Legitimate Interests

Our legitimate interests may include:

• operating the Service;
• providing requested AI analysis;
• preventing fraud and abuse;
• maintaining security;
• debugging and improving reliability;
• protecting legal rights;
• understanding service performance.

Where required, we consider whether those interests are overridden by the rights and interests of affected individuals.

C. Consent

We rely on consent where required, including for certain analytics, advertising or tracking technologies.

You may withdraw consent through available privacy/cookie controls where applicable.

D. Legal Obligation

We may process data when necessary to comply with law, tax, accounting, regulatory or valid legal-process requirements.

E. Protection of Rights

Where permitted by law, we may process information to establish, exercise or defend legal claims or protect users and third parties.

5. Meta Pixel and Conversions API

Where permitted by applicable law and your privacy choices, Roastagram may use Meta Pixel and Meta Conversions API technologies for advertising attribution, campaign measurement and related advertising purposes.

Depending on the event and available data, information sent for these purposes may include:

• event type;
• event timestamp;
• page or conversion information;
• value and currency;
• browser identifiers such as fbp/fbc where available;
• privacy-protected identifiers such as normalized and cryptographically hashed email information where appropriate.

Roastagram's implementation is intended to respect applicable consent choices.

Where opt-in consent is required, such tracking should not operate until required consent has been provided.

Where an opt-out model is legally permitted, users must be able to exercise applicable privacy choices.

6. Email

Roastagram may use email providers such as Resend to deliver:

• verification emails;
• security messages;
• account notices;
• transactional communications;
• other Service-related messages.

We may process your email address and delivery status for these purposes.

Marketing messages, if introduced in the future, will be handled separately in accordance with applicable law and opt-out requirements.

7. Payment processing

Payments are processed through payment providers such as Stripe.

Stripe may independently process payment, billing, fraud-prevention and related information under its own privacy practices.

We receive only information reasonably necessary to confirm transactions and manage your Roastagram entitlements.

8. Security and human verification

We may use security and anti-abuse providers, including technologies such as Cloudflare Turnstile, to distinguish legitimate human use from automated or abusive activity.

Such providers may process technical information necessary to provide their security services.

9. AI service providers

To generate roast analysis and related AI output, information associated with a submitted roast may be processed by AI infrastructure or model service providers acting on our behalf or supporting Service functionality.

We seek to limit information provided to what is reasonably necessary for the requested functionality.

Do not submit private, confidential or sensitive information that is not necessary to use Roastagram.

10. Service providers

We may disclose information to vendors that help us operate Roastagram, including providers of:

• cloud hosting;
• databases;
• authentication;
• payment processing;
• transactional email;
• security and anti-abuse;
• analytics;
• advertising measurement;
• AI inference;
• customer support;
• infrastructure monitoring.

These providers may process information subject to contractual terms and their respective legal obligations.

11. No sale for money

Roastagram does not sell personal information to third parties for monetary payment.

However, certain advertising or analytics disclosures may be considered a "sale," "sharing," targeted advertising or cross-context behavioral advertising under some privacy laws even where no money changes hands.

Where applicable law provides an opt-out right, Roastagram will honor applicable privacy choices through available consent/privacy controls.

12. Shared roast links

A user may choose to distribute a roast through a share link or share feature.

If a user shares such a link publicly, people with access to the link may be able to view the associated result.

Roastagram does not maintain a public Roast Wall or searchable public directory of all roast results.

If a shared result concerns you and you believe it should be removed, use the Report Abuse, Data Removal or Contact page.

13. Data retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, resolving disputes and complying with legal obligations.

Retention periods may vary by category.

Examples:

• account information may be retained while an account is active and for a limited period afterward where necessary;
• roast history may remain associated with an account until deleted or otherwise removed under applicable retention rules;
• transaction and accounting records may be retained for periods required by tax, accounting or legal obligations;
• security and diagnostic logs may be retained for a reasonable security/operational period;
• temporary pending-roast continuation information may expire automatically, including approximately 24 hours where the current product flow uses such a pending state;
• information associated with valid legal disputes or abuse investigations may be retained while reasonably necessary.

Deletion from active systems may not immediately remove information from disaster-recovery backups, which may expire through normal backup rotation.

14. Data deletion

Registered users may use available account, History or Data Removal functionality to delete certain Roastagram information.

Deleting a roast from your account should remove it from normal user-facing history subject to technical, legal and security exceptions.

Deleting an account may not require us to erase information we are legally permitted or required to retain, including:

• transaction records;
• fraud-prevention records;
• security logs;
• records required to establish or defend legal claims.

15. Your privacy rights

Depending on where you live and applicable law, you may have rights concerning your personal information, including rights to:

• access;
• obtain information about processing;
• correct inaccurate information;
• delete information;
• restrict processing;
• object to certain processing;
• data portability;
• withdraw consent;
• opt out of certain advertising-related processing;
• appeal certain privacy decisions;
• complain to a data-protection authority.

These rights are not absolute and may be subject to legal exceptions.

Requests may be submitted through the Contact or Data Removal page.

We may need to verify your identity before fulfilling a request.

16. European Economic Area and United Kingdom

Where the GDPR, UK GDPR or similar law applies, users may have rights including access, rectification, erasure, restriction, portability and objection.

Where processing relies on consent, consent may be withdrawn.

Where processing relies on legitimate interests, you may have the right to object in circumstances provided by law.

You may also lodge a complaint with the competent supervisory authority.

17. California and other U.S. state privacy rights

If a U.S. state privacy law applies to Roastagram and to you, you may have rights including:

• knowing/accessing certain personal information;
• deleting certain personal information;
• correcting inaccurate information;
• obtaining data portability;
• opting out of sale/sharing or targeted advertising where legally applicable;
• limiting certain uses of sensitive personal information where applicable;
• non-discrimination for exercising privacy rights.

We do not discriminate against users for exercising legally protected privacy rights.

Requests may be submitted through our Contact or Data Removal mechanisms and may be subject to verification.

Authorized agents may submit requests where permitted by applicable law and where required authorization is provided.

18. Children

Roastagram is intended for adults aged 18 or older.

We do not knowingly offer accounts or paid Roastagram services to children.

If you believe a child has provided personal information to Roastagram in violation of this Policy, contact us through the available Contact or Data Removal page.

19. International data transfers

Roastagram is operated by a U.S. company and uses service providers that may process information in the United States and other countries.

As a result, information may be transferred to jurisdictions with data-protection laws that differ from those in your country.

Where legally required, appropriate transfer mechanisms or safeguards will be used.

20. Security

We use reasonable administrative, technical and organizational measures designed to protect information against unauthorized access, loss, misuse or alteration.

However, no internet-connected service or method of electronic storage can be guaranteed to be completely secure.

You are responsible for maintaining the security of your own account credentials and devices.

21. Data breaches

If a security incident involving personal information occurs, we will investigate and provide notifications where required by applicable law.

22. Third-party websites

Roastagram may contain links to Instagram, Stripe or other third-party services.

We do not control the privacy practices of those third parties.

Their collection and processing of information is governed by their own policies.

23. Automated processing

Roastagram uses automated systems and artificial intelligence to generate entertainment-based roast analysis.

These outputs are not intended to make legal or similarly significant decisions about individuals.

Do not use Roastagram outputs as the basis for employment, credit, housing, insurance, education, medical, legal or similarly consequential decisions.

24. Do Not Track

Browser "Do Not Track" signals are not uniformly standardized.

Where required by applicable law, Roastagram will honor legally recognized opt-out preference signals to the extent applicable to the relevant processing.

25. Changes to this Privacy Policy

We may update this Privacy Policy as our Service, technologies or legal obligations change.

The current version and effective date will be displayed on this page.

Where required by law, we will provide additional notice or request consent for material changes.

26. Contact and privacy requests

Privacy questions, access/deletion requests, objections, abuse complaints and other privacy matters may be submitted through the Contact, Data Removal or Report Abuse pages available at roastagram.app.