Privacy Policy

Roomie (“Roomie”, “we”, “us”) is operated by Company ERM AL-HADITH For Information Technology (One Partner), based in Riyadh, Saudi Arabia. This policy explains what information we collect when you use the Roomie app, how we use it, the legal bases we rely on, and the choices you have.

By using Roomie, you agree to this policy as part of our Terms of Service. Where we rely on your consent — for example, for your location, which you can turn off at any time — we ask for it separately, as explained in Our legal bases below.

Roomie is intended only for people aged 18 and over.

Our website and our app

Roomie has a website (roomie.cc) and a mobile app, and they collect different information.

Our website hosts our contact form (name, email, category, and message), our policy pages, an informational account-deletion page, a blog of read-only articles (which does not collect personal data), and — when available — a newsletter sign-up (your email). It also keeps standard hosting and security logs. The website does not read your device, and it does not collect your profile, location, or messages.
Our app is where we collect your in-service data: your profile, approximate location, messages, optional identity verification, referral attribution (including the one-time device check described under Referrals), and app-activity data.

Where a type of processing is specific to the website or the app, we say so below.

Information we collect

Account information. When you create an account, we collect your name and email address, and we assign you a user ID.

Date of birth. We collect and retain your full date of birth (and a derived age) when you register, to confirm that you meet our minimum age requirement of 18. Roomie is for adults only; under-18 registration is denied, and your date of birth is locked after you sign up.

Profile information. To match you with compatible roommates, we collect the details you add to your profile — your photo, your gender and the gender preference you set for roommates, the lifestyle preferences you choose to share (for example sleep schedule and tidiness), and any free-text bio you write. Roomie does not ask for sensitive details such as religion, health, ethnicity, or marital status. Please don’t include sensitive personal information in free-text fields like your bio; the profile details you choose to share are visible to other members.

Identity verification. Identity verification through our partner Didit is optional and offered after signup, in your settings, so you can earn a verified badge. It is not required to use Roomie, and it is not an age check (we confirm your age at signup from your date of birth). Verification uses Didit’s SDK to check an identity document, confirm liveness, and match your face to the document. Didit acts as our processor and carries out the biometric and liveness checks; Roomie does not store that biometric data — we keep only the verification result and status (the decision and a session reference), and Didit does not use this data to train its models on our users’ data (we have opted out). Before any data is sent to Didit, we ask for your explicit consent through a dedicated step; if you do not consent, verification does not proceed, and declining does not affect your use of Roomie. We keep a record of your consent, including when you gave it and the version of this Privacy Policy in force at the time. A verified badge confirms a member completed this process — it is not a guarantee of any member’s identity, character, intentions, or conduct. This processing may involve transfer outside the Kingdom (Didit’s Middle East contracting entity is based in the United States; see the International data transfers section).

Verification with Nafath. Members who hold a Saudi national ID or Iqama may be offered identity verification through Nafath, the Kingdom’s national digital identity platform (operated by Elm Company under SDAIA supervision). Where it is offered, you enter your ID number and approve the request in your own Nafath app, and we receive only the verification result. Your ID number is used only to initiate the Nafath request — we never store it and never record it in our logs. After verification, all we keep is that you are verified, the method used, and when — no identity-document data and no biometric data. Nafath verification is optional, and verification through Didit remains available for other IDs.

Location. With your permission, we collect your approximate (coarse) location only — never your precise location, and never in the background — to show you relevant matches and listings near you. Roomie stays fully usable if you choose not to share location. You can change this in your device settings at any time. During onboarding, your approximate coordinates may be sent to Google’s geocoding service (a third-party processor) to turn them into a city name.

Communications. We process the messages you send through the app, including any photos or files you share in a chat, so that the service works and to support safety and moderation.

Technical information. We collect device identifiers, app-interaction data, and crash logs to keep the app running, diagnose problems, and improve it. This includes signals about how features are used — such as contact-exchange outcomes, response times, and when profiles or listings are shown or seen — which we use to operate and improve matching and safety.

Saved listings. We store the listings you save or bookmark so you can find them again.

Contacting us and support. When you contact us, we collect and process the information you provide so we can respond to and manage your request. Through our website contact form, we collect your name, email address, the category you select, and your message. Through the in-app support form, we collect your message, the category you select, your email address, and your language/region preference (locale), and we link the request to your account using your account identifier so we can help you in the context of your account. We use this information only to respond to and manage your request and to improve our support. Submissions are stored securely and are accessible only to authorized support personnel, and we do not store your IP address when you submit these forms. We keep support and contact submissions for as long as needed to handle your request and for up to 12 months after it is resolved, after which they are deleted.

We do not collect payment information. Roomie is currently free to join and use.

Our legal bases

We only use your personal information when we have a lawful basis to do so. Under Saudi Arabia’s Personal Data Protection Law (PDPL) and, for users in the European Union, the GDPR, we rely on the following bases:

To provide the service — creating and managing your account, matching you with compatible roommates, and enabling in-app messaging. This is necessary to perform our agreement with you (our Terms of Service).
Our legitimate interests — keeping Roomie safe and trustworthy, reviewing reports, preventing fraud and abuse, and operating, maintaining, and improving the app. We rely on these interests in a way that respects your rights.
Your consent — for collecting your location and for optional identity verification. You can turn location off at any time in your device settings. Identity verification only takes place if you opt in through a dedicated consent step beforehand; if you do not consent, it does not proceed.
Legal obligation — where we must process information to comply with laws that apply to us.

How we use your information

We use your information to:

create and manage your account;
match you with compatible roommates and show relevant listings;
verify identities and support trust and safety, including reviewing reports and preventing abuse;
enable in-app messaging;
operate, maintain, and improve the app; and
comply with legal obligations.

How matching works

Roomie suggests potential roommates using automated processing of the lifestyle preferences and profile details you provide (for example sleep schedule and tidiness). You control these inputs and can change or remove them at any time in your profile. Matching produces suggestions to help you decide — it does not make binding decisions about you, and you always choose who to view, contact, or connect with.

Location on the map

How a listing’s location appears on the map depends on the kind of post:

A room you offer. When you create a listing to offer a room, you place its pin on the map yourself and you see exactly where it is. That location is shown publicly with your listing on the map, so people looking for a room can find it.
A place you’re seeking. When you post that you are looking for a room, we deliberately protect your location: before it is shared with anyone, we generalize it on our servers to the center of your city. Your precise location is never shared with other members and never leaves our systems.

This is in addition to the approximate device location described under Information we collect, which we use only to show you nearby matches and listings.

Reviews and reputation

When you connect with another member, you can leave and receive reviews. A review includes category ratings, a “would live again” indicator, and a short comment, and is attributed to you — it shows your name. Reviews build members’ reputation on Roomie and appear on profiles once they are revealed (we hold reviews under a double-blind process and show them only when both have been submitted or a set time has passed). Reviews are visible to other members — they are information you choose to share publicly within Roomie. Reviews can be reported, and we remove those that break our rules.

Badges and your avatar

Roomie may award badges and achievements that recognize how you take part in the community (see our Terms of Service for how they work). If you choose to display one of your badges on your avatar, that badge becomes visible to other members wherever your avatar appears — including a badge for an achievement that is not otherwise public. Displaying a badge is your choice, and you can change or remove it at any time.

We do not sell your personal information. We share it only in these situations:

With other users. The profile information you choose to display is visible to other members so they can decide whether you might be a good match. If you add a real-estate license number to your listing (or, for partner organizations, a FAL license number), it is shown publicly with the listing as you entered it.

With service providers. We use trusted providers to run Roomie — including Google Firebase / Google Cloud for hosting and backend infrastructure, Didit for identity verification, Resend for delivering our account, service, and referral reward emails, Zoho Mail for hosting our email mailboxes, and Cloudflare for DNS, content delivery, and network-layer security. They each process limited data on our behalf, under our instructions, and under agreements that require them to protect it. When Resend sends an email on our behalf, it receives the recipient’s email address and, for a referral reward, the gift-card code.

For legal and safety reasons. We may disclose information where required by law, to enforce our Terms, or to protect the rights, safety, and security of our users, the public, or Roomie.

Roomie lets two members exchange contact details — phone number and email — when they both agree: one member requests the exchange, and when the other accepts, both sets of details are revealed at the same time. We share your contact details with another member only on your instruction, through this mutual exchange.

Before both members agree, messages that contain contact details — such as phone numbers or email addresses — may be blocked. When that happens, we log a sanitized record of the event (the type of contact detail detected, never the message content) to support safety and prevent abuse.

Referrals and rewards

Roomie has a referral feature that lets you invite friends.

When you use it, we create a unique referral code for you (in the form ROOMIE- followed by a short string). The code is yours, stays the same, and is included in your invite link along with your first name only — so the person you invite can see who invited them. No other personal details travel in the link, and our website only displays your first name from the link; it does not store it from the link.

If someone joins through your invite, we record the referral relationship between the two accounts so we can attribute the referral and manage rewards. This information is internal — members are never shown who referred whom; it is visible only to our administrators. If you earn a referral reward, we send it to your email as a gift card (the email is delivered by our email provider, as described under How we share your information).

Checking whether you arrived through an invite (app only). To detect whether you came from a friend’s invite, the app checks for an invite code once — only the first time you open the app after installing:

On iOS, the app reads your device clipboard a single time, solely to look for an invite code (a ROOMIE- code). It does not otherwise read your clipboard, and any other clipboard content is ignored and discarded — only a matched code is kept.
On Android, the app uses Google’s Play Install Referrer to read the invite code passed through the install; only the invite code itself is kept.

The code is kept only briefly, to credit the referral, and is cleared from your device once the referral is attributed. These checks happen only in the app — our website never reads your device clipboard.

When you take part in our reward program, we record your progress toward a reward (such as your qualifying referrals or the approval of a listing you posted), our decision on whether to grant it, and the delivery of any reward to your account email. The rules that apply to any reward are set out in the rewards section of our Terms.

Link previews

When someone shares a link to an active listing, the listing’s public details — such as its title, first photo, area, and price — may appear in the link preview generated by the app or website that receives it. Inactive, hidden, or removed listings do not appear in these previews.

Roomie may offer an optional newsletter. If we do, you can subscribe only by an affirmative opt-in — a choice you actively make (for example, by ticking a box that is not pre-checked). It is never automatic and is not part of accepting our Terms. Our legal basis for sending it is your consent, and you can withdraw that consent at any time, using the unsubscribe link in every newsletter email or your in-app Email Preferences.

This is separate from the service emails we send to operate Roomie — such as account verification, password resets, and referral reward emails. Those are not marketing, and your newsletter choice does not affect them.

Notifications

Roomie sends service notifications to operate the app — for example, alerts about new matches and messages, updates about your reviews and achievements, account and security notices, and app-update prompts. You can control these notifications at any time through your device’s notification settings.

Separately, Roomie offers an optional email newsletter, which is covered above under Newsletter and marketing emails — you choose whether to receive it, and you can unsubscribe at any time.

Signing in with Apple or Google

You can create your account or sign in using your Apple or Google account. When you do, the provider shares certain information with us — your name and email address. Apple users can choose Hide My Email, in which case we receive a private relay address instead of your real one. If the email from the provider matches the email on an existing Roomie account, your sign-in is linked to that account. The provider’s own privacy terms apply to its part of the process. Email/password sign-up remains available.

International data transfers

Your personal data is processed and stored in the United States, where our infrastructure providers (Google Cloud/Firebase) and our identity-verification processor (Didit) operate. For users in the European Economic Area, transfers are covered by Google’s Cloud Data Processing Addendum and the EU Standard Contractual Clauses applied under it. We are a controller registered with the Saudi Data & AI Authority and apply appropriate safeguards to international transfers, including the data-protection commitments of our processors. We are finalizing additional transfer safeguards in accordance with the Personal Data Protection Law; this policy will be updated as those are completed.

Data retention and deletion

We keep your information only for as long as we need it, based on the type of data:

Account and profile data (name, email, user ID, photo, lifestyle preferences) — kept while your account is active. You can delete your account at any time from within the app. When you do, your account enters a 30-day recovery period and is then permanently deleted. Full details are on our Account Deletion page.
Messages and shared files — kept so the service works. After you delete your account, your past messages are anonymized — your identity is removed and you appear as “Deleted User” — so other members’ chat history stays intact without exposing your data.
Technical data and logs (device identifiers, app-interaction data, crash logs) — kept for limited periods, as described below.
Support and contact submissions — kept for as long as needed to handle your request and for up to 12 months after it is resolved, then deleted.

When you delete your data or your account, it is removed from our active systems promptly. Short, standard recovery windows apply at the infrastructure level before permanent deletion: deleted media (such as photos) may be recoverable for up to 7 days, and database records carry only brief internal version history. Operational logs are retained for up to 30 days, and certain security/audit logs for up to 400 days. Identity-verification data held by our processor, Didit, is retained for up to 1 month and then deleted.

When you delete your account, your personal data is removed or anonymized. Where information forms part of a record involving another member — such as referrals, reviews, matches, messages, or block lists — your identity is removed from that record while the anonymized record may be retained, so that the other member’s information and our ability to keep the service safe are preserved.

After deletion, we may retain limited information where necessary to comply with legal obligations, for security purposes, or to prevent fraud and abuse, in anonymized or aggregated form.

Your rights

Depending on where you live and subject to applicable law — including Saudi Arabia’s PDPL and, for EU users, the GDPR — you may have the right to:

access a copy of the personal information we hold about you;
correct information that is inaccurate or incomplete;
delete your personal information;
object to or restrict certain processing;
data portability — receive your information in a structured, commonly used format, or ask us to transfer it;
withdraw consent where we rely on it — for example, by turning location off in your settings; and
complain to the supervisory authority — in Saudi Arabia, the Saudi Data & AI Authority (SDAIA); in the EU, your local Data Protection Authority.

To exercise any of these rights, or to ask any privacy question, contact us at support@roomie.cc. We aim to respond within 30 days. We may need to verify your identity before acting on a request.

If there is a data breach

If a personal-data breach occurs that affects your information, we will notify the competent supervisory authority — and affected users where the breach is likely to create a high risk to them — as required by applicable law (including the PDPL and, for EU users, the GDPR).

Diagnostics and crash reports

If the app crashes or hits an error, we collect a crash report so we can find and fix the problem. A report contains technical information — the device model, operating system version, app version, what went wrong (the stack trace), and anonymous diagnostic notes about what the app was doing. Crash reports are not tied to your identity: we do not attach your account, email, or any identifier to them. They are processed for us by Google’s Firebase Crashlytics. Crash reporting is on by default, and you can turn it off at any time in the app (in the About section); your choice is remembered.

Security

We take reasonable technical and organizational measures to protect your information, and we restrict access to personal data. Messages can be read only by the participants in a conversation; your profile information and photos are owner-scoped, accessible only to you and to the members you choose to share them with on Roomie; and administrative access is limited to authorized personnel. No method of transmission or storage is completely secure, but we work to safeguard your data and limit access to it.

Children

Roomie is not directed to anyone under 18, and we do not knowingly collect personal information from minors. See our Child Safety page for our standards against child sexual abuse and exploitation. If you believe a minor is using Roomie, please contact us immediately.

Changes to this policy

This policy is versioned, and you accept it together with our Terms of Service and Community Guidelines as a single agreement. We may update it from time to time; for material changes we will ask you to accept the updated version again in the app, while minor changes take effect when posted. We also update the date above whenever we make changes.

Contact us

This Service is operated by Company ERM AL-HADITH For Information Technology (One Partner), Commercial Registration No. 1009154490, Riyadh, Kingdom of Saudi Arabia.

For privacy questions or to exercise your rights, contact our Data Protection Officer, Abdulaziz Alessa, at a.alessa@roomie.cc. We are registered with the Saudi Data & AI Authority (SDAIA) National Personal Data Protection Register, Registration No. 3260006969.