Privacy policy

roomshot (Singapore) runs roomshot. This page explains what we collect and why. It follows Singapore's Personal Data Protection Act (PDPA) and the EU GDPR basics.

What we collect

• Your email address, to sign you in.
• The images you upload and the mockups we make from them.
• Your credit balance and purchase history. Card details go to Stripe; we never see them.
• Basic server logs (time, page, error codes) to keep the service secure. Logs do not include your email.

We remove location and camera data (EXIF/GPS) from every upload before storing it.

Why we use it

Only to run roomshot: sign-in, making your mockups, billing, and preventing abuse. We don't sell your data and don't use your artwork to train AI models.

Who processes it for us

• Supabase: sign-in and database
• Cloudflare R2: file storage
• Cloudflare Turnstile: bot check on sign-in (reads browser signals, not your email)
• Stripe: payments
• Railway: hosting

Cookies

We use one sign-in cookie, which is needed for the app to work. No advertising or tracking cookies.

How long we keep it

Until you delete your account. Deleting your account in Settings removes your uploads, mockups, credits and sign-in. Payment records stay with Stripe as tax law requires.

Your rights

You can ask to see, correct or delete your data, or withdraw consent. We reply within 30 days.

Security

Files are private and only reachable through short-lived links after we check you own them. Data is encrypted in transit.