# Roof Privacy Policy

**Policy version:** `roof-privacy-2026-11-07-r12`

**Prepared:** 2026-11-07

**Status:** Release candidate; not yet effective. Publication requires verification of provider arrangements and implementation of the retention rules below.

This Policy explains personal-data processing for the Roof app, its messaging server and related account, purchase, moderation and support services. It addresses users and people whose information is included in a message or report. The public website and independent services of Apple, Google and other providers have their own notices where they process data for their own purposes.

This is a privacy notice, not a request for blanket consent. Accepting the Terms does not waive privacy rights or authorize optional tracking. Separate consent is requested where the law requires it.

## 1. Controller and Contact

The controller is **Oliver Rüsenberg**, sole proprietor using **ORGate** as a business designation, not a separate company.

Postal address: **In der Gasse 10a, 90574 Rosstal, Germany**

Email for privacy requests, support and security reports: **info@orgate.net**

No separate data protection officer has been appointed. Oliver Rüsenberg is the controller and direct privacy contact; that role is not described as an independent data protection officer.

## 2. Data We Process

We obtain data from your entries and device, your selected identity and purchase providers, and other users who interact with you or submit reports:

- **Account:** stable account ID, username, optional profile email, preferred languages, creation/status information and feature entitlements. A profile email is not required for device registration and can be removed. Provider sign-in may separately supply an email, including an Apple relay address, and a display name.
- **Authentication:** device and credential IDs, public keys, signed challenges, provider name and subject ID, token verification data, sessions and expiry/revocation information. Device private keys remain on the device. We do not receive your Google or Apple password. A device identifier is personal data even without your real name.
- **Messages and neighborhoods:** text, sender ID/name, message ID/type, timestamps, stream, neighborhood name and code, membership, role and membership timing. A neighborhood is not based on collected GPS location.
- **Interactions:** reactions, counts, favorites, blocks, delivery/seen state and relevant timestamps. Delivery records support ordering and deduplication; they are not proof a person read a message.
- **Reports and support:** reporter and subject identifiers, reason, reported-message snapshot where available, relevant correspondence, attachments you choose to send, decisions and review information. A report can contain information received from someone other than you.
- **Purchases:** new Premium purchases are currently disabled in the app. Existing entitlement refresh or restore may still process app-user and store transaction identifiers, product, subscription status, purchase/renewal/expiry/refund events and entitlement information. RevenueCat and the stores also process relevant device, SDK and transaction data. If purchases are enabled in a later release, the store purchase flow will process the transaction and the then-current data will be described before activation. Roof does not collect payment-card numbers through its own payment form.
- **Operation and security:** IP addresses needed for network communication and potentially recorded in access/security logs, request timestamps and identifiers, technical client information, errors and delivery/performance diagnostics. Aggregate CPU or connection counts are different from identifiable request records.
- **Legal and deletion records:** each recorded Terms acceptance includes the account ID, request ID, accepted document versions and SHA-256 hashes, separate Terms acceptance, Privacy notice acknowledgment and age-declaration flags, and server time. If you submit the in-app withdrawal declaration, the server also records your account ID, request ID, name, declaration for the free Roof contract and receipt time. These server records are associated with the account and removed when it is deleted. A short-lived deletion-status proof hash has deletion and expiry timestamps but does not itself contain the former account ID, username or message content.

Roof does not request device location, contact lists or advertising identifiers and does not build behavioral advertising profiles. This does not mean that only an optional email is processed: the identifiers and messages above are also personal data. Do not submit passwords, payment details, government identification numbers, health data or similarly sensitive information. If such data is nevertheless submitted, it may be processed to deliver, assess or remove the content, subject to any additional legal conditions.

## 3. Purposes and Legal Bases

The following bases refer to Article 6(1) of the EU General Data Protection Regulation (GDPR):

| Purpose and data | Legal basis |
| --- | --- |
| Registration, authentication, sessions, account settings, requested messaging, memberships, reactions, favorites and blocks | Point (b): performance of the contract or steps you request before entering it, only where necessary for that purpose. |
| Refreshing/restoring existing Premium entitlements and, if enabled later, administering purchases; answering contractual support requests | Point (b); statutory accounting records under point (c) where applicable. New purchases are currently disabled in the app. |
| Securing accounts, preventing fraud/abuse, technical diagnostics, enforcing lawful content rules and handling non-contractual inquiries | Point (f): legitimate interests in a secure, reliable service, protecting users and responding to inquiries, balanced against affected people's rights. |
| Preventing a deleted account from evading an active moderation block with the same device or Apple/Google sign-in, using only one-way hashes of those identifiers | Point (f): legitimate interest in enforcing moderation decisions and protecting other users, limited to the remaining block period and at most two years. |
| Assessing illegal-content notices and complying with applicable orders or statutory reporting duties | Point (c), including applicable Digital Services Act duties; voluntary safety review and defense of claims under point (f). |
| Recording the applicable Terms, availability of the privacy notice and registration confirmation | Point (f): documenting the contractual relationship and providing accountability; point (c) only for a concrete applicable legal duty. This is not proof of consent to all processing. |
| Receiving and documenting a withdrawal declaration, confirming its receipt and completing requested account deletion | Point (b) to process your contractual declaration and deletion request; point (c) where a specific statutory duty applies; and point (f) to establish and document the declaration and receipt, balanced against your rights. |
| Displaying contextual promotions to free accounts using account tier and stream authorization | Point (f): financing the free service with non-personalized advertising, subject to your rights and any separate legal consent requirement. |
| Optional processing that legally requires consent | Point (a), only following a separate, specific request; you may withdraw that consent at any time. No such consent is inferred from using Roof. |

Account and authentication identifiers are necessary for an account; without them we cannot provide authenticated messaging. Message content and interaction data are needed only for the features you choose. Providing a profile email or sending support attachments is voluntary. Statutory disclosure requirements arise only where applicable, not from a general obligation to provide all requested data.

Sensitive data and information about alleged offences may require additional conditions under Articles 9 or 10 GDPR and national law. A general legitimate-interest statement does not replace those conditions.

## 4. Messages and Neighborhood Data

Other authorized Global users can receive Global posts with the sender's username. Neighborhood members receive posts according to their access rights; administrators see membership information needed for administration. Your profile email and authentication credentials are not published as part of an ordinary message.

Messages are processed in readable form by the Roof server. Transport protection is not end-to-end encryption. The operator can access retained content, accounts and reports through restricted administration tools for operation, support, security and moderation. These tools are not public access to the database.

Recipients can retain screenshots or other copies outside Roof. Server expiry and account deletion cannot erase those independent copies or force an already-running recipient app to forget its memory buffer. In-app hiding is not deletion from everyone else's device.

## 5. Providers and Recipients

The services used for the intended public release are:

- **Hetzner Online GmbH, Germany:** hosting of the Roof server and operator-managed backups in Germany; infrastructure processing on our behalf.
- **Zoho Mail:** delivery and storage of correspondence sent to info@orgate.net. Zoho operates the operator's own business mailbox and processes that correspondence as an independent controller for its mailbox service, not as a processor of app user data on our behalf. Its group and subprocessors may provide support from other countries; European hosting alone does not exclude international access.
- **Google and Apple:** authentication when you select their sign-in method, and store distribution, payment and subscription services when you use their stores. The relevant regional provider entities are identified in your provider account and purchase terms. They act independently for their own accounts, payments, fraud prevention and statutory duties.
- **RevenueCat, Inc., United States:** subscription and entitlement processing on our behalf, including app-user IDs, receipts/purchase tokens, purchase events and relevant device/SDK information. RevenueCat describes US hosting. Its subscription SDK is not our advertising network.
- **Authorities, courts and professional advisers:** only where necessary and legally permitted for a specific duty, investigation or claim, not routine unrestricted access.

For processing on our behalf, Article 28 GDPR requires appropriate processor agreements and controlled subprocessor access. Our ordinary promotions are sent by our own system; we do not provide advertisers with account lists or behavioral profiles. Opening an external advertiser link, if offered, connects you to an independently operated destination with its own privacy practices.

Provider notices: [Hetzner](https://www.hetzner.com/legal/privacy-policy/), [Zoho](https://www.zoho.com/privacy.html), [Google](https://policies.google.com/privacy), [Apple](https://www.apple.com/legal/privacy/), [RevenueCat](https://www.revenuecat.com/privacy/). These notices describe the providers' broader services; their optional website tracking is not automatically present in Roof.

### International Transfers

Our own app server and backups are in Germany, but this is not an EEA-only service: RevenueCat and provider group/support arrangements can involve the United States and other countries outside the European Economic Area. Users abroad also receive messages in their location.

Transfers subject to GDPR Chapter V require a valid basis: an applicable European Commission adequacy decision, or appropriate safeguards such as the Commission's Standard Contractual Clauses with the necessary assessment and supplementary measures. The EU-US Data Privacy Framework is applicable only to covered transfers to a currently certified recipient; US location alone is not sufficient. Registration is not consent to otherwise unlawful transfers. Contact info@orgate.net for the applicable recipient arrangements and a copy of safeguards, with necessary protection of confidential information.

## 6. Retention

The following is the retention schedule for this release candidate. It must be operational before this version takes effect; it is not a claim that an unverified test deployment already meets it.

| Data | Retention and deletion rule |
| --- | --- |
| Ordinary messages in active server history | At most six hours; earlier removal above 10,000 Global messages or 500 per neighborhood. Favorites do not extend retention. Selection windows do not create additional archives. |
| Administrative broadcast/promotion content and system content | Broadcast/promotion up to six hours and the configured priority capacity; system content up to two hours. Report/evidence exceptions below remain separate. |
| Recipient app message buffers | In memory, up to 200 per stream, until eviction or app-process termination; not a six-hour client timer and not persisted as message history across process restarts. |
| Active account/profile/authentication data, memberships and relationships | While needed for the account. Remove without undue delay when account deletion is confirmed, except specifically justified records below. Revoke access credentials as part of deletion. |
| Server access and ordinary security logs | Up to seven days from the event. Isolate necessary records for a concrete incident or legal claim rather than extending every log. |
| Support correspondence and reported-content cases | For handling and review, then up to 90 days after closure. Case snapshots are separate from ordinary message expiry. A lawful erasure request can require earlier deletion. In-app report records are removed seven days after the case is resolved; warning and system-block records are removed with the account, except for the block-evasion record below. |
| Block-evasion record after deleting a blocked account | If an account is deleted while a moderation block is active, we keep only one-way SHA-256 hashes of its device identifier and linked Apple/Google account identifiers, the record type, and creation/expiry times—no username, email, messages or report content. A new account, or an account to which a matching device or sign-in is linked, is blocked for the remaining period. The record expires when the block would have ended, at most two years after deletion, and is then deleted automatically. It is included in account-only backups under the 30-day backup rule. |
| Operator-controlled backups of account data | Account data and content-free security/replay records only, in rolling copies no more than 30 days old. Message content is never included in these backups, including ordinary, broadcast, promotion and system messages, delivery-outbox content and reported-message snapshots. Deleted account data can remain isolated until the copy expires; it is not used for ordinary service. Reapply deletions and reconcile security state before restored data becomes available. |
| Deletion-status recovery proof | Only the proof hash and deletion/expiry timestamps, for at most seven days. It cannot authenticate a user or recreate an account. |
| Pending-send recovery on the device | If the server's receipt of a message cannot be confirmed, the app stores that one message's text, stream identifier, request ID and timestamps in platform secure storage so you can review and resolve the uncertain send. The 24-hour limit applies to server confirmation/retry, not guaranteed deletion of the local record: if unresolved, it may remain until you review/discard it or remove the app's data. Account deletion is blocked until the pending send is resolved or discarded; after confirmed deletion its local record is cleared. Resolved or discarded records are deleted by the app, subject to device/OS storage behavior. This record is not part of server message history or account backup. |
| Terms acceptance and Privacy notice acknowledgment | An append-only event history while the account exists, containing request ID, document versions and SHA-256 hashes, separate Terms acceptance / Privacy acknowledgment / age-declaration flags, and server timestamp. Events are removed with account deletion. It is not identity-document or verified-age evidence. Current documents can be viewed in-app and at the public Website URLs; Roof does not email document copies. |
| Withdrawal declaration and acknowledgment | The account-linked server record contains request ID, consumer name, the declaration for the free Roof contract and server receipt time. One declaration per account/contract is retained. It is removed from the active account database by account deletion. An isolated approved account-only backup may retain it until that copy expires, under the 30-day backup limit; restored data must undergo deletion reconciliation before use. The app separately stores the receipt on the device under the immutable account ID so it remains accessible after deletion until app data is removed. Receipts for earlier accounts on the same device are retained separately. No withdrawal receipt is emailed. |
| Saved legal document copies | If you choose the app's separate “Save offline” action while viewing a legal document, the exact validated text, version, SHA-256 and local save time are stored on the device. Saving is optional, is not required for registration, and can be requested before or after account creation. Copies are for offline access and are not proof that an account was created or that a document was accepted. Copies are versioned, earlier versions are not overwritten, and they are not deleted with account-scoped preferences; they remain until app data is removed or the local copy is removed by the user or platform. |

Server backups use selective account-data exports, not full database, transaction-journal, volume or machine snapshots containing message storage. This rule applies to scheduled, manual and pre-migration backups. Message loss after a failure or restoration is accepted; message content is not recoverable from our account backups. Report cases retained for active handling under the separate rule above are not exempt from the message-content backup exclusion. Operator-controlled support exports must also exclude any copied Roof message content.

A database DELETE is not proof of immediate physical erasure of active storage pages, transaction journals or media. The six-hour rule for ordinary server history is not a guarantee that recipient copies, separately retained report evidence or every residual physical byte disappear at that exact time. Backup exclusions, existing-copy handling, rotation and physical-storage controls must be verified before this candidate policy takes effect.

The 30-day backup rule concerns copies controlled by us, not a promise about every provider's independent systems. Zoho mailbox recovery/backup arrangements and provider-side deletion must be verified for publication. Apple and Google may retain their own purchase records under their legal obligations. We instruct processors to delete data we control when it is no longer needed; deleting Roof does not delete your Apple or Google account.

Specific records may need longer retention to comply with statutory duties or establish, exercise or defend a concrete legal claim. For ordinary German civil claims, the regular limitation period is generally three years from the end of the relevant year, subject to statutory start, suspension and extension rules. Only necessary evidence is retained, with restricted access and periodic review, not the whole account by default. Tax/accounting documents follow the applicable record category and statutory period, commonly six, eight or ten years from the statutory start date. These periods do not justify keeping all messages. We can explain any applicable exception when handling your request, unless legally restricted.

## 7. Your Rights

Under the GDPR and subject to its conditions, you have rights of access and a copy (Article 15), correction (16), erasure (17), restriction (18), and portability of data you provided where automated processing is based on consent or contract (20). You can withdraw consent at any time without affecting processing lawfully performed before withdrawal. We communicate relevant corrections, erasure or restrictions to recipients where required by Article 19.

**Right to object:** Under Article 21(1), you may object on grounds relating to your particular situation to processing based on legitimate interests. We must stop unless we demonstrate compelling overriding grounds or processing is necessary for legal claims. **For direct marketing, you may object at any time without giving reasons, including related profiling; we then stop processing your personal data for that marketing.** Exercising this right does not require buying Premium.

Send requests to **info@orgate.net** or the postal address in section 1. We may request proportionate verification where there are reasonable doubts about identity, but do not require identity documents routinely. Requests are ordinarily free; only statutory exceptions permit a fee or refusal. We respond without undue delay and normally within one month. If complexity or the number of requests justifies an extension by up to two further months, we explain it within the first month. A refusal will include reasons and information on available remedies where required.

You may complain to a supervisory authority, particularly where you habitually reside, work or consider an infringement occurred, without contacting us first. The authority for private-sector controllers in Bavaria is the **Bavarian State Office for Data Protection Supervision (BayLDA)**, Promenade 18, 91522 Ansbach, Germany; [complaint information](https://www.lda.bayern.de/de/beschwerde.html).

Account deletion does not automatically cancel a store subscription. Cancel renewal with the store separately, without losing applicable rights against us. Additional mandatory rights under your local law are not excluded.

## 8. Children

Roof is intended only for people aged **18 or over** who can lawfully enter the contract. Registration asks for an age confirmation, not a full birth date or identity-document upload. This is a declaration, not verified proof of age. If you believe a minor has an account or has supplied data, contact **info@orgate.net**. We will assess and take appropriate action, including account closure and erasure where required. An age restriction does not remove duties to protect minors who may nevertheless access the service.

## 9. Security

Measures include HTTPS transport for the public API, signed device authentication, session and neighborhood authorization, restricted administrative access and bounded message storage. Device credentials are stored using platform secure-storage facilities; preferences and delivery identifiers have different storage purposes. Neither pseudonymous usernames nor these controls make the service anonymous or end-to-end encrypted.

No system guarantees absolute security. Report concerns to **info@orgate.net**, without sending private keys or passwords. Where a personal-data breach meets the GDPR notification thresholds, we notify the supervisory authority and affected people as legally required.

## 10. Cookies and Similar Technologies

Roof uses local storage for authentication, account caches, settings, legal copies you explicitly save offline, account-bound withdrawal receipts and minimal server/message identifiers that prevent repeat display of priority messages. Legal copies are not saved automatically during registration; the viewer has a separate “Save offline” action. Selecting it is a separate request to store that public document on this device for offline access; it is not acceptance of the Terms, consent to unrelated processing, or permission to store other content. These priority IDs contain no message body and can survive account deletion or account switching on the same installation. Appearance settings can also survive account changes. The current deduplication ledger has no automatic time expiry; device/app-data removal depends on platform behavior. Withdrawal receipts and explicitly saved legal copies remain on the device after account deletion until app data is removed; receipts remain associated with their original immutable account IDs. Separately, an uncertain pending send can contain its message text in platform secure storage beyond the 24-hour confirmation window until it is reviewed/discarded or app data is removed, as described in section 6. Contact us about data erasure rather than assuming account deletion erases every installation-level setting.

Storage or access strictly necessary for transmitting communications or supplying a digital service you expressly request is governed by the exceptions in section 25(2) TDDDG. Other device storage/access requires prior consent under section 25(1) where applicable, as well as a lawful basis for subsequent personal-data processing. Calling an SDK a billing tool does not automatically exempt all its telemetry.

Roof does not operate a separate behavioral advertising, cross-app tracking or third-party crash-analytics service. Subscription processing has its own technical records as described above. Promotions are selected by the operator, not by profiling message text or interests. Matching a promotion to your selected language is planned, not represented as already active in this version. Before activation we will explain the processing, applicable basis and controls. Your optional profile email is not used for unsolicited marketing newsletters.

Feed ordering, favorite protection, blocks, membership and Premium checks are automated feature rules. We do not use solely automated decisions producing legal or similarly significant effects within Article 22 GDPR; substantive moderation decisions are made manually. Technical access errors and moderation decisions can be raised with the operator.

## 11. Changes

We publish a new identifiable version when processing changes and provide appropriate notice before materially different processing begins. When the Terms or this Policy receive a new version, the app shows the current texts on your next sign-in or app start and asks you to accept the Terms and acknowledge this Policy again before you can continue posting; you can instead sign out or delete your account. If a new activity requires consent, a privacy-text update or continued use is not a substitute for obtaining it. Terms acceptance, acknowledgment of information and optional processing consent remain separate. A record of an earlier version is not retroactively treated as acknowledgment of a later text.

## 12. Contact

**Oliver Rüsenberg**, business designation **ORGate**

**In der Gasse 10a, 90574 Rosstal, Germany**

**info@orgate.net**