<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width,initial-scale=1">
  <title>Privacy Policy — Roam · EU data-rights handling</title>
  <meta name="description" content="Roam's privacy policy: what data we collect, why, where it is stored, EU data-residency, GDPR rights, and how to exercise them. Plain language.">
  <link rel="canonical" href="https://roam-code.com/privacy">
  <meta property="og:title" content="Privacy Policy — Roam">
  <meta property="og:description" content="What data Roam collects, why, where it goes, and the EU data rights you can exercise.">
  <meta property="og:url" content="https://roam-code.com/privacy">
  <meta property="og:image" content="https://roam-code.com/og.png">
  <meta name="twitter:card" content="summary_large_image">
  <meta name="twitter:image" content="https://roam-code.com/og.png">

  <script type="application/ld+json">
  {
    "@context": "https://schema.org",
    "@type": "WebPage",
    "name": "Privacy Policy",
    "url": "https://roam-code.com/privacy",
    "inLanguage": "en",
    "dateModified": "2026-05-18",
    "isPartOf": {"@type": "WebSite", "name": "Roam", "url": "https://roam-code.com/"},
    "publisher": {"@type": "Organization", "name": "Cranot", "url": "https://github.com/Cranot"},
    "breadcrumb": {
      "@type": "BreadcrumbList",
      "itemListElement": [
        {"@type": "ListItem", "position": 1, "name": "Home", "item": "https://roam-code.com/"},
        {"@type": "ListItem", "position": 2, "name": "Privacy", "item": "https://roam-code.com/privacy"}
      ]
    }
  }
  </script>
  <link rel="icon" type="image/svg+xml" href="/favicon.svg">
  <meta name="theme-color" content="#0049b7">
  <meta name="apple-mobile-web-app-title" content="Roam">
  <link rel="apple-touch-icon" href="/favicon.svg">
  <link rel="manifest" href="/manifest.webmanifest">
  <link rel="preload" href="/fonts/space-grotesk-variable.woff2" as="font" type="font/woff2" crossorigin>
  <link rel="preconnect" href="//github.com" crossorigin>
  <link rel="preconnect" href="//pypi.org" crossorigin>
  <link rel="preload" href="./landing.css" as="style">
  <link rel="stylesheet" href="./landing.css">
  <meta name="robots" content="index,follow">
</head>
<body>

  <a class="skip-link" href="#main">Skip to content</a>

  <nav class="site-nav" aria-label="Main navigation">
    <div class="nav-inner">
      <a href="/" class="site-logo">roam<span class="logo-dot">.</span></a>
      <input type="checkbox" id="nav-toggle" class="nav-toggle-checkbox" aria-label="Toggle navigation menu">
      <label for="nav-toggle" class="nav-toggle-label">
        <span class="nav-burger" aria-hidden="true"></span>
        <span class="visually-hidden">Menu</span>
      </label>
      <ul class="nav-links">
        <li><a href="/">Home</a></li>
        <li><a href="/pricing">Pricing</a></li>
        <li><a href="/compare">Compare</a></li>
        <li><a href="/setup">Setup</a></li>
        <li><a href="/docs/">Docs</a></li>
        <li><a href="https://github.com/Cranot/roam-code">GitHub</a></li>
      </ul>
    </div>
  </nav>

  <main id="main" class="legal-page">
    <header class="legal-header">
      <h1>Privacy Policy</h1>
      <p class="legal-meta">Last updated: <time datetime="2026-05-18">2026-05-18</time> · Effective: <time datetime="2026-05-18">2026-05-18</time></p>
    </header>

    <article>
      <p>
        This page explains what data we collect, why, where it goes, how long we
        keep it, and what rights you have. It applies to <strong>roam-code.com</strong>
        and paid or early-access Roam services when enabled (PR Replay,
        planned Roam Review and Cloud, and private-deployment pilots). It
        does not apply to the open-source CLI when run locally — that runs
        entirely on your machine and sends nothing to us.
      </p>

      <h2>1. Who we are</h2>
      <p>
        The data controller is <strong>Cranot (Dimitris)</strong>, a sole-trader
        operating from Athens, Greece.
      </p>
      <p>
        Contact: <a href="mailto:hello@roam-code.com">hello@roam-code.com</a><br>
        Privacy + data-subject requests: <a href="mailto:hello@roam-code.com?subject=Privacy%20request">hello@roam-code.com</a><br>
        Security disclosures: <a href="mailto:security@roam-code.com">security@roam-code.com</a>
      </p>

      <h2>2. What runs locally vs. what touches our servers</h2>
      <p>
        The <strong>open-source CLI</strong> (<code>roam-code</code> on PyPI)
        is <strong>100% local, no API key, no vendor cloud endpoint</strong>.
        It writes a SQLite file inside your repo's <code>.roam/</code>
        directory. <strong>It does not phone home, send telemetry, or
        transmit any source code.</strong> No data crosses the network. The
        same local-only stance is contractually committed in
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md#6-security-measures">DPA §6</a>.
      </p>
      <p>The paid services collect different things, listed below.</p>

      <h2>3. What this website (roam-code.com) collects</h2>
      <ul>
        <li>
          <strong><a href="/no-cookies">No analytics, no cookies, no tracking pixels.</a></strong>
          We don't run Google Analytics, Plausible, PostHog, or any
          equivalent. The page sets no first-party cookies.
        </li>
        <li>
          <strong>Standard server logs</strong> via Cloudflare (IP address,
          User-Agent, requested path, timestamp, response code). Retained
          for 30 days for security + abuse-prevention purposes. Legal basis:
          legitimate interest (GDPR Art. 6(1)(f)) — operating a website
          securely.
        </li>
        <li>
          <strong>Email contents you send us</strong> at hello@ or security@.
          We retain these as long as the conversation is operationally
          relevant, then delete. Legal basis: contract performance or
          legitimate interest, depending on the message.
        </li>
      </ul>

      <h2>4. What Roam Cloud collects (planned paid SaaS)</h2>
      <ul>
        <li>
          <strong>Metrics only.</strong> Health scores, complexity numbers,
          dependency counts, language breakdown, file-role counts, repo size.
          <strong>Never the source code itself.</strong>
        </li>
        <li>
          <strong>Account data.</strong> Email, name, organisation name,
          subscription tier. Provided by you at signup.
        </li>
        <li>
          <strong>Billing data.</strong> Handled by Stripe under their privacy
          policy. We see card-brand, last 4 digits, billing country — not the
          full card number.
        </li>
      </ul>
      <p>Legal basis: performance of the contract you signed by subscribing.</p>

      <h2>5. What Roam Review collects (planned paid GitHub App)</h2>
      <ul>
        <li>
          <strong>Pull-request diffs</strong> are processed ephemerally in our
          cloud when the service is enabled. Private-deployment pilots are
          scoped separately when hosted processing is blocked by policy.
          Diffs are held in memory for the duration of the analysis, then
          discarded.
        </li>
        <li>
          <strong>Repository metadata</strong> required to post comments back
          (repo name, PR number, commit SHA, author).
        </li>
        <li>
          <strong>GitHub installation token</strong> stored encrypted at rest,
          revocable by uninstalling the App.
        </li>
      </ul>
      <p>
        Legal basis: performance of the contract. Roam Review does <strong>not</strong>
        retain source code after analysis. The audit-trail JSONL Roam emits
        contains metadata (verdict, finding count, confidence) — never the
        diff text.
      </p>

      <h2 id="sub-processors">6. Sub-processors</h2>
      <p>
        The canonical sub-processor list with location, processing purpose,
        and transfer basis is in
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md#5-sub-processors">DPA §5</a>.
        At the effective date above:
      </p>
      <ul>
        <li><strong>Stripe, Inc.</strong> (USA) — payment processing, receipts, refunds, billing records. Billing-contact and transaction metadata only; no source code. Transfer basis: Stripe SCCs where applicable. <a href="https://stripe.com/privacy">privacy policy</a></li>
        <li><strong>GitHub, Inc.</strong> (USA / global) — for PR Replay only when Controller chooses GitHub collaborator, deploy-key, GitHub App, or webhook access; for the planned Roam Review GitHub App, the auth + comment-posting layer. Transfer basis: GitHub SCCs where applicable. <a href="https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement">privacy policy</a></li>
        <li><strong>Cloudflare</strong> (US/EU) — DNS, CDN, edge compute, and standard server logs for the public website at <code>roam-code.com</code>. No source code, no customer data. <a href="https://www.cloudflare.com/privacypolicy/">privacy policy</a></li>
        <li><strong>Hosting provider</strong> for Roam Cloud + Roam Review backend — <em>[TBD: HOSTING_PROVIDER]</em> (EU-based; to be selected and disclosed before paid general availability; named in the DPA at GA). During early access there is no production backend processing customer data, and PR Replay v1 has no hosted sub-processor for analysis (the CLI is local-only).</li>
      </ul>
      <p>
        New sub-processors are added with at least <strong>14 calendar days'</strong>
        prior notice, unless emergency replacement is necessary to maintain
        security or service continuity, per
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md#5-sub-processors">DPA §5</a>.
        Controllers may object on reasonable data-protection grounds; if the
        objection cannot be resolved, the affected service may be terminated
        with any refund required by the Agreement.
      </p>

      <h2>7. International transfers + edge caching</h2>
      <p>
        Some sub-processors are US-based (Cloudflare, Stripe, GitHub). The
        Processor's primary PR Replay processing location is Greece (EU)
        per
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md#11-cross-border-transfers">DPA §11</a>.
        Where personal data is transferred outside the EEA, transfers happen
        under an applicable GDPR Chapter V safeguard — typically the EU
        Standard Contractual Clauses (2021/914), an adequacy decision, or the
        EU-US Data Privacy Framework. We do not transfer source code outside
        the EEA from the CLI (it stays local) or from Roam Cloud (metrics
        only).
      </p>
      <p>
        The static site at <code>roam-code.com</code> is served from
        Cloudflare's global edge network; cached copies of the public HTML may
        exist at any Cloudflare POP worldwide. No personal data is processed by
        the static site itself — only the standard server logs listed above.
      </p>

      <h2>8. Retention</h2>
      <p>Website + paid-service retention windows:</p>
      <ul>
        <li>Server logs: 30 days</li>
        <li>Email correspondence: as long as operationally relevant, then deleted on a 12-month rolling basis</li>
        <li>Account data: until account deletion + 30 days for backup expiry</li>
        <li>Billing records: 7 years (Greek tax law requirement)</li>
        <li>Audit-trail records (Roam Review, when enabled): 1 year by default; private-deployment pilot retention follows the order form</li>
      </ul>
      <p>
        PR Replay-specific retention is set by
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md#7-return-deletion-and-retention">DPA §7</a>:
      </p>
      <ul>
        <li>Temporary repository clones, git bundles, indexes, and derivative working files: deleted within <strong>7 calendar days</strong> after report delivery or service termination (deletion confirmation available on request).</li>
        <li>Final delivered report: retained up to <strong>90 days</strong> for follow-up questions, unless earlier deletion is requested.</li>
        <li>Engagement ledger entries: retained up to <strong>2 years</strong> for audit defence, reconciliation, and dispute handling.</li>
        <li>Anonymised aggregate product metrics: retained only where no client, repo, contributor, code, identifier, or quote can be reconstructed.</li>
      </ul>

      <h2>9. Your rights</h2>
      <p>
        Under the GDPR (Articles 15-22) you have the right to:
      </p>
      <ul>
        <li>Access the personal data we hold about you (Art. 15)</li>
        <li>Have inaccurate data rectified (Art. 16)</li>
        <li>Have data erased — "right to be forgotten" (Art. 17)</li>
        <li>Restrict processing (Art. 18)</li>
        <li>Receive your data in a portable format (Art. 20)</li>
        <li>Object to processing based on legitimate interest (Art. 21)</li>
        <li>Not be subject to a decision based solely on automated processing (Art. 22)</li>
        <li>Withdraw consent (for any processing based on consent)</li>
        <li>Lodge a complaint with your local data protection authority. In Greece, that's the Hellenic Data Protection Authority (search the <a href="https://www.edpb.europa.eu/about-edpb/about-edpb/members_en">EDPB members directory</a> for current contact details).</li>
      </ul>
      <p>
        When Roam processes personal data on a customer's behalf under the
        paid services, we act as the GDPR Article 28 processor under the
        <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md">Data Processing Agreement</a>;
        the customer is the controller and is the primary point of contact
        for data-subject requests in that flow. For requests about data we
        hold as a controller (website logs, paid-tier accounts, support
        correspondence), email
        <a href="mailto:hello@roam-code.com?subject=GDPR%20request">hello@roam-code.com</a>.
        We respond within 30 days.
      </p>

      <h2>10. Automated decision-making</h2>
      <p>
        Roam analyses code and emits findings. None of those findings result in
        a legal or similarly significant decision about you as an individual.
        We do not engage in profiling or automated decision-making within the
        meaning of GDPR Art. 22.
      </p>

      <h2>11. Children</h2>
      <p>
        Roam is a developer tool not directed at children under 16. We do not
        knowingly collect data from children.
      </p>

      <h2>12. Changes to this policy</h2>
      <p>
        Material changes will be announced at least 30 days in advance to
        active subscribers. The effective date at the top of this page tracks
        the latest version.
      </p>

      <h2>13. Related documents</h2>
      <ul>
        <li><a href="/trust">Trust &amp; compliance posture</a> — procurement-overview companion to this page (framework status, sub-processor list, security contact, vulnerability disclosure, data-flow diagram).</li>
        <li><a href="/security">Security policy</a> — threat model, secure-coding posture, vulnerability disclosure terms, PGP key.</li>
        <li><a href="/terms">Terms of Service</a> — paid-service contract terms.</li>
        <li><a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md">Data Processing Agreement (DPA)</a> — GDPR Article 28 processor agreement for paid engagements.</li>
        <li><a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/sow-pr-replay.md">PR Replay Statement of Work</a> — incorporates the DPA by reference.</li>
        <li><a href="https://github.com/Cranot/roam-code">GitHub source</a> — the Apache 2.0 CLI that produces every evidence artifact.</li>
      </ul>

      <p class="legal-foot">
        Questions? <a href="mailto:hello@roam-code.com">hello@roam-code.com</a>.
      </p>
    </article>
  </main>

  <footer>
    <div class="footer-inner">
      <div class="footer-col">
        <strong>Roam</strong>
        <span>The local codebase intelligence layer for AI agents and the teams that run them.</span>
        <span class="footer-meta">Built in Athens. Made in the EU.</span>
      </div>
      <div class="footer-col">
        <a href="https://github.com/Cranot/roam-code">GitHub</a>
        <a href="https://pypi.org/project/roam-code/">PyPI</a>
        <a href="/docs/">Docs</a>
      </div>
      <div class="footer-col">
        <a href="/setup">Setup</a>
        <a href="/about">About</a>
        <a href="/press">Press</a>
        <a href="/changelog">Changelog</a>
        <a href="/status">Status</a>
        <a href="/security">Security</a>
        <a href="/accessibility">Accessibility</a>
      </div>
      <div class="footer-col">
        <a href="/privacy">Privacy</a>
        <a href="/terms">Terms</a>
        <a href="/refund">Refund</a>
        <a href="/no-cookies">No cookies</a>
      </div>
      <div class="footer-col">
        <a href="mailto:hello@roam-code.com">hello@roam-code.com</a>
        <a href="mailto:security@roam-code.com">security@roam-code.com</a>
        <span class="footer-meta">No cookies. No tracking. No analytics.</span>
        <span class="footer-meta"><a href="https://github.com/Cranot/roam-code/tree/main/templates/distribution/landing-page">This page is open source</a></span>
      </div>
    </div>
  </footer>

</body>
</html>
