Privacy Policy

Last updated: September 1, 2026

The short version

• Calm, Sharp, Savage, and the "Make it sendable" rewrite run entirely on your device using Apple's Foundation Models framework. That text never leaves your iPhone, iPad, Mac, or Apple Watch.
• Vent and Feral private drafts route through a developer-owned cloud proxy by default, because Apple's on-device model is too gentle to produce real venting. The situation text you type, the chosen intensity, the locale, and an opaque per-install device UUID are sent to our Cloudflare Worker, which forwards them to a third-party LLM provider for inference. You can turn this off in Settings → AI & Privacy → Stronger Vent / Feral (Cloud AI) to keep everything local.
• Our proxy does not store a copy of your text. Upstream LLM providers may temporarily retain requests under their own policies.
• Sign in with Apple is optional. If you choose to sign in, your Apple User ID is stored in your device's Keychain.
• No analytics, no tracking, no advertising identifiers, no device fingerprinting.

1. On-device generation (Calm / Sharp / Savage / Rewrite)

For these intensities, the text you write is sent to Apple's Foundation Models framework, which runs the AI model on your device's CPU/GPU/Neural Engine. No part of that text is transmitted to RoastMate AI or to any third party. These paths work in Airplane Mode.

Generated responses are stored on your device in a SwiftData store, and — if you are signed in to iCloud — mirrored to your own private iCloud database (see section 3). You can clear this history at any time from Settings → Clear sample data or by deleting individual entries.

1a. Cloud generation (Vent / Feral)

By default, when you choose the Vent or Feral intensity, the app sends the following to a Cloudflare Worker we operate: the situation text you typed, the chosen intensity (vent or feral), the style name, your UI locale, and an opaque per-install UUID used only to enforce a per-device daily rate limit. The Worker builds the prompt server-side and forwards the request to a third-party LLM provider (currently Groq, with OpenRouter as a fallback; we may change providers in the future without further notice).

Our Worker does not retain a copy of your request text or the generated response — it stores only a per-device daily counter that expires automatically. The upstream LLM providers each have their own privacy policies; in summary they do not retain customer prompts long-term but may retain them temporarily (typically up to 30 days) for reliability, abuse-prevention, or compliance purposes. If this is unacceptable to you, disable cloud routing in Settings → AI & Privacy → Stronger Vent / Feral (Cloud AI); the app will then generate Vent / Feral locally on Apple's on-device model (with gentler output).

2. Sign in with Apple (optional)

You can use RoastMate AI fully without signing in. If you choose to sign in with Apple:

• Apple provides us a stable, app-specific user identifier and, optionally, a name and email (real or relayed).
• We store the user identifier in your device's Keychain. We do not transmit it off the device.
• The name you share is displayed in the app's Account screen and may be synced to your other Apple devices via iCloud. It is never shared with us.
• You can sign out at any time from Settings → Account → Sign Out. Your local data and iCloud-synced data remain.

3. iCloud sync

If you are signed in to iCloud, your history syncs across your devices through your own private iCloud database (CloudKit container iCloud.yyh.roastmate.app). To be explicit about what that covers, because the wording here used to be vaguer than it should have been: it includes your roast history and your private Vent and Feral drafts, along with threads, saved situations, settings, and credit-ledger entries.

This is your iCloud storage, not ours. The sync uses Apple's infrastructure; we do not operate, and cannot access, any server that holds this content, and none of it is ever sent to us. There is no in-app switch for it — it follows your device's iCloud state. Signing out of iCloud, or turning off iCloud Drive for RoastMate AI in iOS Settings → [Your Name] → iCloud, stops it.

4. App Store Connect "Privacy Nutrition Label"

The data types we collect, as defined by Apple's framework:

• Other User Content — the situation text you type, when you use the Vent or Feral cloud path. Purpose: App Functionality. Linked to user: No. Used for tracking: No.
• Device ID — an opaque per-install UUID sent with Vent / Feral cloud requests for rate limiting. Purpose: App Functionality. Linked to user: No. Used for tracking: No.
• User ID — when you sign in with Apple. Purpose: App Functionality. Linked to user: Yes. Used for tracking: No.
• Name — only if you choose to share it during Sign in with Apple. Purpose: App Functionality. Linked to user: Yes. Used for tracking: No.
• Purchases — if you subscribe to Pro, the app sends the Apple-signed StoreKit transaction receipt to our Cloudflare Worker so it can confirm the subscription is genuine and grant the higher cloud quota. It identifies the transaction only; it carries no name, email, or payment details. Purpose: App Functionality. Linked to user: No. Used for tracking: No.

We do not collect: location, financial info, health & fitness, sensitive info, contacts, search history, browsing history, identifiers beyond those listed above, usage analytics, advertising IDs, or any content beyond the Vent / Feral request you explicitly send to the cloud (which you can disable).

5. Third parties

RoastMate AI integrates no analytics SDK and no advertising SDK. For the Vent / Feral cloud path, the request is proxied through Cloudflare (our Worker host) and forwarded to a third-party LLM inference provider (currently Groq; OpenRouter as fallback). Apple's iCloud (CloudKit) is used only if you enable iCloud sync. No other third parties are involved.

6. Children

RoastMate AI is rated 17+/18+ (IARC) for mature humor and sarcasm. It is not intended for children under 17.

7. Your rights

Our cloud proxy does not retain a copy of Vent / Feral request text, so there is no historical content stored at us to access, export, or delete; the per-device rate-limit counter expires automatically within about 48 hours. All in-app data can be deleted by clearing the app's history or uninstalling the app. To stop all cloud routing, disable Settings → AI & Privacy → Stronger Vent / Feral (Cloud AI).

8. Changes

If we change this policy, we'll update the "Last updated" date above and revise the in-app About screen accordingly.

9. Contact

Questions? Email yyyyy.yeyuhe@icloud.com.