Privacy

Last updated: 18 October 2026. Operator: Roami (https://roami.xyz), built by Aaghran Ghosh. Contact: hello@roami.xyz.

This policy covers the Roami product (app.roami.xyz and related APIs), the marketing site (roami.xyz), and MCP connections at mcp.roami.xyz. It is written in plain language for a beta product. It is not a substitute for legal advice.

What we collect

• Account. Email and authentication data when you sign up or sign in (via Supabase Auth). Profile details you choose to provide.
• Content. Posts, drafts, ideas, media, tags, places, social drafts, affiliate records, and other data you create or import into your Roami project.
• Search Console. If you connect Google Search Console, we store tokens needed to sync and the performance data we pull for your project (queries, pages, clicks, impressions, and related metrics).
• Agent access. OAuth sessions and API keys you create so Claude, Cursor, Gemini, or your own tools can call Roami. Keys are project-scoped; agents cannot publish or schedule posts.
• Usage and ops. Request logs, error reports, and technical metadata needed to run and secure the service (IP, user agent, timestamps).
• Marketing site. Standard server logs. If Google Tag Manager is configured, analytics events may be collected under Google's terms.
• Free blog audit (/try). The domain you enter and publicly readable pages we fetch for the peek. No account is required for that flow.

How we use it

• Provide the CMS, syncs, audits, drafts, and agent tools you ask for.
• Authenticate you, enforce the publish gate, and scope agents to your project.
• Operate, debug, and improve reliability and security.
• Communicate about the beta, outages, and (later) billing — when relevant.

We do not sell your personal data. We do not use your blog content or Search Console data to train Roami's own foundation models. When you connect an external AI agent, that agent's provider may process prompts and content under their terms — that is outside Roami's control.

Who processes data for us

• Supabase — authentication and database hosting.
• Our application hosting — servers that run the Roami API, app, MCP, and marketing site (currently on Oracle Cloud infrastructure we operate).
• Google — if you connect Search Console (OAuth and Search Console APIs); and analytics if GTM is enabled on the marketing site.
• Your chosen AI apps — Claude, Cursor, Gemini, or others you connect via MCP or API keys. They receive whatever the connection and your prompts allow.

OAuth scopes

Google Search Console access is used only to sync search performance for projects you connect. Roami sign-in for agents uses OAuth so tools can act as you within the publish and edit rules described on Security and the publish gate.

Retention and deletion

We keep account and project data while your account is active. You can delete content inside the product. To close an account or request export/deletion of personal data we hold, email hello@roami.xyz. We will respond within a reasonable time for a solo-operated beta. Backups and logs may persist for a limited period after deletion for security and recovery.

Cookies and similar tech

Sign-in sessions use cookies or equivalent storage required to keep you logged in. The marketing site may use analytics cookies if GTM is configured. You can block non-essential cookies in your browser; the product may not work without session cookies.

Children

Roami is not directed at children under 16. Do not create an account for them.

International use

Roami is operated from India. Data may be processed in the regions where our providers host infrastructure. If that is not acceptable for your situation, do not use the service.

Changes

We may update this page as the product changes. The date at the top will change when we do. Material changes for signed-in users will be called out by email or in-app notice when practical.

Contact

Privacy questions and requests: hello@roami.xyz. Related: Security, Terms.