Privacy

The short version

• Without an account, your apartments are saved only in this browser.
• To work, the app sends some things to our server and to a few outside services: the address you type, the floor-plan image you upload, and the listing link you paste. Each service gets only what it needs. The AI service that reads floor-plan images is outside the United States (see below).
• We do not sell your data and we do not show it to other users.
• If you sign in, all apartments saved in this browser and their floor-plan images are copied to your account.

What we use, and who sees it

We share only what each service needs to do its job. We don't sell data.

• The address you type. It goes to our server. While you type, our server sends the text to Photon (an address search by komoot) to find matching addresses. When you pick one of its suggestions, we use the location Photon sent with it; nothing else is asked. Only if you choose “Search for what you typed” does our server send the address to the US Census address lookup service (a US government service) to find where it is. To find the buildings nearby, our server uses its own copy of Overture Maps building data; where that does not cover the area, it sends the location (not the address) to OpenStreetMap's Overpass service.
• The floor-plan (or site-plan) image you upload. It goes to our server and to an AI service that reads the walls, rooms and windows (by default DeepSeek). Our server deletes the image after it has been read, normally within minutes, and at the latest within a day. A record of the reading (the walls, rooms and windows the AI found, and the file name of your image, but not the image) is kept on our server for about 7 days, for everyone, so you can reopen the floor-plan check. Then it is deleted. A copy of the image stays in your browser so we can draw the sunlight on it.
• A photo of the building's outside, if you upload one to estimate window heights, goes to our server and the same AI service. Our server deletes it as soon as it has been read.
• A listing link you paste. Our server opens the listing website. It sends the page text to an AI service that pulls out the floor plan details (by default GLM, an AI language model, run by Fireworks AI), and floor-plan images from the page to the image AI service above.
• The map. Map pictures come from Stadia Maps. Your browser asks for them directly, so Stadia Maps sees your IP address (the number that identifies your internet connection) and which map area you look at.
• Where the AI services are. DeepSeek, which reads floor-plan images and building photos by default, is run from China, so your image is processed outside the United States. Fireworks AI, which reads listing text by default, is a company in the United States. We do not control how long these AI services keep what they receive; their own privacy policies decide that.
• Sign-in email. If you sign in with email, Resend sends the sign-in link to your address. If you sign in with Google, Google tells us your email address.
• Hosting and storage. Our server and databases run on Amazon Web Services in the eastern United States.
• Buying credits. You pay on a Stripe page. Your card details go only to Stripe; we never see or keep them. We record which credit pack you bought, the amount, the time and Stripe's payment number. Stripe keeps payment records as its own obligations require.

What we keep

• Without an account: the apartments you save, their floor-plan images and the map of the buildings are stored in your browser only. We do not keep them on our server. An apartment you have started but not saved is kept in this browser for up to 24 hours so you can come back to it, and a note that you just saved one for 24 hours. “Clear data on this device” removes all of these.
• With an account: your email address, the sign-in methods you used, and a copy of your saved apartments, their floor-plan images and the sunlight drawing settings. When you sign in, all apartments saved in this browser are copied to your account (up to 5). After that, changes you make are saved to your account automatically. There is no password.
• Credits: a record of your floor-plan reading credits: when each reading was used, and each purchase or adjustment. Besides the service itself, only the operator looks at your email, credits and the names and addresses of your saved apartments, and only to handle a support request such as a refund or a credit adjustment.
• You stay signed in for 30 days; after 30 days without use you need to sign in again.
• Account data is kept until you delete your account.
• For everyone: the record of each floor-plan reading (walls, rooms, windows and the image's file name, not the image) is kept for about 7 days, then deleted.

Cookies

Without an account we set one cookie, and only once you ask the AI to read a floor plan: sunshine-guest, a random number that counts how many free readings you have left. It is not linked to who you are, and it and its count are deleted after 180 days without use. Your apartments are kept in your browser's storage instead, which only this site in this browser can read.

When you sign in, the sign-in system sets these cookies. They are only for sign-in, never for ads or tracking:

• authjs.session-token: keeps you signed in. It lasts 30 days and is renewed while you use the app.
• authjs.csrf-token: protects the sign-in form from other websites. It is deleted when you close the browser.
• authjs.callback-url: remembers which page to bring you back to after sign-in. It is deleted when you close the browser.

On a secure (https) connection the names start with __Secure- or __Host-. While you sign in with Google, the sign-in system also sets a cookie for about 15 minutes to check that the answer really comes from Google.

How to delete your data

• Data in this browser: on the Account page, choose “Clear data on this device”. You can also remove a single apartment on the Compare page.
• Apartments in your account: when you are signed in, removing an apartment on the Compare page also removes it and its floor-plan image from your account.
• Your account: on the Account page, choose “Delete account”. This deletes the account, signs out every device and deletes the apartments and images saved in your account, along with your remaining credits (including purchased ones), right away. There is no undo. Data in your browser is not affected.

What we don't do

• We don't sell your data or use it for ads.
• We don't make public links or show your apartments to other users.
• We don't use your data to train AI models.

Contact

Roomlit is a beta project run by an individual developer. Questions about your data: email david996@bu.edu. See also the Terms.