Room for TwoGet the app

Legal

Privacy Policy

Effective: 2026-09-28 · Last updated: 2026-09-28

This Privacy Policy explains how Mykola Sereda ("we", "us", "our"), operating the Room for Two mobile application and website (together, the "Service"), collects, uses, discloses, and protects information about you when you use the Service. Please read it carefully. If you do not agree with it, do not use the Service.

The controller is established in the Republic of Cyprus, an EU Member State. We comply with the EU General Data Protection Regulation ("GDPR"), the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data (Law 125(I)/2018), the UK GDPR where the Service is offered to UK residents, and the California Consumer Privacy Act ("CCPA/CPRA") where applicable. Where a specific jurisdiction grants you rights beyond those described here, those rights continue to apply.

1. Data controller

The controller responsible for your personal data is Mykola Sereda, a solo developer operating the Service. You can contact us at nickolaysereda@gmail.com for any privacy-related question, request, or complaint.

We have not appointed a Data Protection Officer because we are not legally required to do so. All privacy inquiries are handled directly by the controller.

2. Scope

This Policy applies to personal data we process about you when you (a) visit https://roomfortwo.org, (b) install or use the Room for Two mobile application, or (c) communicate with us (e.g., by email). It does not apply to third-party websites, apps, or services that we link to but do not operate.

3. Personal data we collect

We collect only what we need to run the Service. Categories include:

  • Account data — the email address, display name, and (optional) avatar preset you provide when you create an account; a unique account identifier we generate. We do not host or store user-uploaded profile photos.
  • Room and content data — the six-character invite code for your room; the identity of your paired partner; the answers, prompts, thread messages, reactions, reflections, memories, and any other content you or your partner post inside your private room. This content is stored so that it can be shown back to the two of you.
  • Special-category / sensitive information (Art. 9 GDPR) — the Service is designed for you to write freely about your relationship, feelings, memories, or beliefs. To the extent anything you voluntarily write qualifies as a special category of personal data (e.g., data revealing sex life, political opinions, religious beliefs, or health), we process it on the basis of your explicit consent given by continuing to use the Service after being informed of this processing (see §6 for legal bases).
  • Device data — a push-notification registration token (issued by Apple Push Notification service or Firebase Cloud Messaging) so we can deliver notifications you have opted into, and the time zone your device reports so we can align the daily session to your local day. Our backend also stores connection-level data (e.g., IP address in server logs) for the short period necessary to route requests and detect abuse.
  • Support data — the content of any message you send us, including your contact details.

The current version of the Service does not include any advertising SDKs, third-party analytics SDKs, third-party crash-reporting SDKs, in-app purchases, or subscriptions. If we add any of these in a future release, we will update this Policy and notify you as described in §17.

4. Sources of your personal data

We obtain personal data directly from you when you use the Service. We also receive limited information about you from your partner — for example, they may invite you to a room by sending you a code, or their content in your shared room may reference you. Device data comes from your device and browser.

5. How we use your personal data

We use your personal data to:

  • Create and manage your account, and authenticate you.
  • Sync your room across your devices and your partner's devices.
  • Deliver the daily session and unlock sealed answers when both partners have replied.
  • Personalise session content and generate short reflections in threads using a third-party AI provider (see §11).
  • Send you essential service notifications you opt into.
  • Detect, prevent, and address abuse, fraud, or security incidents.
  • Improve reliability, performance, and features.
  • Comply with our legal, regulatory, and tax obligations.
  • Respond to your questions, requests, and legal claims.

6. Legal bases for processing (GDPR Art. 6 & 9)

We rely on the following legal bases:

  • Performance of a contract (Art. 6(1)(b)) — providing the Service you asked for: account creation, syncing your room, delivering prompts, generating AI reflections that are integral to the product.
  • Legitimate interests (Art. 6(1)(f)) — securing the Service, preventing abuse, understanding and fixing crashes and performance issues, and communicating with you about the Service. We have balanced these interests against your rights and freedoms and believe they are proportionate; you may object at any time (see §10).
  • Consent (Art. 6(1)(a) and Art. 9(2)(a)) — for any processing that requires consent, including special-category data you voluntarily submit and any optional marketing communications. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
  • Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data to comply with law, court order, or lawful request from public authorities.

7. Sharing your personal data

We share personal data only in the limited situations below:

  • Your partner — content you post inside your room is visible to your paired partner. The Service is designed for two people.
  • Sub-processors (service providers) — infrastructure providers who process personal data on our behalf under written data-processing terms. Current categories include:
    • Cloud hosting, database, authentication, serverless compute and push messaging: Google LLC / Firebase (Ireland & USA regions).
    • AI processing for session personalisation and thread reflections: OpenRouter, Inc. (USA), which routes prompts to the underlying model provider (currently OpenAI OpCo, LLC), under contracts that prohibit training on your content.
    • Push notification delivery on iOS: Apple Push Notification service (Apple Inc.).
    • Transactional email (e.g., email-verification links): sent through Google LLC / Firebase Authentication.
    A current list of sub-processors is available on request from nickolaysereda@gmail.com.
  • Apple and Google — the App Store and Google Play distribute the app, and (if we introduce in-app purchases in the future) would process those payments under their own privacy policies. The current version of the Service has no in-app purchases.
  • Professional advisors — lawyers, accountants, and insurers, under confidentiality, where necessary.
  • Authorities — where required by law, regulation, valid legal process, or governmental request, or where we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.
  • Business transfers — if we sell, merge, or reorganize the Service, your data may be transferred to the successor entity, subject to the protections of this Policy.

We do not sell your personal data, do not "share" it for cross-context behavioral advertising (as those terms are defined under the CCPA/CPRA), do not use it to build advertising profiles, and do not disclose it to data brokers.

8. International data transfers

The Service is operated from and may be accessed globally. This means your personal data may be transferred to and processed in countries outside your country of residence, including the United States. When we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country not covered by an adequacy decision, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (2021/914) and, where applicable, the UK International Data Transfer Addendum. Copies of the relevant safeguards are available on request.

9. Data retention

We keep personal data only for as long as we need it:

  • Account data — for the life of your account.
  • Room content — while your room is active, plus a grace period of up to 30 days after account deletion so that you and your partner can recover the room if deletion was unintended. Encrypted, offline backups may be retained for up to 90 days before secure deletion.
  • Server logs — connection logs (including IP addresses) are kept only for the short period necessary to route requests, investigate abuse, and diagnose incidents; they are then aggregated or deleted.
  • Support communications — up to 24 months from the last message, unless a longer period is needed to establish, exercise, or defend a legal claim.
  • Purchase records — none at present. If we introduce in-app purchases later, related records will be kept as required by tax and accounting law (typically 7 years).

10. Your rights

Subject to the conditions and exceptions in applicable law, you have the following rights in respect of your personal data:

  • Access — a copy of the personal data we hold about you.
  • Rectification — correction of inaccurate or incomplete data.
  • Erasure ("right to be forgotten") — deletion of your personal data where the conditions in Art. 17 GDPR apply.
  • Restriction — asking us to pause processing while a request is resolved.
  • Portability — receiving your personal data in a structured, commonly used, machine-readable format, and asking us to transmit it to another controller where technically feasible.
  • Objection — objecting to processing based on legitimate interests, at any time.
  • Withdrawal of consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
  • Complaint — the right to lodge a complaint with a supervisory authority. See §14.
  • Automated decision-making — we do not make decisions producing legal or similarly significant effects on you solely by automated means.

To exercise any right, email nickolaysereda@gmail.com. We may need to verify your identity before responding, and will reply within one month (which may be extended by up to two additional months for complex requests). There is no fee for reasonable requests; we may charge a reasonable fee, or refuse, for manifestly unfounded or excessive requests.

11. AI-assisted content

The Service uses a third-party AI provider in two ways:

  • Session personalisation — when a daily session is generated, we send the day's context (your and your partner's first names, the day of the week, and any active shared goal) to the AI so it can rewrite the intro line and, for some question types, produce variant answer options. Your own answers are not sent for this purpose.
  • Thread reflections — in the "Between us" (Threads) feature, once both partners have written and a reflection is requested, we send the recent thread messages to the AI so it can produce a short reflection. The reflection is stored in your room.

Requests are routed through OpenRouter, Inc. to the underlying model provider (currently OpenAI). Our contracts with these providers prohibit them from training their models on your content, and prohibit retention beyond what is needed to service the request. AI-generated output is produced automatically and is not reviewed by us before it appears in your room.

AI output is not professional advice of any kind. It is a conversational mirror, and it can be wrong, incomplete, or contextually inappropriate. See the Terms of Use for the full disclaimer.

12. Cookies and similar technologies

This marketing website uses no analytics cookies and no advertising cookies. Google Fonts is loaded from Google's CDN and may create standard log entries with Google. The mobile app uses persistent identifiers on your device for authentication (Firebase Auth session tokens) and a push-notification registration token (Apple Push Notification service on iOS, Firebase Cloud Messaging on Android). It does not use third-party advertising identifiers, does not read Apple's IDFA, and does not integrate any analytics or cross-app tracking SDK.

13. Children

The Service is intended for adults aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Complaints

If you have a concern, please contact us first at nickolaysereda@gmail.com — we will try to resolve it. You also have the right to lodge a complaint with a data-protection supervisory authority. Because the controller is established in the Republic of Cyprus, our lead supervisory authority under the GDPR "one-stop-shop" is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy). EU/EEA residents may also complain to the supervisory authority of their habitual residence, place of work, or place of the alleged infringement.

15. Security

We use reasonable and appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction — including encryption in transit (TLS), encryption at rest for stored content where supported by our infrastructure, access controls, and periodic review. However, no system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential. If you suspect unauthorised access to your account, notify us immediately.

16. Third-party services and links

The Service may link to third-party websites, apps, or services (including the App Store and Google Play). Those third parties operate under their own privacy policies and terms. We are not responsible for their content or practices.

17. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you in the app or by email at least 30 days before they take effect, unless a shorter period is required by law. The "Last updated" date at the top always reflects the current version. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

18. California residents (CCPA / CPRA)

If you are a California resident, you have the right to (i) know what personal information we have collected, disclosed, or "sold"/"shared"; (ii) request deletion or correction; (iii) opt out of "sale" or "sharing" of personal information; and (iv) not be discriminated against for exercising these rights. As noted above, we do not sell or share personal information. To exercise a right, email us at nickolaysereda@gmail.com. You may designate an authorised agent to submit requests on your behalf.

19. Contact

For any question about this Policy or how we handle your personal data:

Mykola Sereda
Email: nickolaysereda@gmail.com