Privacy Policy

Effective 2 October 2026

Who we are

RoomChat is operated by RoomChat LLC, a Wyoming limited liability company.

RoomChat LLC is the data controller for the personal data described here. RoomChat turns a room, flat or holiday let into a shareable web page. It is aimed at people in the European Union, starting in Spain.

What RoomChat is, in one paragraph

A poster fills in a web form and gets a link. The listing at roomchat.io/l/ plus a short code is a public web page. A person looking for a room opens that link, answers the questions the poster chose, and messages the poster directly on WhatsApp, Telegram or SMS. RoomChat has no accounts, sends no messages, and is never in that conversation.

What we hold

RoomChat is deliberately low-data. There are no accounts and no profiles.

If you post a listing

• The listing itself: the type (room, flat or holiday let), the rent, and a map pin. Everything else is optional: deposit, bills, move-in date, beds, smoking, length of stay, a description of up to 500 characters, up to 4 photos, and a YouTube video link.
• The map pin is blurred before it is saved. We move it 50 to 200 metres and store only the moved point. Your exact position is never written anywhere, so it cannot leak from a backup or a bug. We never ask for a street address.
• The WhatsApp number you proved. You prove it by sending us one message, the RC code shown on screen, from that number. We store the number the message arrived from.
• The language you posted in, the listing's status and expiry date, and the date and version of the terms you accepted.
• Two anonymous counters per listing: how often its page was opened and its contact button tapped. They count events, not people.

If you are looking for a room

• Browsing and searching create no record of you. You need no account, and opening a listing or running a search stores nothing about you beyond the server logs described below. Listing pages carry no phone numbers, so there is nothing on them to harvest.
• The first time you tap Message, we ask you to confirm your WhatsApp number. You send a one-time code to our number from your own handset, the same proof a poster gives, and until that message arrives no poster's number is handed over. We store that code as a hash, with the listing you were contacting, and delete the row the next day. You are asked once in a browser, not on every listing.
• What we keep from the confirmation is a one-way hash of your WhatsApp number, never the number itself, and a count of how many times you tapped Message today. That count is there for one reason: a daily limit of 50 that stops bulk scraping of phone numbers. Fifty is far above what looking for a room takes, so in practice the limit only ever stops a script. A hash cannot be dialled or messaged, and nothing sits beside it: no name, no profile, no inbox.
• Your answers to a poster's questions are never stored. They go into the first message you send the poster, from your own app. We cannot read that conversation and nothing from it comes back to us.

Photo checks

Every photo is checked automatically before it is stored (see the next section). We keep a record of each check: a mathematical fingerprint (hash) of the image, the verdict, and the time. A rejected photo itself is never stored.

Server logs

Our server keeps technical request logs (time, path, status) to run and debug the service. The secret in a poster's private link is blanked before logging.

Why we use it, and on what legal basis

• To run the service: publishing your listing, rendering its page, and handing a seeker into your chat. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To stop abuse and scraping: the daily contact limit, photo screening, and security logging. Legal basis: our legitimate interest in keeping the service usable and protecting posters from bulk harvesting (Art. 6(1)(f)).
• To meet legal duties: reporting apparent child sexual abuse material to the US National Center for Missing and Exploited Children as required by 18 U.S.C. §2258A, responding to lawful requests, and keeping tax records once anything is paid. Legal basis: legal obligation (Art. 6(1)(c)).

We do not use your data for advertising, we do not sell it, and we do not profile you.

Photo screening

Every photo submitted with a listing is checked automatically, before it is stored or shown, by Sightengine, an image screening service. The photo itself is sent to Sightengine for the check. A photo that fails is rejected and never stored, and your private page tells you when photos are being checked and when one was not accepted. These checks are automated: no person looks at your photo as part of them. Apparent child sexual abuse material is reported to the National Center for Missing and Exploited Children as US law requires.

Who else touches your data

These companies process data for us, on our instructions or as part of delivering the service:

• Hetzner (Germany): our server. The application, the database and the photos live on it, in Falkenstein, Germany.
• Scaleway (France): nightly database backups, stored in Paris and deleted after 30 days.
• Cloudflare: the network in front of the site. Every request to roomchat.io passes through it. Cloudflare tells us roughly which city a request comes from, and the map opens there so you do not have to drag it across the world. We do not store that.
• Sightengine: photo screening, as described above.
• Meta (WhatsApp): carries the one message you send to prove your number, and the chat a seeker opens with you. WhatsApp's own privacy policy governs your use of WhatsApp.
• Twilio: provides our inbound phone number.
• Stripe: payment processing, only if and when paid tiers go live. They are not live today.
• NCMEC and law enforcement: where we are legally required to report or disclose.

And in public:

• A live listing is a public web page. Anyone with the link can open it, and search engines can find, index and cache it. It shows the listing details and photos. It never shows your phone number: the number is given only to a seeker who answers your questions and taps through to message you.
• A person searching or browsing is shown to nobody.

What your browser loads from others

Our pages load the map library from jsDelivr and map tiles from OpenFreeMap. If a listing has a video, the YouTube player (youtube-nocookie.com) loads only after you tap it. When your browser fetches from these services they see your IP address, and the tile server sees which map area you are looking at.

RoomChat sets one cookie, and only when you ask to message a poster. It is called rc_seek. While you are confirming your WhatsApp number it holds the one-time code you were shown, signed by us, for at most a day, so that the page you came from can tell you have confirmed. Once you have, it is what remembers that this browser has already confirmed, so you are asked once instead of on every listing. From then on it holds two things, signed by us so they cannot be forged or edited: an opaque id for the record described above, and the date it stops working, a year out. It is read for one purpose, the daily Message limit. It carries no name, no profile and nothing you typed, it is shared with nobody, it cannot follow you to another site, and it is the only cookie RoomChat uses. It is strictly necessary: you asked to be let past a gate, and this cookie is what keeps you past it, so there is nothing here to consent to and no banner to click. Clear it and the only cost is confirming once more.

Your answers are also remembered in your own browser, so you do not type them again on every listing. Your name, when you would move in and the rest of what you tell a poster are kept in this browser's local storage, under rc_answers, and filled in for you the next time you open a room. This is not a cookie: it is never sent to us, it is not attached to any request, and it never leaves your device — it is the same promise as above, that what you type for a poster is never stored by RoomChat. Anything already on screen is left alone. Clearing your browser's site data forgets it, and the only cost is typing your name again.

International transfers

The infrastructure that stores RoomChat's data, the application, the database, the photos and the backups, is in the European Union (Germany and France). RoomChat LLC is a United States company, and our own people access that data from the United States to run and support the service. RoomChat LLC is directly subject to the GDPR under Article 3(2) and stays responsible to you wherever the data is accessed from. Where a transfer to a provider outside the EU needs a safeguard under Chapter V GDPR, we rely on a European Commission adequacy decision or on the Commission's Standard Contractual Clauses. Ask us at hello@roomchat.io for details.

How long we keep it

A job runs every night and enforces these periods:

• A live listing runs for 30 days, unless you renew it or close it earlier.
• Closed listings (filled, withdrawn or expired): deleted 90 days after closing. Photos are deleted with them.
• Unconfirmed drafts (a form never proved by a message): deleted after 7 days.
• Your poster record: deleted 12 months after your last activity, once no listing of yours remains.
• Your seeker record (the hash and the daily count): deleted 12 months after your last activity.
• One-time confirmation codes: deleted after 1 day.
• Backups: nightly, deleted after 30 days.

Delete it now

Your private link has a Delete for good button. It erases the listing and its photos at once, whatever state the listing is in, and the link stops working. You can also email hello@roomchat.io; tell us the number on your listing so we can find it. If you confirmed your number to message a poster, tell us that number and we can match its hash and delete your seeker record; it is also deleted by itself 12 months after your last activity.

Your rights

If you are in the EU or the UK, you have the right to access your data, correct it, have it erased, restrict or object to how we use it, and receive it in a portable form. Write to hello@roomchat.io and tell us the phone number on your listing so we can find it. We answer within one month.

You can also complain to your data protection authority. In Spain that is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

Children

RoomChat is for adults. You must be 18 or over to post a listing, and the service is not directed at children. If we learn that we hold data about a child, we delete it.

Security

Photos are served through short-lived signed links. The secret in your private link is stored only as a cryptographic hash. Connections are encrypted and the infrastructure is access-controlled. No system is perfectly secure, but we keep very little: for a seeker, at most a one-way hash of a phone number and a daily count.

Changes

If we change this policy we update the effective date above and announce material changes on the site. We hold no way to message you, so the site is where changes appear.

Contact

hello@roomchat.io — or see the contact page for postal details and how to report a listing.