Last updated September 18, 2026

Privacy policy

Milo Mode Inc., United States · hello [at] roma.app

1. Overview

This policy explains how Roma collects, uses, shares and deletes personal data when you use our website, our web, Mac and iPhone apps, and when you connect another AI app (such as ChatGPT, Claude or Cursor) to your Roma account (together, the “Service”).

2. Information we collect

a. Account information

Your name, email address, profile photo from your sign-in provider, timezone and settings.

b. Your workspace

What you keep in Roma: tasks, notes, projects, lists and their rows, automations, files and images you attach, your conversations with Roma's assistant, and the version history of your notes and tasks.

c. Memory

Short facts about you and how you like to work, which the assistant keeps so it does not have to ask again. You can see, edit and delete them in Settings.

d. Connected apps

If you connect an app such as Gmail, Google Calendar, Linear, Notion, GitHub or Slack, we access it only to do what you ask or what an automation you set up asks, and only within the permissions you granted. Access to those apps runs through our integration provider, Composio, which holds the connection credentials.

e. Usage and diagnostic data

A log of changes in your workspace (created, edited, completed, deleted), records of the assistant's requests and tool calls used to find and fix errors, device information and push-notification tokens.

3. How we use your information

  • To provide the Service: store, sync, search and show your workspace on your devices.
  • To run the assistant: answer your requests, organize what you capture, run automations on the schedule you set, and act in apps you connected when you ask.
  • To make your content searchable, including by meaning.
  • To send the notifications and emails you asked for, and essential account emails.
  • To keep the Service secure, reliable and working as described, and to fix errors.

We do not sell your personal data, and we do not use it for advertising.

4. AI processing

To answer a request, organize an item or run an automation, the relevant part of your workspace is sent to our AI model provider, OpenAI. Under OpenAI's API terms, data sent through the API is not used to train their models. We do not train AI models on your data.

5. Connecting other AI apps

You can connect an AI app such as ChatGPT, Claude or Cursor to your Roma account. You approve each connection on a Roma screen that lists what it will be able to do: view and manage your tasks, notes, projects and lists, read the facts Roma remembers about you, and see and run your automations. The connected app acts only as you, only on your own workspace.

Whatever that app reads from Roma is then also handled under its provider's own privacy policy. You can remove the connection in that app at any time; to have us revoke its access on our side as well, email hello [at] roma.app.

6. Sharing of information

We share data only with service providers that run essential parts of the Service, on our behalf and under contractual safeguards:

  • Supabase: database, sign-in and file storage
  • Vercel: hosting
  • Inngest: background processing
  • OpenAI: AI models
  • Composio: connections to the apps you connect
  • Braintrust: records of AI requests, used to find and fix errors
  • Loops: email
  • Tavily: web search the assistant runs for you
  • Browserbase: the browser the assistant uses when you ask it to act on a website
  • Apple: push notifications

When you share a task or note by link, or invite someone to it, the people you share with can see it. Nothing else you keep is public.

7. Data retention and deletion

We keep your data while your account is active. Anything you delete goes to the trash, where it stays recoverable for 30 days and is then permanently deleted.

You can delete your account at any time in Settings. This permanently deletes your workspace, files, memory, chats and activity from our systems. We keep only a record of AI usage cost (model, token counts, price), which contains none of your content and is no longer linked to you.

8. Security

We use industry-standard practices, including encrypted connections and encrypted storage, and every request is scoped to the signed-in account. No system is 100 percent secure.

9. Your rights

You can see, correct and delete your data in the apps. For anything else, including a copy of your data or a question about how it is used, email hello [at] roma.app. Depending on where you live, you may have further rights under local law, such as the GDPR or the CCPA.

10. Children's privacy

Roma is not directed to children under 16, and we do not knowingly collect their data.

11. International data transfer

Your data may be processed in the United States and in other regions where our service providers operate.

12. Changes to this policy

We may update this policy and will change the date above when we do. If a change is significant, we will tell you in the app or by email.