Privacy Policy

Information We Collect

What we collect depends on how you use the site:

• Visitors without an account: we don't create a profile for you or tie your activity to your identity. The words you discover and your Daily Challenge attempt are stored only in your browser (localStorage). For technical and abuse-prevention purposes, we may record your IP address and set a technical cookie to manage daily usage for visitors.
• When you create an account: your email address and password (encrypted — we never see or store it as plain text), your display name, and the avatar you choose. If you sign up via Google, we receive your name and profile picture from your Google account (no password).
• Your in-app activity (for registered users): the words you've discovered (your collection), your daily machine spins, root pages opened and "What Root" attempts, your points and unlocked avatars, Word Decoder and review quiz results, and your Daily Challenge attempts (including your streak).
• Subscription & payment: payment is handled entirely through PayPal — we never see or store your card number or any sensitive payment details. We store only your subscription status, plan type (monthly/yearly), current billing period's expiration date, and a PayPal subscription reference ID (a reference number that carries no payment information) so we can link your subscription to your account and let you cancel it.
• Contact form: when you write to us through the Contact page, we receive the name, email address, and message you enter, and we record your IP address and submission time to prevent abuse and automated messages.
• Technical data: when a technical error occurs, information such as browser type, device, the page where it happened, and technical error details may be sent to our error-monitoring service (Sentry), solely to fix problems. Our hosting provider also keeps standard server logs (such as IP address and request time).

How We Use Your Information

We use your data to run the features you actually use: saving your root collection and progress across devices, enforcing daily limits, showing your results and Daily Challenge streak, recognizing you when you sign in, managing your subscription, replying to your messages, protecting the site from abuse, and fixing errors. We don't sell your personal data or share it with marketing parties. The "Advertising" section below covers Google ads.

Cookies & Local Storage

We use the following:

• Language cookie: remembers your chosen interface language (Arabic/English).
• Technical visitor cookie: for usage management and abuse prevention.
• Session cookies: managed by our authentication provider (Supabase) to keep you signed in between visits.
• Browser local storage (localStorage): stores your progress as a visitor, your preferences (such as mute), that you've seen the welcome tour, and a temporary cache of some of your data to speed up pages.
• Analytics cookies: Google Analytics places cookies (such as _ga) to measure traffic, as described in the "Usage Analytics" section.
• Advertising cookies: when ads are shown, Google and its partners may place cookies or similar identifiers in your browser, as described in the "Advertising" section.

You can delete or block cookies and local storage in your browser settings at any time, which may cause you to lose your visitor progress or be signed out.

Usage Analytics (Google Analytics)

We use Google Analytics 4 to measure site traffic and how the site is used, so we can see which pages matter to visitors and improve Rooto. It uses cookies (such as _ga) and collects anonymous usage data, such as the pages you visit, your device type and your approximate location. This data is processed by Google. You can opt out by installing the Google Analytics Opt-out Browser Add-on, or by blocking cookies in your browser settings.

Advertising (Google AdSense)

We may show ads on the site to users on the Free plan through Google AdSense (ads are not shown to paid subscribers). Here is how that works:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to our website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the Internet.
• You may opt out of personalized advertising by visiting Google Ads Settings, or visit aboutads.info to opt out of some third-party vendors' use of cookies for personalized advertising.
• To learn how Google uses information from sites that use its services, visit this page.
• If you are in the European Economic Area, the United Kingdom, or Switzerland, we will ask for your consent before using advertising cookies, as required by applicable law.

Who Processes Your Data

We rely on trusted service providers to run the site, each processing data under its own privacy policy:

• Supabase: our database and authentication provider; your account and activity data is stored through it.
• PayPal: processes payments and subscriptions directly, not through our servers.
• Google: sign-in with Google (solely for authentication), advertising, and usage analytics (Google Analytics).
• Brevo: sends emails (such as account confirmation, password reset, and contact-form messages).
• Sentry: monitors and helps us fix technical errors.
• Netlify: hosts and serves the site.

Your data may be processed in countries other than your own, where these providers' servers are located.

Data Retention

We keep your account data for as long as your account exists. When you delete your account, the account and its associated data (root collection, points, unlocked avatars, review history, and subscription) are permanently deleted. Technical and abuse-prevention records (such as visitor IP addresses and the contact form) are used only for the purpose stated. PayPal may retain your transaction records under its own policy.

Your Rights

You can delete your account and data yourself at any time from your Account page ("Delete my account") — after cancelling any paid subscription first. Under applicable laws (such as the EU GDPR and California's CCPA), you may also ask to access, correct, export, restrict, or object to the processing of your data by contacting us at the email below, and we'll respond within a reasonable timeframe.

We do not sell your personal data.

Children's Privacy

Rooto is not directed at children under 13, and we don't knowingly collect data from this age group. If you believe a child has provided us with personal information, contact us so we can remove it promptly.

Changes to This Policy

We may update this page from time to time as the site and its features evolve. We'll update the "Last updated" date above whenever a meaningful change is made.

Contact Us

For any question or request related to your privacy, email us at info@rooto.app.