Privacy Policy

Last updated: September 6, 2026

Your privacy matters to us. This page explains what information Rooto collects, how we use it, and who (if anyone) we share it with — in plain language, without unnecessary legal complexity.

Information We Collect

What we collect depends on how you use the site:

  • Visitors without an account: we don't collect any data on our servers. Your progress (discovered words, daily spin limit, and your Daily Challenge attempt if you play as a guest) is stored only in your browser (localStorage), and clears automatically or when you clear your browser data — with no streak or cross-device sync, since that requires an account.
  • When you create an account: your email address and password (encrypted — we never see or store it as plain text). If you sign up via Google, we receive your name and profile picture from your Google account (no password).
  • Your in-app activity (for registered users): the words you've discovered (your collection), daily machine spin counts, your daily "What Root" attempt count, Word Decoder and review quiz results, and your Daily Challenge attempts (including your streak).
  • Subscription & payment: if you subscribe to a paid plan, payment is handled entirely through PayPal — we never see or store your card number or any sensitive payment details. What we do store is your subscription status (active/cancelled/expired), plan type (monthly/yearly), current billing period's expiration date, and a PayPal subscription reference ID (a reference number that carries no payment information) so we can link your subscription to your account and let you cancel it from within the site.

How We Use Your Information

We use your data solely to run the features you actually use: saving your root collection and progress across devices, enforcing daily spin limits, showing your quiz results and Daily Challenge streak, and recognizing you when you sign in. We don't sell your data, use it for targeted advertising, or share it with any marketing party.

Cookies

We use one simple cookie to remember your chosen interface language (Arabic/English), plus session cookies managed by our authentication provider (Supabase) to keep you signed in between visits. We don't use any third-party advertising or analytics tracking cookies.

Where Your Data Is Stored

Your account and activity data is stored via Supabase (our database and authentication provider), with protections ensuring each user can only access their own data — never another user's. If you choose to sign in with Google, it's an additional third party involved (solely for authentication). If you subscribe to a paid plan, PayPal processes the payment directly (your email and payment details go straight to PayPal, governed by its own privacy policy — not through our servers).

Your Rights

You can request an export of your data or full account deletion at any time by contacting us at the email below — we'll respond and process the request within a reasonable timeframe.

Children's Privacy

Rooto is not directed at children under 13, and we don't knowingly collect data from this age group. If you believe a child has provided us with personal information, contact us so we can remove it promptly.

Changes to This Policy

We may update this page from time to time as the site and its features evolve. We'll update the "Last updated" date above whenever a meaningful change is made.

Contact Us

For any question or request related to your privacy, email us at .