Privacy Policy

Version: 5.12.0 Effective Date: November 10, 2026 Supersedes: version 5.11.0 of October 18, 2026

We built Rosance with privacy by design. Your account and content are hosted in the European Union. The ads you see on Rosance are bought by other Rosance users and chosen by us: we use no third-party ad network, no advertising identifier and no tracking across other apps or websites, and advertisers never receive information about who saw their ad (Section 4a). We do not sell your personal information — to anyone, ever.

This policy explains, in plain terms, what we collect, why, who else touches it, and what you can do about it. Where we use artificial intelligence on your content, we say so explicitly — see Section 5.

1. Data We Collect

We collect only what we need to run the service, operate monetization, and keep the platform safe.

Account & profile

Account information: username (handle), display name, email address, and authentication credentials. Passwords are stored only as salted, peppered Argon2id hashes — we never see or store your plain password. If you sign in with Google or Apple, we receive your verified email address and an identity token from that provider.
Date of birth / age: collected to confirm you meet the minimum age for the service and to apply the additional protections we give to minors (Section 10). Correctable from your profile settings, subject to the same age check and to a 30-day limit between changes.
When you last changed an identifying field: we record the date you last changed your display name, handle, date of birth or email address, so we can enforce the 30-day limit between changes. We keep the dates only, never the previous values.
Profile information: avatar, bio, preferences (theme, language, display currency, notification settings, including whether we may send you reminders, and whether ads may be personalised), and — if you enable push notifications — a push notification token and your device's time zone. We use the time zone for one thing only: not sending you reminders at night. A push token belongs to one account at a time: when another account signs in on the same device the token moves to it, and signing out deletes it.
Badges: achievements shown on your profile, a verified checkmark once your identity has been verified (Section 1, "Money and identity"), and — for verified political figures and businesses that declare it — a public "political account" badge.
Interface state: a small amount of state about the app's own interface, such as how far through onboarding you are and which one-time tips you have already been shown. This exists so the app does not repeat itself on your next sign-in or on a new device. It records only that something was displayed to you — never what you watched, liked, or looked at, which is covered separately under "How you use Rosance" below.
Your phone number (optional): if you provide one during onboarding it is stored on your profile so that people who already have your number in their contacts can find you. Nobody can search for you by phone number, and no other user is ever shown it. You can stop people finding you this way in Settings → Privacy → "Discoverable by phone number" (on by default). We do not verify the number. We also read which country it belongs to, as one of the signals described under "Your country" below. This is separate from contact discovery below, where numbers from your address book are hashed and never reach us in readable form.

Content you create

User-generated content: videos, images, captions, comments, and audio you upload and share, together with the technical metadata needed to process them (duration, format, your Creator Studio edit instructions).
Microphone while recording video: recording with the in-app camera captures your microphone, so your voice — and anything else audible around you — becomes part of the video's audio track. Like the rest of a published video, that audio may be processed by the automated steps described in Section 5, including speech-to-text. Certain camera face effects (currently "Goofy") additionally distort your voice on your device before upload; for those we only ever receive the distorted result, never your undistorted voice. The microphone is used only while a recording is actually running, and only after you grant microphone permission.
Derived media renditions: to publish and to check your content we automatically generate additional versions of it — streaming renditions, thumbnails, still frames sampled across a video, and a downloadable watermarked copy. When you turn Captions on we additionally produce a compressed audio track, used only for the speech-to-text step described in Section 5 and deleted once that step finishes.
Speech transcripts and subtitles — only if you ask for them: we transcribe the spoken audio of a video only when you switch Captions on for it in Creator Studio. If you leave Captions off, no transcript of your speech is produced, stored, or read by any of our automated systems. When you do switch it on, we extract the spoken audio from that video and send it to an outside transcription service — a speech-recognition model run by Cloudflare Workers AI, reached through Cloudflare AI Gateway — to be turned into text. We delete that audio extract as soon as the captions come back; only the video's sound is sent, never the picture. The resulting text and detected language are stored with your post and used for content categorisation, accuracy checking and safety, while the same transcription is saved as a subtitle track. This applies to public content you publish — never to your direct messages.
- Subtitles are visible to viewers. Once you have turned Captions on, anyone watching your video can display them, whether or not you set them to show by default. What you say in that video may therefore be read as text by your audience.
- We also store when each word was said. Alongside the subtitle text we keep the timing of the individual words, so captions can highlight each word as you say it. This is the same speech we already transcribed, recorded more precisely — no additional audio is kept, and it is stored, served and deleted exactly like the subtitle track it belongs to.
- You can correct your captions. Creator Studio shows you the transcription and lets you rewrite any line the model misheard. Your correction replaces the machine's text everywhere it is used, including in the stored transcript that the categorisation and accuracy-checking steps in Section 5 read. Timings are not editable.
- We transcribe the clip you uploaded, before trimming. The captions shown to viewers are cut to match the part you published, but the stored transcript may include speech from a section you trimmed away. It is deleted together with the video.
- If you replace the audio with music, your speech is no longer part of the published video, so the transcript is not used for categorisation or accuracy checking. Your captions still display if you asked for them.
Places you tag: if you use the Location sticker, we store the name, OpenStreetMap identifier and coordinates of the place you selected, and we draw that place onto the post and show it beneath the post's caption. These are the venue's coordinates as published by OpenStreetMap — not a record of where you were. To offer you a list of nearby venues we ask your device for its position while the picker is open, send it to our own servers to look up what is nearby, and do not store it anywhere: not on your account, not in our logs, not in analytics. Our servers look the position up with OpenStreetMap's place services (Section 3) without sending anything that identifies you. Granting location is optional; the search field tags any place without it. Because the sticker is drawn into the video's picture, a tagged place cannot be removed from an already-published post (Section 9).
People tagged in a post: an author can tag other people in two ways — with the Mention sticker, which draws the handle into the video itself, or by writing @yourhandle in the post's caption. Either way, if you are tagged we store the link between you and that post, we notify you, your handle is shown beneath the post's caption, and tapping it opens your profile. You can remove your tag whenever you like from the post's menu — that deletes the link, stops your handle linking to you, and removes the post from your tagged list. The caption line we build from the tags is assembled each time the post is shown rather than saved as text, which is what lets it follow your decision. Two things it cannot undo, because neither is ours to rewrite: your handle drawn into the video's picture, since a published video cannot be edited, and your handle where the author typed it into their own caption, since that is a sentence they wrote (Section 9). Someone you have blocked cannot tag you by either route, and no one but you can remove your tag.
Stories — content that expires after 24 hours: a story is a photo or short video you post to the rail above the feed. Unlike a normal post it stops being visible to your audience 24 hours after you post it. After that it stays in your own private story archive: the Stories tab of your profile, which only you can open. Nobody else — not the people who could see it while it was live, not someone you sent it to in a message — can watch it again, and it cannot be shared onward from there. You can watch it back yourself, together with the list of people who watched it while it was live, for as long as you keep it. When you delete a story, the picture or video and every version we generated from it are removed from our storage within the hour, and only a small record is left behind — when you posted it, who it was shown to, and how many people watched — so that a reply to it in Direct Messages can say the story has expired rather than showing a blank card. That record is deleted 30 days later. Stories go through the same automated safety check as any other upload (Section 5); a story that fails it is taken down and you are told, rather than being held for review, because a review would outlast the story.
- Who you choose to show it to. Each story is saved with the audience you picked when you posted it — everyone, or friends only (people you follow who also follow you). Making your profile private later narrows stories you posted for everyone to the followers you have approved. Making it public again never widens a friends-only story.
Who watched a story: when you watch someone's story we record that you watched it, and when. The person who posted it can see that list — it is how they know who has seen it. You are never shown who watched anyone else's story, and this is never used to rank or recommend anything. The record is deleted when the story record is, when the poster deletes their account, or when you delete yours.
Content-analysis results: the topics/hashtags our systems infer from your post, the model's short written reasoning, safety-scan scores, and — where applicable — an automated accuracy assessment of a factual claim in your post together with the sources it cites (Section 5).
Video replies — someone else's comment inside your video, and yours inside theirs: you can answer a comment with a video. The comment being answered is displayed as a card inside the published video itself, showing that person's handle, profile picture and the text of their comment as it read when the reply was recorded. This works both ways: when someone answers your comment, your handle, picture and words appear inside their video. Two consequences we want to be direct about. First, the card is fixed at the moment of recording — editing or deleting your comment afterwards changes the conversation thread but does not change a video that has already been made. Second, because the card is part of the video's own picture, it is not something we can remove by deleting a database record; see Section 9. A video reply also inherits the topics of the post it was made under, so that it reaches the same conversation.
Music you upload to the sound library: once your identity is verified and you have accepted the Artist Agreement, you can upload recordings of your own from rosance.com so other creators can use them in their posts. An approved recording shows you as its owner and can earn you royalties (Section 1, "Money and identity"). We store the audio file, what you called it, the tags you gave it, and the technical details we work out from the file itself (its length and the shape of its waveform). If a recording is approved we also count how many posts have used it, and show that count to you.
- The record of your rights declaration. Before a recording can be reviewed you must tick a declaration that you hold the rights to it. We record when you ticked it, the exact version of the wording you agreed to, the IP address the request came from, and the browser your device reported. This is the only place on the platform where we keep an IP address against a deliberate statement you made, and we are direct about why: the declaration is what allows us to host music we have no licence of our own for, and a declaration nobody can date or attribute is not evidence of anything. It is used for that purpose and no other — never for personalisation, advertising or profiling. See the Artist Agreement for what the declaration commits you to.
- A refused or withdrawn upload. If we refuse a recording, or you take it out of the library, the record of the decision and of your declaration stays for the period in the retention table below. The audio itself goes when you discard the upload.
Camera effects ("lenses"): face tracking for camera effects runs entirely on your device (Apple ARKit on iPhone, Google MediaPipe models built into the app on Android). No picture of your face, no face measurements and no face mask are stored or sent anywhere; only the video you choose to publish is uploaded. If you create a lens in Lens Studio we store the lens, the images you put in it, its versions, your rights declaration (when you made it and the wording version), and the review outcome. A lens approved for the public catalogue stays available after you delete your account, without your name. We also remember which lenses you favourited and how often you used each one, to order your own lens tray. Some built-in lenses download their 3D models from GitHub the first time you use them, which shows GitHub your device's IP address and nothing else.
GIF stickers: the GIF picker searches Giphy directly from your device. Giphy receives what you type into the picker and your IP address; we receive neither, and nothing about your account is sent.

Lives

If you go live: your camera picture and microphone sound are streamed to our media server, which passes them on to the people watching. We store the live's title, who may watch it, when it started and ended, its viewer and like counts, and the gifts it received. Every live is recorded. The recording is available only to you, in the Live studio, and is deleted after 30 days (Section 6).
If you watch or take part in a live: joining a live is recorded on that live's timeline together with your profile, and so are the chat messages, likes, gifts, super chats and donations you send, so the host's recording can replay them at the right moment. These timeline records are deleted together with the recording.
Safety checks during a live: a Rosance safety account joins every live, and our self-hosted safety scanner checks a still frame of the video every few seconds while the live is on air. It does not listen to the sound. A frame it flags is saved and attached to a report so it can be reviewed (Section 5).
Host tools: if a host mutes you in a live's chat, we keep that only until the live ends. If a host removes you from a live, it applies to that live only.

Private messages

Direct messages and group chats (end-to-end encrypted): the text and media of your messages, in one-to-one chats and in group chats, are encrypted on your device before they reach us. We cannot read, access, or scan the text or media of your messages. We store only the encrypted ciphertexts, so your conversation history stays available on your devices, until you delete a message, a conversation, or your account. In a group, the key is shared with every member, so people who join later can read the group's earlier messages. Your private key is stored only in a form encrypted with a key derived from a recovery PIN you choose and we never receive — we cannot decrypt it, and we cannot reset that PIN for you. To protect that backup, we count wrong PIN guesses and lock it for a while after repeated failures.
What we can read around your messages. To route and display conversations we process, in readable form:
- the envelope of each message: sender, conversation, timestamps, size, media type and length, the waveform of a voice note;
- emoji reactions;
- link previews of a link you share (the address and the preview's title, picture and description);
- a custom chat background picture;
- for group chats: the group's name and photo (and a new photo while our safety scan checks it), who created it, who is a member or admin, who invited whom, who left or was removed and by whom, and rename events. The group name and photo are shown in invitations, in push notifications and on the group's invite link: anyone holding that link, signed in or not, can see the group's name, photo and number of members. A group's admins can reset the link;
- whether you muted a conversation;
- when you message a business through an ad's "Send message" button, which ad the message came from (Section 4a).
Contact discovery (optional): if you choose to find friends from your contacts, phone numbers are normalised and irreversibly hashed (SHA-256) on your device before being sent to us for matching. We never receive plaintext phone numbers from your address book.

How you use Rosance

Interest profile (feed personalisation): to rank your "For You" feed we maintain an interest profile derived from your activity on Rosance — topics and hashtags of videos you watch, how long you watch them and whether you finish them, likes, comments, follows, and posts you have asked to see less of. See Section 4.
Interaction records: views (including dwell time and watch completion), likes, comments, shares, reposts, saved posts, follows, blocks, topics you asked to see less of, and your fact-check community votes (on posts and stories).
Follow requests: if your account is private, we store who asked to follow you and when, until you accept or decline. Your posts, stories and follower lists are shown only to people you have approved.
Your country: we work out which country you are in, at country level only, from: a country you declared (if any), the country of the phone number on your profile, and the country your recent sign-ins came from, which Cloudflare derives from your IP address. We keep the country of each sign-in for as long as the sign-in session is kept, and the country you sign in from most often over the last 30 days on your account. We use the result to show you news and trending waves from your country, to give a modest boost to waves from your country in "For You", to choose ads that apply to your country (Section 4a), to show creators aggregate counts of where their viewers are, and to help our reviewers spot a mismatch during identity verification. When you publish a wave we record your country with it, so it can appear in that country's News feed; it is never shown to other users. It is never more precise than a country and it is not your nationality.
If you are not signed in: you can watch the public feed without an account. To count your view once and to limit how often an ad is shown or charged for, we give your browser a random viewer key, kept in your browser's local storage (see our Cookie Policy), and record which posts it watched and for how long. The key is random and not derived from your device. To stop one network inflating an advertiser's bill we combine it with a scrambled (hashed) form of the network part of your IP address; the IP address itself is never stored. We never use this to identify you and we never join it to an account.
Reminders after time away (only if you turn them on): reminders are off until you switch them on — when you set up your account, or later in Settings → App Preferences → Reminders. If you have, and you stop opening the app, we may send you an occasional notification about real activity you missed: new waves from people you follow, messages waiting for you (a count and who sent the latest, never their content), stories you have not watched, new views on your own wave, or a wave trending in your country. To space them out, we keep when your current time away began and which reminder is next. Reminders are never generic, never sent between 21:00 and 09:00 in your time zone, and never more than one a day; they stop after six months away. You can turn them off again at any time in Settings → App Preferences → Reminders without affecting any other notification.

Money and identity

Wallet & monetization: your earnings balance (what you can withdraw), your ad budget if you advertise (credit you prepaid to run ads), transaction history, gifts sent and received (including the comment a gift was sent with), song royalties, promotion budgets and spend, ad spend, and refunds. Earnings become withdrawable 30 days after they are credited, which covers refunds and chargebacks.
Purchases in the apps: gifts and promotions bought in the iPhone or Android app are paid through Apple's App Store or Google Play. They process the payment and we receive a receipt; we keep the store's transaction identifier so the same purchase cannot be credited twice. We never see your card in this case.
Card payments on the website: on rosance.com you can pay for gifts, promotions and ad budget by card through our payment processor, Netopia Payments. You type your card details on Netopia's own payment page; we never receive your full card number or security code. To process the payment we send Netopia your name, email address, phone number and billing address, together with the order. We keep the order's reference, Netopia's replies about the payment, and any invoice number. If you choose to save a card, we keep a token from Netopia that lets us charge that card again (stored encrypted), together with the card's brand, last four digits and expiry date, so you can recognise it. You can remove a saved card at any time.
Billing details for invoices: if you buy ad budget we ask for the details that go on an invoice: name, address, country, and a tax identification number (a company registration code or, for a person, a personal numeric code) and VAT number where you have one.
Payout accounts: to withdraw earnings, the account holder's name, IBAN, bank, address, country and tax identification number. We record when the details last changed and whether the account is the first one you added, and refuse a withdrawal to an account added or changed in the previous 24 hours, to protect you if someone takes over your account. Your first payout account is not held, because every payout is currently reviewed by hand before it is sent. Each withdrawal keeps a copy of the details it was paid to.
Identity verification (KYC): to earn money, advertise or upload music, we verify who you are: your legal name and country, or for a business its name, registration number and representative, and photographs of a government-issued ID and a selfie. The photos are encrypted on your device before upload and can only be decrypted by our review system; every time a reviewer opens them we record who, when and from which IP address and browser. A change to verified details goes back to review. A successful verification gives your profile a verified checkmark.
Politically exposed persons: the law requires us to ask whether you, a family member or a close associate hold or held a prominent public function. If so we record the person's name, position, country, whether they are still in office or the year they left, and the source of funds. Such accounts always get a manual, enhanced review. Where you declare that you yourself (or your business) are political, your profile shows a public "political account" badge once approved.
If you advertise: your campaigns, their targeting choices and saved audiences, and their statistics (Section 4a). Every ad shows who paid for it, using your company name or, if you advertise as a person, your legal name as verified. Political ads additionally publish a transparency notice naming the sponsor, their country, the amount spent, the reach and the audience criteria, as EU law requires.
Song royalties: if a recording you uploaded is used, we record per song and per day the earnings it generated and what was credited to you.
Tax reporting data: where required by EU tax law, the identification and income data we must collect about creators who earn on the platform (Section 2, "Legal obligation").

Safety, support and technical data

Safety & moderation data: reports you file or that are filed against your content, blocks, moderation decisions, safety-scan results, the written assessments our AI moderator makes of a report (Section 5), and enforcement history (e.g., suspensions).
Support conversations: messages you exchange with our AI support assistant and with support staff, the questions the assistant asks you and your answers, and the status of each conversation. To answer you, the assistant is given a short summary of your account (Section 5).
Restrictions: if we restrict a feature on your account (for example posting, commenting, messaging or advertising), the feature, the reason, who decided it, and when it ends.
Orders from authorities: when a court or public authority sends us an order about content or an account (for example a removal order or a request for information, under Articles 9 and 10 of the Digital Services Act), we keep the order, the issuing body, its legal basis and reference, and what it concerned. We tell you about it unless the law or the authority requires us not to.
Alerts to our moderators: when a report needs a human moderator (after our AI moderator has looked at it, Section 5), or when a support chat is handed to a human, we email our moderators so someone sees it without waiting for them to open their dashboard. That email carries the reason you chose, what kind of thing was reported, the time, and a link to the item in our moderation tools — not what you wrote. Your free-text description of a report never leaves those tools. For a support chat the alert also carries the thread's subject line, because an alert without one cannot be prioritised; the conversation itself stays in our support system.
Technical & security data: IP address, device and country for active sign-ins, security logs, crash reports, and approximate "last active" timestamps used for presence features. If you sign in on the web by scanning a code with your phone, the phone is shown the browser's device and IP address before you approve it; that request is kept for three minutes at most.
Content-reuse protection: we keep a fingerprint (a hash) of every uploaded file, so a video that a moderator confirmed must come down cannot simply be uploaded again. Fingerprints of removed content are kept permanently. If you delete a post while a report about it is open, we keep a copy of it until the report is decided, so deleting a post cannot erase what a report is about.
Analytics (optional): we use OpenPanel, self-hosted on our own EU infrastructure, to collect pseudonymised usage metrics (app performance and feature engagement). Crash reports and diagnostic logs are not part of this and are governed by their own switch, described below. Engagement metrics record the screens you open and the actions you take on a post — opening its comments, commenting, liking, reposting, sharing or reporting it — together with the identifier of the post concerned. They never record what you wrote: no comment text, no search terms, no report details. A share records how you shared it, never who you shared it with, and a report records only whether a post, a comment or an account was reported, never the reason you chose. This data is not shared with third parties. You can turn analytics off at any time in Settings → Privacy → Analytics — the switch takes effect immediately on your device, is saved to your account, and applies on every device you sign in to. On the website the same collection additionally requires you to have accepted analytics cookies.
Diagnostic logs and crash reports (optional): if the app misbehaves or stops working, it can send us a technical record so we can fix it. This covers a timestamped trace of what the app itself did (for example "camera session ready", "upload failed") and, when the app stops working, a crash report: the error, where in our code it happened, your device model and OS version, the app version, and your account identifier, so we can tell one person hitting a bug forty times from forty people hitting it once. It also includes the recent network requests the app made, with the web addresses cut back to the endpoint so they no longer say which post or conversation you were looking at.

All of it goes only to our own servers in the European Union. It is received and stored by software we run ourselves and is never sent to any third party — no crash-reporting company, no analytics vendor, nobody. We previously used Sentry, a US provider, for crash reports; we no longer send them anything.

It never includes your name, email or handle, no screen recording or screenshots, and no message content — your messages are encrypted and we hold no readable copy of them to send.

You can turn this off at any time in Settings → Privacy → "Diagnostic and crash reports". The switch takes effect immediately, is saved to your account, and applies on every device you sign in to. Turning it off stops anything leaving your device; the app keeps its own local record so a problem is still reportable by you if you choose. This is a separate switch from Analytics: turning one off does not turn off the other.

Email and announcements

Mailing list: we keep a list of email addresses for service announcements and updates, together with a note of how the address reached us (for example, the website sign-up form or creating an account) and whether it belongs to a registered account or is a newsletter-only contact. We use that distinction so that messages which only make sense for account holders — such as a notice that we have updated our Terms or this Policy — are not sent to people who do not have an account.
Send records: we record whether each message was queued, sent, failed or bounced, so we can tell whether an announcement actually reached you.
Opting out: every message carries an unsubscribe link. Unsubscribing stops all further marketing email. We keep your address on a suppression list rather than deleting it — that record is what guarantees you are not re-added by a later import. If you delete your account, the address stays on that suppression list but is unlinked from your account and is no longer treated as belonging to a registered user.

2. Legal Bases for Processing (GDPR Art. 6)

Purpose	Legal Basis
Operating your account; hosting, transcoding and delivering your content; direct messaging; wallet and gifts	Performance of a contract (Art. 6(1)(b))
Streaming a live, recording it for the host, and keeping the live's timeline (who joined, chat, likes and gifts)	Performance of a contract (Art. 6(1)(b))
Checking still frames of lives for sexual content while they are on air, and keeping the recording of a live we ended while that decision can be appealed	Legal obligation (Art. 6(1)(c)) under the Digital Services Act and child-protection law, and legitimate interest (Art. 6(1)(f)) in a safe platform
Feed personalisation ("For You")	Performance of a contract (Art. 6(1)(b)); you can switch to the non-personalised Newest and Discover feeds at any time
Working out your country (Section 1) and using it for the News feed, the same-country boost, aggregate creator statistics and identity-verification checks	Legitimate interest (Art. 6(1)(f)) in showing you locally relevant content and in preventing fraud; you can object at privacy@rosance.com
Choosing which ads to show you by age, country, language and interests (Section 4a)	Legitimate interest (Art. 6(1)(f)) in funding the service with ads relevant to you. You have an absolute right to object to this (Art. 21(2)–(3)), with one switch: Settings → Privacy → Personalised ads
Showing ads to visitors who are not signed in, counting their views and billing advertisers fairly	Legitimate interest (Art. 6(1)(f)); the viewer key is stored on your device under the exemption for storage strictly necessary to provide the service you asked for (see our Cookie Policy)
Card payments on the website, saved cards, invoices	Performance of a contract (Art. 6(1)(b)); invoices and accounting records also legal obligation (Art. 6(1)(c))
Political-advertising transparency notices and sponsor records	Legal obligation (Art. 6(1)(c)) under Regulation (EU) 2024/900
Automated safety scanning and content categorisation of published content	Legal obligation (Art. 6(1)(c)) under the Digital Services Act and child-protection law, and legitimate interest (Art. 6(1)(f)) in a safe, functioning platform
Speech transcription of a video you switched Captions on for	Performance of a contract (Art. 6(1)(b)) — you asked us to caption it. The resulting text is then also used for the safety and categorisation steps above
Automated accuracy checking (fact-checking) of published content, and displaying the outcome	Legitimate interest (Art. 6(1)(f)) in reducing the spread of misinformation, balanced against your interests as described in Section 5
Self-hosted analytics, platform security, fraud and abuse prevention, service improvement	Legitimate interest (Art. 6(1)(f)) — you can object at any time, and for analytics we honour that objection with a one-tap switch
Reminders about activity you missed while away	Your consent (Art. 6(1)(a)), given by turning reminders on; you can withdraw it at any time with one switch (Settings → App Preferences → Reminders), without affecting any other notification. Delivering them as push notifications also rests on your push-notification consent
Camera, microphone, photo library, contacts access, push notifications	Consent (Art. 6(1)(a)) — revocable at any time in the app or at OS level
Identity verification (KYC), politically-exposed-person checks, anti-money-laundering checks, transaction record-keeping, tax reporting on creator earnings, responding to lawful orders	Legal obligation (Art. 6(1)(c)) — incl. EU AML Directives, Romanian Law no. 129/2019, Council Directive (EU) 2021/514 ("DAC7"), and Articles 9 and 10 of the Digital Services Act
Keeping fingerprints of removed content, and evidence of a reported post until the report is decided	Legitimate interest (Art. 6(1)(f)) in stopping removed content from returning, and legal obligation (Art. 6(1)(c)) under the Digital Services Act
Content moderation, notice-and-action, statements of reasons, appeals and transparency reporting	Legal obligation (Art. 6(1)(c)) under Regulation (EU) 2022/2065 (Digital Services Act)
Establishing, exercising or defending legal claims	Legitimate interest (Art. 6(1)(f))

Special category data. Government ID images and selfies submitted for verification are processed to comply with anti-money-laundering law (Art. 9(2)(g) GDPR, substantial public interest). A politically-exposed-person declaration can reveal a political affiliation; we process it for the same anti-money-laundering reason, and the public "political account" badge shows only that you hold or held a public political role, which you have yourself made public (Art. 9(2)(e)). Content you choose to publish may itself reveal special category data — you decide what you publish, and the legal basis for publishing it is your own act of making it public (Art. 9(2)(e)).

3. Where Your Data Lives, and Who Processes It

Your account data and your content are stored in the European Union. Our primary infrastructure runs in Sweden (Google Cloud region europe-north2), with object storage in Cloudflare R2 configured for EU data residency.

Our processors

Processor	Role	Location
Google Cloud (Google Cloud EMEA Ltd / Google Ireland Ltd)	Virtual machines, managed infrastructure, databases, and the media server that relays lives	EU — Sweden (`europe-north2`)
Cloudflare	Object storage (R2) for video and image files; content delivery; network protection	EU data residency configured; global edge network
Cloudflare Workers AI (via Cloudflare AI Gateway)	Runs the AI models described in Section 5, including speech-to-text, the support assistant and the AI moderator that first reviews reports. With each request we also send our internal identifiers of the account and post concerned, so costs can be matched to their cause.	EU/global — see Section 5
Netopia Payments (Romania)	Processes card payments on the website and stores the card for you if you save it. Receives your card details on its own page, and from us your name, email, phone, billing address and the order.	EU — Romania
Apple (App Store) / Google (Google Play)	Process payment for purchases made in the apps and return a purchase receipt. They act as the merchant; we receive no card data.	US/global
Google (Firebase Cloud Messaging) and Apple (APNs)	Delivery of push notifications	US/global
Expo (EAS Update)	Delivering updates to the app itself. Receives which platform, app version and release track your install is on — no account, profile, content or identifier of yours — plus a random number the app generates for itself and your IP address.	US/global
Search engines queried through our self-hosted search instance	Retrieving public web pages for automated accuracy checking	Global
OpenStreetMap place services — Nominatim (OpenStreetMap Foundation) and the Overpass API (FOSSGIS e.V.)	Looking up places for the Location sticker — both the "near me" list and searching by name. Receive the coordinates or the search term the lookup is for, never your account or any identifier of yours, because our servers make the request, not your device.	EU/global
Audius and Jamendo (music catalogues)	Searching for songs to add to a post. Our servers send only the search term. Until we have copied a track to our own storage, your device plays its preview directly from that service, which then sees your IP address.	Global
Brevo (email provider)	Delivering the email we send you — sign-in codes, password resets, security notices, your data-export link and service announcements — and the internal alerts that tell our moderators a report or a support chat is waiting. Receives the address and the contents of the message concerned.	EU

Services your device contacts directly. A few features load something straight from another company rather than through us. These companies receive your IP address and the request itself, under their own privacy terms, but nothing about your account:

Giphy (US) — when you search for a GIF sticker, it receives your search.
Google Fonts (Google) — when you style text in the Creator Studio on the website.
GitHub (US) — the first time you use certain built-in camera lenses.
Google and Apple — the sign-in buttons on the website load their scripts from Google and Apple.

We do not use third-party advertising networks and we do not sell or share your data with data brokers.

International transfers

Your content and account records stay in the EU. Some strictly limited data leaves the EU because of how the underlying technology works:

Push notifications are delivered through Google (Firebase Cloud Messaging) and, on iPhone, Apple. A push carries the notification's text and who it is from — that person's display name, their public profile picture, and their account identifier — so your device can show their picture on the notification. For encrypted messages the message body travels encrypted and is decrypted on your device: the delivery services, and we, never see message content.
App updates. On launch the app asks Expo whether a newer version of itself exists for the one you have installed. The request describes the build, not you: platform, app version, release track. It carries no account, session, profile or content, and you are not signed in to it. It does carry a random number the app generated for itself on first launch, and your IP address — we see neither. Every install on the same app version is offered the same update, so nothing here is targeted at an individual.
Sign-in with Google or Apple means that provider processes your sign-in.
GIF search, web fonts and some lens models are fetched by your device from Giphy, Google and GitHub, as described above.
Automated accuracy checking sends a short search query — derived from the claim in a published post, not from your account data — to public search engines. Search results are public web pages.
AI model inference may execute on a processor's global network (Section 5). This includes speech-to-text: if you switch Captions on for a video, the spoken audio of that video is transmitted to our transcription provider. Previous versions of this policy said the audio never left our servers; that changed in version 4.0. The resulting text is then used for categorisation and accuracy checking, the same as your caption.

These transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses together with supplementary technical measures. You can request a copy of the relevant transfer mechanism at privacy@rosance.com.

4. Feed Personalisation

The "For You" feed is ranked by an algorithm using: your interest profile (topic/hashtag affinities), topics you asked to see less of, your interactions (watch time and completion, likes, comments, follows), content recency, language match, whether the post comes from your country (Section 1, "Your country"), accounts you follow, posts you have muted with "Show less", and — where a creator has paid to promote a post — a clearly labelled, time-decaying promotion boost.

The News feed shows the most recent waves our systems recognised as news (Section 5) that were published from your country, newest first. It uses your country but not your interest profile.

You are in control. You can switch to the chronological Newest feed or the Discover feed at any time from the feed filter; neither ranks posts by profiling. (Ads can still appear in them — see Section 4a.) Every post carries an info button that shows you why it was ranked for you, which topics it was matched on, and a "Show less" control. You can review and adjust your interests in Settings → My Algorithm.

4a. Advertising

Rosance shows ads. They are bought by other Rosance users — creators and businesses whose identity we have verified — who pay to show one of their own waves to more people. We run this ourselves. There is no outside ad network, no advertising SDK and no advertising identifier, we do not track you across other apps or websites, and advertisers never receive information about who saw, watched or tapped their ad: they see totals only.

How an ad is labelled. Every ad is marked as an ad and shows who paid for it. Political ads are labelled as political and link to a public transparency notice (sponsor, their country, amount spent, reach and the audience chosen), as Regulation (EU) 2024/900 requires.

How we choose which ads you see. An advertiser chooses one or more audiences by country, language and age range, and may add interests (topics). We then match:

You are	What we use to choose ads	What we never use
Signed in and 18 or older	Your age (from your date of birth), your country (Section 1), your language, and — only for ads that target interests — the top topics of your interest profile (Section 4). We also use your viewing history and the ads you hid, but only to stop showing you the same ad too often	Interests are never used for political ads
Signed in and under 18, or we do not know your age	Nothing — we show you no ads at all	—
Not signed in	Your country (from your IP address, via Cloudflare) and your browser's language only, and only ads whose advertisers chose to reach visitors	Age, interests, any profile

"Why am I seeing this ad?" Every ad has an info button showing who paid for it and the audience it matched you on (countries, languages, age range and interests). From there you can hide that ad.

What the advertiser learns. Only totals per day: impressions, views, taps, messages and spend, and, while they plan a campaign, a rounded estimate of how many people match their audience. We never give an estimate for fewer than 100 people. If you choose to tap an ad's "Send message" button and write to the advertiser, they receive your message and see who sent it, as with any message — because you wrote to them.

Ads appear in every feed, including Newest, Discover and News: choosing a non-personalised feed changes how posts are ordered, not which ads you can be shown.

Your right to object. You can object at any time to your interests and age being used to choose ads for you; this right is absolute (Art. 21(2)–(3) GDPR). Turn off Settings → Privacy → Personalised ads, in the app or on the website; it takes effect from your next page of the feed, on every device. From then on you still see ads, but generic ones: only ads whose advertisers chose to reach visitors who are not signed in, chosen by your country and language alone, exactly as for those visitors. Advertisers' audience estimates stop counting you for campaigns that use age or interests. You can also object by writing to privacy@rosance.com.

Minors. Consistent with Article 28 of the Digital Services Act, we never show ads based on profiling to anyone we know to be under 18 — in fact we show them no ads at all.

What we keep. Short-lived markers that an ad was shown to, charged for or tapped by a viewer are deleted after 24 hours. Campaign statistics are totals and contain no viewer. Advertisers' campaigns, saved audiences and political declarations are kept with their account.

5. Artificial Intelligence: What We Run on Your Content

We use automated and AI systems in a small number of clearly defined places. This section exists so you know exactly where.

None of these systems ever touch your direct messages. DMs are end-to-end encrypted and technically unreadable to us.

System	What it does	Runs on	Applies to
Safety scanner (NSFW)	An image classifier checks still frames from your published media for sexual content before it goes live, checks a new profile picture before it appears on your profile, and checks a still frame of every live every few seconds while it is on air. A frame it flags in a live is saved and attached to a report	Our own servers (self-hosted model)	Published photos and videos, profile pictures, and lives
Speech-to-text (Captions)	Transcribes the spoken audio of a video so it can carry subtitles viewers may display, and so the categorisation and safety steps understand what was said. Also records when each word was said, so captions can highlight words as they are spoken. The audio itself is sent to the provider	Third-party model provider (Cloudflare Workers AI, via Cloudflare AI Gateway)	Only videos you switched Captions on for — never your Direct Messages. You may correct the resulting text; your correction is what the steps below then read
Content categorisation and news recognition	A vision model looks at sampled frames plus your caption and transcript, assigns topics/hashtags used for ranking, and scores how likely the post is to be news. Posts above a threshold appear in the News feed of the author's country. It also records safety labels. One of them, whether a video or photo shows graphic violence, is used as a second opinion when the post is reported for violence (see "Reports are reviewed by our AI moderator first"); the others are not acted on	Third-party model provider (currently Cloudflare Workers AI)	Published photos and videos (and stories, when story checks are switched on)
AI moderator	Reviews every report before a human does. It reads the report (the reason, any text you added), the reported post, comment or account, earlier assessments of the same content, how many reports the reporter has filed before and how they were decided, and looks at still frames of the reported photo or video, including the frames the safety scanner flagged. It writes a short assessment for our moderators and either closes a report it is confident does not break our rules, hides the reported content when it is highly confident it breaks them and a second, independent automated check agrees (see below), or passes it to a human moderator. For that second opinion on a reported caption, transcript or comment it may send that text to a text safety classifier (currently Llama Guard, run by the same provider). When a live is reported, or the safety scanner flags one, it looks at the flagged frames and at any reported chat message, and it may end the live only when the scanner flagged it for sexual content, it reaches the same conclusion, and the host is known to be 18 or over; anything that might involve someone under 18 always goes to a human. Apart from ending a live in that case, it never restricts reach or acts against an account	Third-party model provider (currently Cloudflare Workers AI)	Reports, posts held back by the safety scanner, and lives the scanner flagged
Automated accuracy check ("fact check")	Where a post appears to make a checkable factual claim, an AI system searches the public web and returns an assessment with citations. A claim already checked is recognised by comparing a numerical representation of its text, so the same verdict can be reused for the same claim in another post	Third-party model provider + public search engines	Published posts flagged as making a factual claim (and stories, when story checks are switched on)
Anastasia support assistant	Answers your support questions. With your conversation it is given a short summary of your account so it can actually help: your display name, handle and email, how you sign in, whether 2FA is on, your language, how long you have had the account, whether business features, earnings and verification are active, your withdrawable balance, how many payout accounts and saved cards you have, legal documents waiting for your consent, and uploads in progress. When it looks something up for you (an account overview, your wallet, a withdrawal, a post) the result goes to it too	Third-party model provider (currently Cloudflare Workers AI)	Support conversations

You are talking to an AI

Anastasia is an AI assistant, not a human. It is labelled as such in the app. You can ask to be transferred to a human at any time. This disclosure is made in line with Article 50 of Regulation (EU) 2024/1689 (the AI Act).

Automated accuracy checks — what they are and are not

Where our systems detect that a post makes a checkable factual claim, an automated check may run after the post is published and display an assessment in the post's info sheet, together with the sources consulted. Please understand:

It is an automated assessment, not a statement of fact by Rosance, and it can be wrong. It is labelled as automated and shows its sources so you can judge for yourself.
It is never a moderation decision. It does not remove your post, restrict its reach, demote it in ranking, or affect your monetization. Where the assessment is that a claim is false, the post is shown in the feed behind a notice that viewers can tap through ("See anyway").
Creators can contest it. If you believe an assessment of your post is wrong, you can request re-checking in-app and you may contest it through the complaint process in our Terms of Use. We will correct or remove an assessment that is inaccurate.
Viewers can signal disagreement with an assessment. That signal is advisory only — it never changes the assessment or the ranking of the post.

Reports are reviewed by our AI moderator first

Every report goes first to the AI moderator described above. What it can and cannot do:

It can close a report when it is confident the content does not break our rules, for example when the safety scanner mistook a face or an arm for nudity. When it closes your report, the notice we send you says that an automated system made the decision, and you can appeal it through the complaint process in our Terms of Use, where a human decides.
It can take down a narrow set of content without a human review, only when it is highly confident and a second, independent automated check agrees:
- nudity or sexual content in a reported post or story that our safety scanner also flagged, and only when the account holder is known to be 18 or over;
- hate speech in a reported post or comment that the text safety classifier also judges to be hate;
- graphic violence in a reported post that our categorisation step also labelled graphic, or a violent threat in a reported post or comment that the text safety classifier also judges to be one;
- spam in a reported post or comment, when the same account posted the same text at least three times in seven days.
Posts and comments are hidden, not deleted, and come back as they were if an appeal succeeds. When the content may threaten someone's life or safety, a human moderator still reviews the report after it is hidden, to decide whether the law requires us to inform the police or Europol. It never acts on anything that might involve someone under 18. The author receives a statement of reasons that says an automated system took the decision, and can appeal it through the complaint process in our Terms of Use, where a human decides.
It can withhold our own automated output. If a report says an automated fact check or an AI description of a post or story is wrong and the AI moderator agrees, it hides that output until a human moderator confirms the decision or restores it. It never does this for a post that runs as an advert.
Everything else is a human decision. Removing any other content, restricting it, suspending or banning an account is always decided by a human moderator.
Child-safety reports always go to a human moderator, whatever the AI concludes.
Anything it is unsure about, and any report it cannot process, goes to a human moderator.

The assessment it writes is kept with the report as part of our moderation record (Section 6).

Automated decisions that hold content back

Two automated checks must pass before a post with photo or video goes live: the safety scan and the categorisation step. This means publication of your post can be delayed, or your post returned to drafts, by an automated process.

If the safety scanner flags your content, it is not deleted. It is held for review and you are notified. Our AI moderator looks at it first: if it is confident the scanner was wrong, your post is released and published; if it is highly confident the post shows nudity or sexual content our rules do not allow, the post is removed and you are told that this was an automated decision and how to appeal it. Otherwise a human moderator makes the decision.
If a check fails for technical reasons, your post returns to your drafts and you can retry it.

A new profile picture is scanned the same way before it appears anywhere. Here the outcome is different, and we state it plainly: a picture the scanner flags is refused automatically, without human review. Your previous picture stays in place, we tell you the photo was not accepted, and you can choose another one immediately. If you believe a photo was refused wrongly, you can contest it through the complaint process in our Terms of Use.

Every enforcement decision other than the AI moderator's removals described above (removal, restriction, suspension, demonetisation) is taken by a human moderator. For every enforcement decision, automated or not, you receive a statement of reasons and a right of appeal decided by a human (see our Terms of Use, Section 5).

Identity verification (KYC) is likewise always reviewed and approved by a human.

You have the right under Article 22 GDPR not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects on you, and the right to obtain human intervention, to express your point of view and to contest the decision. The appeal routes in our Terms of Use are how you exercise it.

6. Data Retention

Data	Retention
Content and its derived renditions	Until you delete it or close your account
Stories (the photo or video)	Visible to your audience for 24 hours, then kept in your private story archive, where only you can open it, until you delete it or close your account. Deleted within an hour of you deleting it
Story records (audience, when posted, watch count)	Kept with the story; 30 days after you delete it, so a reply to it in Direct Messages still makes sense, then deleted
Who watched a story	Deleted with the story record, or with either person's account
Live recordings	Available to the host for 30 days, then deleted. If we ended the live for breaking our Terms, kept until that decision can no longer be appealed, then deleted
A live's timeline (who joined, chat messages, likes, gifts, super chats and donations) and its preview picture	Deleted together with the live's recording. A chat message that has been reported is kept as a moderation record until the report and any appeal are closed
Still frames our safety scanner flagged in a live	6 months after the report and any appeal about that live are closed, then deleted
A live's summary (title, times, viewer and like counts)	Shown to the host in the Live studio until they delete their account
Money received or sent as gifts during a live	With your financial records (below)
Transcripts, categorisation results and safety-scan scores	For the life of the post; deleted with the post
Music you uploaded to the sound library	While the recording is in the library. Deleted when you discard the upload; a recording you withdraw or that we refuse is removed from the library, and the audio is deleted when you discard it
Your rights declaration for an uploaded recording (time, wording version, IP, browser)	While the recording is in the library, and 3 years afterwards, as the record of the permission that was given. Kept for that period even if the recording is withdrawn or refused, because a claim about a track can arrive after it is gone
Direct messages (ciphertext)	Until you delete the message/conversation for yourself or for everyone, or delete your account
Account data	Removed from our database immediately when you delete your account. Stored media files and your side of your conversations are erased by the clean-up described in Section 9, within 30 days of you asking for it. Except where law requires longer
Interest profile	Deleted with your account; individual signals age out continuously
Reminder schedule (when your time away began, which reminder is next) and your device's time zone	Replaced each time you come back or your device reports a new time zone; deleted with your account
KYC images, politically-exposed-person declarations and financial records	5 years after the end of the business relationship (Romanian Law no. 129/2019 and accounting law)
Tax reporting records (DAC7)	As required by tax law, currently 10 years
Moderation, enforcement and appeal records	As long as needed to enforce our Terms, handle appeals, and meet Digital Services Act obligations
Security logs and sessions (including each sign-in's IP address, device and country)	Lifetime of the session plus a short security window (7 days after it expires)
The country you sign in from most often	Recalculated on each sign-in; deleted with your account
Signed-out viewing records (random viewer key, post, watch time)	As long as the post exists
Ad delivery markers (shown, charged, tapped)	24 hours
Advertising campaigns, audiences, statistics and political declarations	With the advertiser's account. Political-ad transparency records as long as Regulation (EU) 2024/900 requires
Saved cards	Until you remove the card or close your account
Card-payment records, invoices and payout details	With your financial records (below)
Record of who opened your identity-verification photos	With your verification
Orders from authorities	As long as needed to comply with them and to report on them under the Digital Services Act
Fingerprints of removed content	Permanently, to stop it being uploaded again; they contain no picture and cannot be turned back into one
Copy of a deleted post with an open report	Until every report on it is decided; kept if a violation is confirmed
Record of each AI request (which account and post it was for, the cost)	400 days
Fact-check claim records	Reused while still current; deleted 30 days after they expire unused, even if the post is gone
Lenses you published to the catalogue	Remain available after you delete your account, without your name
Data exports	We keep none. The report is generated from your account when you open the download link and is not stored anywhere. Each link works once and stops working after 24 hours. If we close your account ourselves, we attach the report to the closure email instead of sending a link — see Section 9 — and we keep no copy of that either
Analytics	Pseudonymised; retained no longer than needed for the metric
Diagnostic logs and crash reports	30 days, then deleted automatically. Grouped crash statistics are kept longer to tell whether a bug has come back, but they carry no device or account identifier once the underlying reports are deleted
Mailing-list address after unsubscribing or account deletion	Kept indefinitely as a suppression entry, so you are not re-added by a later import. On account deletion it is unlinked from your account; you can ask us to erase it outright at privacy@rosance.com

7. Security

We apply technical and organisational measures appropriate to the risk, as required by Article 32 GDPR. We use only published, standard cryptography (NIST, IETF and PKCS standards); we implement no proprietary encryption of our own design.

Direct messages are end-to-end encrypted. Message text and message media are encrypted on your device with a fresh AES-256-GCM key for each message, wrapped to you and your recipient with RSA-OAEP-2048. Your private key is generated on your device, held in the operating system's secure keystore (iOS Keychain, Android Keystore) and never leaves it in readable form. We hold no copy of it, so we cannot read your direct messages and cannot recover them for you. Your private key is encrypted first with a key derived from a recovery PIN you choose (PBKDF2-HMAC-SHA256), and we store only that encrypted result. We never receive that PIN, so we cannot decrypt the backup and cannot reset it for you: if you forget it and no device still holds your key, that message history cannot be recovered. We add a second layer of encryption to the stored result using a key held in our application environment, so a copy of our database alone cannot be attacked. Media blobs are stored as opaque ciphertext in a private bucket.

Everywhere else. Passwords are hashed with Argon2id and a server-side pepper. Refresh tokens are stored hashed and rotated on every use, with automatic eviction of an entire token family on replay. All traffic is encrypted in transit with TLS. Identity-verification photos are encrypted on your device (AES-256-GCM, with the key wrapped by RSA-OAEP to a key held only by our review service), so the servers that receive and store them cannot read them; they are decrypted only in memory for an authorised reviewer, and every viewing is logged. Saved-card tokens are stored encrypted, and we never receive a full card number. Administrative access is role-based and audit-logged.

No system is perfectly secure.

We will notify you and the competent supervisory authority of a personal data breach where the GDPR requires it.

8. Your GDPR Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing is based on consent, you may withdraw consent at any time without affecting processing already carried out.

Two rights you can exercise instantly, with no need to contact us:

Analytics objection: Settings → Privacy → Analytics turns off all analytics collection for your account, on every device.
Objection to personalised ads: Settings → Privacy → Personalised ads switches off the use of your age and interests to choose ads, on every device (Section 4a).
Access and portability: Settings → Privacy requests a data export. We email you a download link — the email itself contains none of your data. Opening the link builds the report from your account right then, hands it to you, and keeps no copy. You get it two ways: a readable PDF covering every category of personal data we hold — your profile and preferences, your consent records, what you have posted and watched, the interest profile our feed builds, your wallet and payout details, your billing details and saved cards, your country (declared and detected), your safety and support history, and the individual posts, comments, views, notifications and transactions behind those figures — and a JSON file of the same data that you can take to another service. Each link works once and both stop working after 24 hours; ask again from Settings whenever you like. Because the report is built when you open it, it always reflects your account as it stands at that moment. A few things are named in the report but deliberately left out of it, because handing them over this way would put you at risk rather than inform you: your password (which we only ever store as an irreversible hash), any identity document you uploaded, and your full bank account number. Ask us and we will return those through an identity-checked channel.
Erasure: Settings → Privacy → Delete My Account deletes your account.

For anything else, contact privacy@rosance.com. We respond within one month, extendable by up to two further months for complex requests (we will tell you if that happens, and why).

You may lodge a complaint with your local supervisory authority or with the Romanian authority: ANSPDCP — www.dataprotection.ro.

9. Account Deletion

You can delete your account directly in the app: Settings → Privacy → Delete My Account — no email, no web form, no retention offer. Deletion takes effect immediately: your account, profile, posts and stories, comments, wallet access, transcripts, interest profile and the other records described in Section 6 are removed from our database, and nothing you posted can be seen or reached any more. Records we must keep by law (AML, tax, moderation) are retained for the periods stated and for nothing else.

Stored files and conversations go too. Deleting your account yourself runs the same clean-up as when we close an account (see below): the stored media files behind your posts, stories, comments and messages are erased, and your side of your private conversations is closed as described further down. If that clean-up cannot reach one of our systems at the moment you delete, your account is still deleted and the leftovers can no longer be found or opened through Rosance; write to privacy@rosance.com and we will finish it for you.

Money records are kept, without you in them. Accounting and tax law require us to keep records of money that moved through Rosance (Section 6). So when you delete your account, the records of your purchases, the gifts you sent or received (including during lives), promotions, ad budget, earnings and payouts are kept, but detached from you: your account link, name, handle, email and any message you attached to a gift are removed from them. What remains is the amount, the currency, the date, how it was paid and the transaction reference the app store or payment processor gave us, which we need for refunds, accounting and tax reporting. A withdrawal you requested before deleting your account is still paid to you, and its bank details are erased as soon as it has been paid.

If you signed in with Apple, deleting your account also asks Apple to revoke Rosance's access to your Apple ID, so the link between the two ends on Apple's side as well. If you linked Apple before we started keeping the token this needs, sign in with Apple once more before deleting, or remove Rosance from your Apple ID's "Sign in with Apple" settings yourself.

Your email address on our mailing list is a deliberate exception, described in Section 1 under "Email and announcements": the entry survives so that you are not re-added by a later import, but it is unlinked from your deleted account at the moment of deletion. Ask us at privacy@rosance.com if you would rather it be erased outright.

Video replies are a second exception, and an important one. If another user answered one of your comments with a video, your handle, profile picture and the text of that comment are part of their video's picture — not a record of ours that deletion can reach. Deleting your account removes your comment and your profile, and it removes the reply from the conversation thread, but the video someone else published keeps showing what it showed when they recorded it. We do not delete another person's video automatically, because it is their content and may have its own audience. If you want those videos taken down as well, write to privacy@rosance.com — we will locate the replies that quote you and handle them as removals.

If we close your account, we send you your data first. An administrator can close an account — for a Terms breach, a legal order, or at your request through support. When that happens we build your full data report before anything is deleted and email it to your account address, as the same readable PDF and machine-readable file you would get from Settings → Privacy → Download my data. It arrives attached to the closure message rather than as a download link, for the plain reason that a link would have nothing left to read from: your account is gone by the time you open it. Keep those files — once the account is closed we hold nothing to build a second copy from.

An administrator-initiated closure removes your account, your content and its stored files. The exceptions in this section apply exactly as they do when you delete the account yourself, as do the legal retention periods in Section 6.

Private conversations are a further exception, and it is worth being precise about. A conversation is as much the other participants' record as yours: they wrote part of it and received the rest. Closing your account therefore closes each of your one-to-one conversations rather than deleting them. The other person keeps the thread and can still read it; nobody can send anything more into it; your name stays on it, marked as an inactive account, so the history they keep still makes sense to them. In a group chat you leave the group, and the messages you sent stay readable to its members. Your own copy goes with your account, along with the keys that made it readable to you.

If you want a specific conversation removed for the other person as well, that is a request we handle individually — write to privacy@rosance.com before closing your account.

Handles other people wrote are a third exception. If an author tagged you — with the Mention sticker, which draws your handle into their video, or by typing @yourhandle into their caption — removing your tag and deleting your account both stop the link, the notification and the listing, and remove you from their tagged list. Neither reaches the handle itself where it sits inside their video's picture or inside a sentence they wrote. We do not edit another person's published caption or re-encode their video to delete a word, for the same reason we do not delete their video reply automatically: it is their content. If you want those posts taken down as well, write to privacy@rosance.com and we will handle them as removals.

10. Children and Young People

Rosance has a minimum age of 16. We apply that single threshold everywhere, because 16 is the highest age of digital consent any EU Member State sets under Article 8 GDPR — so we never need to rely on parental-consent verification. Date of birth is collected at sign-up and checked before an account is created. You can correct it afterwards from Settings → Profile; every change is re-checked against the same threshold, and — like your display name and handle — it can only be changed once every 30 days.

For users we know to be minors:

We do not show advertising based on profiling (DSA Art. 28(2)) — in fact we show anyone under 18, and anyone whose age we do not know, no ads at all (Section 4a).
They cannot buy anything on Rosance (gifts, promotions, live gifts, super chats or donations), cannot earn money from their content, and cannot go live. If we do not know someone's age, we treat them as under 18 for these purposes. They can watch lives and take part in their chat.
Child sexual abuse material is prohibited absolutely, removed on detection, and reported to the competent authorities. Our child safety standards are published separately and we operate an in-app reporting route for child-safety concerns.

If you believe a child is using Rosance in breach of this policy, contact us and we will act.

11. Changes to This Policy

We notify you in the app of material changes at least 15 days before they take effect and, where the law requires it, ask for renewed consent before then. Previous versions are available on request.

12. Change of Data Controller

Rosance is currently operated by an individual. We intend to transfer the operation of the service to a Romanian limited liability company (societate cu răspundere limitată) that we incorporate and control.

That company would then become the controller of your personal data. If that happens, or if control of the service transfers in connection with a merger, acquisition or transfer of the business:

we tell you in the app at least 15 days before the change takes effect;
the successor is bound by this Policy as it stands at the time of the transfer. A change of controller alone never widens the purposes your data is processed for, never extends a retention period, and never reduces your rights;
your rights under Section 8 are exercisable against the successor exactly as they are against us today, and your right to object, to withdraw consent, or to delete your account (Section 9) is unaffected;
the change of controller does not by itself introduce any new processor, recipient or international transfer. If one is added, we disclose it in this Policy first, as with any other change.

You do not need to do anything for your data to stay protected, and you may delete your account before the change takes effect if you prefer not to continue with the successor.