Room holds your calendar and, if you connect it, your health data. We think the only honest way to earn that is to make the protections structural, built into the database, the encryption and the code paths, and then show you exactly what they are. This page lists only what is built into Room today; the privacy policy is the legal version. No ads and no data sales, ever.
Every table that holds your account's data has PostgreSQL row-level security enabled and forced, so the database itself refuses to return another person's rows even if the application asks for them. The services you use connect through a database role that cannot get around this, and an automated test fails if such a table is ever added without it. Background jobs that sync your sources run under a separate database role. During the beta, the founding team can read the log of questions and answers described in the privacy policy.
The keys to your connections, the files you upload and the tokens that let your iPhone receive nudges are encrypted with AES-256-GCM before they are stored, and the encryption key is kept outside the database. Everything travels over HTTPS.
When Room answers a question, your health numbers are not given to the language model. The answer is worked out from your record, and your numbers are added to it afterwards. Automated tests check this.
Room answers from your own data. When the data isn't there, it says so instead of guessing, and it holds a pattern back until there is enough history to show it. Your data is never used to train AI models.
From a calendar, Room keeps each meeting's timing, a title of up to 120 characters and up to eight attendee names, never their email addresses. Descriptions, locations, links and notes are not stored. Your employer sees nothing: Room is yours, not theirs.
From Gmail, which is optional and read-only, Room keeps short task lines for bills, renewals and emails waiting on your reply, each with the subject line, a short excerpt and a link back to the message. Full message bodies are never stored, and facts drawn from your email are deleted after 21 days.
Your account, database and files are hosted by Amazon Web Services in London, and the database is backed up there every day. When an answer needs a language model, Room uses Anthropic's Claude through AWS Bedrock in the UK and EU, which does not train on your data. Daily limits on AI use, for each person and for the whole service, keep usage bounded.