Privacy Policy
What room.md keeps about you, why, who else sees it, how long it stays, and what you can ask for. Written under Law No. 195/2024 on personal data protection of the Republic of Moldova, which follows the EU's GDPR.
Who is responsible
room.md is run by Vitali Coziulcov, a private individual in the Republic of Moldova, who is the controller of the personal data described here. Anything about this policy or about your data: hello@room.md.
room.md has no data protection officer. The law requires one from public bodies and from those who monitor people or handle sensitive data on a large scale, and room.md is neither — so a letter to the address above reaches the person who runs it.
What we keep
Your account: your name, email address and the identifiers of your sign-in, and your profile picture if you sign in with Google.
Your room: what you write in the journal, the photos, files and voice notes you add, the room you chose and how you set it up — frames, clocks, sound, the place name for the weather.
The people around it: whom you follow and who follows you, reactions, comments, notes left on a desk, invitations and gifts.
Your conversations with the assistant, and what it fetches from services you connect to it.
Technical data: your IP address, browser and device, the time of each request, and security cookies. room.md uses no analytics and no advertising trackers.
Why, and on what legal basis
To give you your room and everything in it — the journal, the assistant, the scenes, the letters: that is what you signed up for, so the basis is a contract (Article 6(1)(b) of Law 195/2024). An email address is required for an account; without one you can still walk into open rooms.
To keep room.md and the people in it safe — security logs, stopping abuse, the record of what an administrator did inside a room: our legitimate interest in a service that is not misused (Article 6(1)(f)).
To remember your theme and language on your device: your consent (Article 6(1)(a)), asked for once and withdrawn at any time under Cookie settings.
To answer a question a visitor asks in a business's room: the legitimate interest of the visitor and of the business in having it answered.
Where a law obliges us to keep or hand over something: a legal obligation (Article 6(1)(c)).
What you write
A journal holds what people do not say elsewhere — health, faith, family, love. room.md processes it only to keep it for you and to show it to the people you choose. A room is private by default, and who may read each entry is decided entry by entry.
Nobody at room.md reads rooms. An administrator steps into one only to help its owner or to deal with a report of abuse, and every such visit is written into that room's own log.
The assistant and AI
When you use the assistant, what you send it, and what it needs from your room to answer, goes to Anthropic, PBC. Voice notes are transcribed, and a photo of your room is repainted, by OpenAI, L.L.C. Under their terms for API customers, neither uses it to train its models.
The assistant writes drafts, suggestions and answers. It makes no decision about you that has legal or similarly significant effects, and nothing it writes is acted on without you.
Who else receives it
Only the companies that run a part of room.md for us, each for its own part: Railway Corp. hosts the database and the API on servers in Amsterdam; Vercel Inc. serves the website and sees the IP address of every visit; Cloudflare, Inc. keeps uploads and artwork in storage under EU jurisdiction and protects sign-in; Clerk, Inc. handles sign-in and account identity; Anthropic, PBC and OpenAI, L.L.C. as above; Postmark (ActiveCampaign, LLC) sends our email; Zoho Corporation receives the mail written to hello@room.md.
Smaller ones, with less: the place name you give the weather window goes to OpenWeather Ltd; when the assistant searches the web, the search words go to Tavily or Brave Search; when you play a radio station, your browser connects to that station directly, and it sees your IP address.
Services you connect yourself — Google, Microsoft, Telegram, Slack, Notion and the like — exchange data with room.md as you set them up, under their own terms.
We do not sell personal data and show no advertising. We hand data to an authority only when a law obliges us to.
Outside Moldova
The database and the files are in the European Union. Several of the providers above are companies in the United States, and part of what they do for us — sign-in, the assistant, email, the IP address of a visit — is processed there.
Those transfers rely on the standard contractual clauses adopted by the European Commission, which Article 46(2)(c) of Law 195/2024 accepts as an appropriate safeguard; they are part of each provider's data processing terms. Write to us for a copy.
How long we keep it
Your account and your room: for as long as you keep them. When you delete your account, it is erased from the live database at once, and from backups as they are replaced, within 30 days.
Something you delete — an entry, a comment, a conversation: 30 days, so that a mistake can be undone; then it is erased.
A visitor's question to a business, and its answer: 90 days.
The log of what was done in a room, and the record of what the assistant was used for: 12 months.
One count outlives that: how many rooms have been painted for you, which the free allowance counts for as long as your account exists — kept with no name or email attached.
Request logs at the hosting providers: from a few days to a few weeks, for diagnosis. Letters to hello@room.md: until the matter is settled, and at most 12 months after.
Your rights
You may ask what we hold about you and get a copy of it; correct it; have it erased; restrict how it is used; take it with you in a format another service can read; object to processing that rests on our legitimate interest; and withdraw a consent at any time, without affecting what was done before.
Your name, language and time zone can be changed in Settings, and Settings → Your data lets you download everything or delete your account yourself. For anything else, write to hello@room.md.
It is free. We answer within one month; a complex request may need two months more, and if so we tell you within the first month. We may ask you to confirm that the request comes from you.
If you want to complain
You may complain to the supervisory authority: the National Center for Personal Data Protection (CNPDCP), 48 Serghei Lazo St., MD-2004 Chișinău, Republic of Moldova; centru@datepersonale.md; +373 22 820 801; datepersonale.md.
Telling us first is welcome and often quicker, but it is not required.
Children
room.md is for people aged 14 and over — the age from which Article 8 of Law 195/2024 lets a person agree to an online service on their own. If we learn that an account belongs to someone younger, we delete it.
Security and breaches
Everything travels encrypted, each part of the system reaches only what it needs, and an administrator's visit to a room is logged.
If personal data is ever exposed, we notify the CNPDCP within 72 hours of learning of it, and tell you directly, without delay, when the risk to you is high.
Asking a business a question
Some rooms belong to a business and have an assistant that a visitor may ask without an account. The question, and the rest of the conversation in that visit, are sent to Anthropic, PBC, the provider of the AI model, which writes the answer from what the business has published. Anthropic processes them on its own infrastructure, outside Moldova and possibly outside the European Union.
We keep each question and its answer for 90 days so that the owner of that room can read what visitors ask, and then delete them. We do not store your IP address or anything else about you with them — so do not type into the box what you would not want the business to read.
Changes and contact
When this policy changes, the date at the top changes with it; when a change matters, room.md says so before it takes effect.
Questions, requests, or anything here that is unclear: hello@room.md.