Privacy Policy

Last updated October 25, 2026

wroom| is a place for role-players and storytellers to write together. You create characters and write as them, on your own page and in shared worlds called wrooms alongside other writers. You can also write as yourself, to plan with other writers and on your own writer profile. The characters are fiction. You are not.

wroom| is operated by wroom Inc., a Canadian corporation. This policy explains what data wroom| collects, why, who else ever sees it, and what you can do about it.

Information we collect

Account information - your email address and a username, provided when you sign up. We never store your password itself, only a scrambled version of it that cannot be turned back into the password. Nobody here can read it, and we cannot tell you what it is if you forget - you reset it instead.
Your date of birth - asked for when you set your account up. It is used only to decide what the app may show you, such as keeping mature-marked worlds away from younger writers, and to keep people under 13 off the service. It is never shown to anyone.
What you write - your characters, their profiles, your posts and replies, your drafts, and any images you add. Some of it stays on your device and your account alone; the rest is read by other writers, which is the point of a shared world. You decide which: every character carries a privacy setting, and every wroom you make is either invite-only or public.
Who you follow, and what you react to - the writers and characters you follow or watch, and the posts you like, repost or quote. These make your feeds work, and some of them are visible to the writer on the other end.
A push address, if you turn notifications on - a device token issued by Apple or Google and held by Expo's push service, plus which platform the device is. It is dropped when you sign out, and it is not used for anything but the notifications you asked for.
Supporter Pass purchases - if you subscribe, Apple or Google tells us the transaction's identifier, which store it was made on, the subscription's status, and when it renews or ends. We use this only to give your account Supporter Pass and to handle cancellations and refunds. We never receive your card or payment details.
Reports you file, and reports about you - what was reported, why, and what was decided. Kept because a moderation decision that leaves no record cannot be reviewed or appealed.
Technical data - your IP address is seen by our servers on each request and used for rate limiting and abuse prevention. When you sign in, and when the app reports an error, we record what you are using: the device model, its operating system version, whether it is a phone or a tablet, and the app version. We keep it to reproduce bugs and to know which devices need testing. Error reports are linked to your account, so a problem you tell us about can be matched to what the app recorded. We do not keep a profile of your browsing.
A device key, to enforce bans - the first time you open the app it creates a random code and keeps it in your phone's secure storage. It's sent to us when you sign up, sign in or open the app, and we store it only in scrambled (hashed) form. We use it for one thing: if an account is suspended, no new account can be created from the same device. It isn't your phone's serial number or advertising identifier, and other apps can't read it.

We do not sell your data, and your fiction - your characters, posts, and images - is never shared with advertisers or with generative AI companies.

What other people can see

wroom| is a place to write with people, so most of what you write is meant to be read. This is who reads what:

A post in a shared wroom is read by everybody who can read that world. If the world is public, that is anybody with the link, including people with no account. If it is invite-only, it is the writers in it.
A post on your own page, or a character's page is read by anyone who can see that page, subject to the privacy setting on the character.
Your characters carry the name, picture, colour and profile you gave them into every world they join, and onto their own page.
Your reactions are attributed. A like, a repost or a quote is visible to the writer whose post it was, by name.
Your follows are visible. Who follows a writer, and who they follow, can be opened from their profile.
Images ride on a plain web address with no sign-in in front of it, so pictures on public pages load for anybody. The address is long and unguessable, but anyone who has it can open it.

What is not read by anyone else: your drafts, your email address, your date of birth, your account settings, and the reports you file.

Keeping the place safe

Posts written in shared worlds may be checked automatically for a small number of things nobody wants to read unwarned, and may be put behind a warning cover or sent to a human to review. Posts are passed through a series of classification and language models to derive a score for each of those things; the scores are what the check acts on.

Images are checked the same way, before they are shown to anyone: every picture you upload - a face for a character, a banner for a world - is passed through the same models and scored. An image that crosses a line is not published, and you are told it cannot be used here. An image the check could not look at is not published either; you are asked to try again.

You also have your own controls, and they are stronger than ours: you can mute or block an individual character or a whole writer, and their work leaves your feeds.

AI

wroom| is not an AI company and will not sell itself out as an AI company. You will not see "wroom|AI" or similar products inside the app, and we will not build AI writing tools or character creation tools into wroom|. The core of wroom|'s mission is to build a platform for writer creativity and expression, and that cannot happen if AI is doing the writing for you.

wroom| will never use generative AI for creative content such as writing, logos, artwork or images, whether in-app or for promotional and marketing material.

Your writing and your data will never be sold or used to train generative AI models, unlike current big tech companies. Where applied as extensions to our human developers' tools, AI coding assistants are used for bug detection, feature testing and security reviews, entirely on our own source code. This means these assistants never touch your writing, and nothing you write will ever be used to train generative AI models.

We will also never knowingly promote AI-generated wrooms or writing throughout the app. That said, we cannot pretend we can detect generated text or images 100% of the time, and we will not ban or moderate writers solely for using these tools themselves. Instead you have moderation tools of your own - character-level and writer-level muting and blocking - to filter out content you believe to be AI-generated.

We are also exploring ways to keep AI from flooding the app, such as spam moderation and blocking suspicious fake accounts. We want everyone writing with real people, not AI bots. Every writer on wroom| today is real, and we hope to keep it that way.

Advertising

wroom| shows occasional sponsored cards in the feed, delivered by Google AdMob. The Google Mobile Ads SDK is included in the app for this, and may collect:

your device's advertising identifier and similar device identifiers;
which ads you were shown and interacted with;
app interaction, performance, and crash diagnostic data;
your IP address, used to estimate a general location.

On iOS the app asks your permission before using the advertising identifier to personalize ads (Apple's App Tracking Transparency prompt). If you decline, you still see ads - they are simply not personalized. On Android you can reset or delete your advertising ID in system settings.

Google acts as an independent controller of the advertising data it collects; see how Google uses data from apps that use its services.

Photos

wroom| asks for access to your photo library only when you choose to add an image, such as an avatar or banner for a character, a picture for a character's gallery, or an image for a wroom. Only the images you select are used. wroom| does not use your camera, and does not read or upload anything else in your library.

The app resizes an image on your device before uploading it. The image is then stored on our servers, checked as described under Keeping the place safe, and shown wherever you placed it. You can withdraw photo access at any time in your device settings; images you have already added remain part of your content until you remove them or delete your account.

How we use your information

To create and secure your account and authenticate you.
To store your writing and sync it across your devices.
To show your writing to the people you chose to share a world with.
To keep the place safe, as described above, and to act on reports.
To answer you when you write to us.
To show ads that help keep wroom| free, as described under Advertising.

Third parties who interact with your data

wroom| is run by a very small team on other people's infrastructure. This is a list of every outside company that interacts with or receives any of your data, and the capacity in which each one is involved in wroom|.

Cloudflare - runs wroom| and stores the database holding your account and your writing, and the object storage holding your images. It also runs the language models used in the checks described above; what Cloudflare does with what they read is set out in their own policy.
OpenAI - used solely for the automatic moderation checks described above, on posts and on images. The endpoint is free; we pay OpenAI nothing to run them. OpenAI's published policy for this endpoint is that any data passed through it is never used to train their models and is not retained beyond thirty days (their policy). It reads the post or the image and returns a score. If that policy changes, wroom| will update our position accordingly. On top of this, no account information is sent with the text or the image - not your name, your email, your device, or anything else identifying you.
Google (AdMob) - the advertising data described above. Google acts as an independent controller of it, not on our behalf.
Expo - builds and delivers the app, and relays push notifications; its push service receives your device's push token and the text of the notification, which includes a short preview of the post it is about.
Apple and Google - distribute the app through their stores and deliver the push notifications to your device.
Resend - sends the emails we have to send you, such as address confirmation and password resets. It receives your email address and the message.
Sentry - receives error reports when something in the app or the server goes wrong, so we can fix it. It is configured not to collect personal information.

Apart from Google's advertising role, these providers process data on our behalf and under contract, and are not permitted to use it for their own purposes. We do not sell your data to anyone.

Data retention and deletion

We keep your account and content until you delete them. You can delete your account at any time from inside the app: Settings, then Delete my account.

We also keep routine encrypted backups of the database so that a fault or a mistake cannot destroy everyone's writing. Backups are kept for up to 30 days and then destroyed; deleted content persists in them until they age out, and is only ever used to restore the service as a whole.

We also keep the earlier versions of each of your characters for 30 days after they are replaced, so that a fault or a mistake cannot lose their writing. A character you delete stays in that history for 30 days, and the whole history is erased with your account.

Deleting takes your account out of sight immediately and schedules it for permanent deletion after 7 days. During that week you can sign back in and restore everything exactly as it was. Once the week is up, your account and its content - your characters, your posts, your drafts, your images, and any push address - are erased for good and cannot be recovered by anyone, including us. The wrooms you run alone are the one thing to settle: before you confirm, the app lists them and lets you transfer each one to another writer, or all of them at once. Any you do not transfer go out of sight with your account, come back with it if you restore it, and are deleted along with it once the week is up; what other writers wrote in them stays. Everything else goes, including the parts your characters took in other people's worlds. Where somebody replied to one of them, their reply stays and the post it answered does not, so what is left reads as a gap rather than as your writing under somebody else's name. If you cannot reach the app, email contact@wroom.studio from your account email and we will remove it for you.

Where the law asks us to name a basis on retention and permissions, we rely on: performing our contract with you, for your account, your writing and the sync that makes the app work; your consent, for push notifications, for the photo library, and for personalised advertising where you were asked; and our legitimate interests in keeping the service secure and moderated, for rate limiting, abuse prevention and moderation records. Where you gave consent you can withdraw it, in your device settings or by turning the feature off.

Children under the age of 13

wroom| is for people aged 13 and over. It is not directed to children under 13, we ask you to confirm you are old enough before an account is created, and we do not knowingly collect personal information from anyone younger. If you believe a child under 13 has made an account, email contact@wroom.studio and we will delete it and its data. Ads shown in wroom| are not directed to children, and the app is not registered with either store as a child-directed or family app.

Changes to this Privacy Policy

If this policy changes, we will update the date above and post the revised version here. If a change materially affects what we collect or who sees it, we will tell you in the app rather than leaving you to notice.

Contact

If you have any questions, connect with us directly through our contact page.