Privacy Policy

1. Data controller

Roastpit ("we", "us", "our") operates roastpit.io, an AI debate entertainment platform. For the purposes of applicable data protection law, we are the data controller for personal information collected through the service. Questions or requests may be sent to support@roastpit.io.

2. What we collect

We collect the following categories of personal data:

• Account data — email address and display name when you register via Google OAuth or email/password.
• Debate content — topics you submit and AI-generated responses produced during your debates.
• Usage data — pages visited, debate activity, vote history, credit balance, and interaction events (e.g. debate started, winner voted).
• Payment data — handled entirely by Stripe. We receive only a non-sensitive transaction record (amount, date, masked payment method). We never see your card number or billing address.
• Technical data — IP address, browser and device type, and error reports used for service monitoring and fraud prevention.

3. Legal basis for processing

We process your personal data on the following legal bases under applicable law:

• Contract performance — to provide and operate the Roastpit service, manage your account, and fulfill purchases.
• Legitimate interests — to monitor service performance, prevent abuse, and improve the product through aggregated analytics.
• Legal obligation — to comply with applicable laws and respond to lawful requests from authorities.
• Consent — for optional analytics cookies where required by local law. You may withdraw consent at any time via our Cookie Preferences page.

4. How we use your data

• To provide, maintain, and operate the Roastpit service
• To manage your account, credit balance, and debate history
• To process payments securely via Stripe
• To detect and prevent abuse, fraud, and policy violations
• To monitor errors and service performance
• To send transactional communications (account confirmation, material policy updates)

We do not sell your personal data to any third party. We do not use your debate content to train any AI model.

5. Third-party processors

We share data with the following sub-processors solely to operate the service:

• Supabase — authentication and database storage
• Stripe — payment processing
• OpenRouter — routing AI model calls for debate generation
• OpenAI — content moderation and optional voice synthesis
• PostHog — product analytics (anonymised where possible)
• Sentry — error and performance monitoring

Each sub-processor is contractually bound to process data only as necessary to deliver their service. Their own privacy policies govern their handling of that data.

6. Data retention

We retain account data for as long as your account remains active. Debate content is retained to support replay and leaderboard features. If you close your account or request deletion, we will remove your personal data within 30 days, except where retention is required by law or legitimate business need (e.g. transaction records for tax purposes).

7. Cookies and tracking

We use cookies for authentication (Supabase session token) and product analytics (PostHog). Necessary authentication storage is always enabled, but analytics storage is only enabled after you consent. See our Cookie Preferences page for details and opt-out options.

8. Your rights

Depending on your jurisdiction, you may have the following rights over your personal data:

• Access — request a copy of the data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your account and associated personal data.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — request that we restrict processing in certain circumstances.
• Objection — object to processing based on legitimate interests.

California residents have additional rights under the CCPA, including the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

To exercise any right, email support@roastpit.iowith the subject line "Data request". We will respond within 30 days.

9. Data security

We implement industry-standard security measures including encryption in transit (TLS), access controls, and regular security reviews. In the event of a data breach that poses a risk to your rights, we will notify affected users as required by applicable law.

10. International transfers

Roastpit is operated in the United States. If you access the service from outside the US, your data may be transferred to and processed in the US or other countries where our sub-processors operate. We ensure that all such transfers are subject to appropriate safeguards under applicable data protection law.

11. Children

Roastpit is not intended for users under 18. Debates involve morally grey topics and AI-generated content that may include strong or provocative language. We do not knowingly collect personal data from anyone under 18. If we learn that we have done so, we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to registered users via email at least 14 days before they take effect. Minor changes (e.g. clarifications) will be reflected by updating the date above. Continued use of the service after changes take effect constitutes acceptance.