Roomline stores your account information and the property records and files you add. Each account has its own workspace. Password accounts use a stored password hash; social sign-in does not give Roomline your Google or Facebook password.
Account access
A session cookie keeps you signed in. Supabase deployments use email confirmation and password recovery emails. Older self-hosted installations may use a private recovery code instead. Your deployment operator manages the authentication configuration.
Google and Facebook sign-in
When available, you can choose Google or Facebook to sign in. Supabase, our authentication provider, receives your provider account identifier, email address, name, and profile information supplied with basic sign-in permissions, such as a profile photo. This information is stored with your authentication account and used to identify you, establish your session, and connect you to your Roomline workspace.
Property records
Only upload information you are authorized to store. The server operator can access the database and backups. Supabase deployments store records in Postgres and files in private Supabase Storage. Access through the app is restricted to your workspace.
Tenants and applicants who use a link
A landlord can send a tenant their own page and invite someone to apply. What a tenant or applicant sends through these pages goes into that landlord’s workspace and nowhere else, and the landlord may be emailed about it. An application asks for contact details, move-in plans, work and income, where the applicant lives now, an optional landlord and reference, pets, and smoking. It never asks for a Social Security number, and Roomline doesn’t run or store screening reports.
An applicant can change their application until it’s decided, or withdraw it, which deletes their answers at once. Otherwise the answers are deleted six months after the decision, the next time the landlord opens Roomline; the decision, its reason, and how the application measured against the landlord’s stated criteria are kept for three years as the landlord’s record. An invite that’s never answered stops working after two months.
AI assistants
You can connect an AI assistant, such as Claude or ChatGPT, from Settings → AI assistants. When you ask it something, Roomline sends it the records it requests: properties, rooms, tenant names and contact details, rental agreements, rent amounts and payment status, repairs, and upcoming dates. An assistant connected by sign-in can only read. A token you create with write access can also add and edit records; it cannot delete them or move money. The assistant’s provider, such as Anthropic or OpenAI, handles that data under its own privacy policy. Roomline does not receive your conversations.
For each connection Roomline stores a hashed token or sign-in grant, its access level, a label, and when it was created and last used, until you revoke it. Disconnect an assistant or revoke a token in Settings at any time; its next request is refused.
Service providers
Roomline is hosted on Railway, with Supabase for sign-in, the database, and file storage. If you subscribe, Stripe processes your payment; Roomline does not see your full card number. If you connect a bank for rent matching, Plaid shares that account’s transactions with Roomline. Addresses you look up are sent to Photon, an OpenStreetMap search, to find them. Your browser loads company logos on bills from Brandfetch, or Google’s site-icon service, asking by the company’s web address; nothing about your account is sent. Each provider handles data under its own privacy policy.
Umami counts visits to the public site, such as the home page, the blog, docs, and the sign-up and log-in pages, without cookies and without collecting personal data. It isn’t used in your signed-in workspace, or on tenant pages or applications.
When Roomline advertises on Facebook or Instagram, those same public pages load Meta’s pixel, which sets Meta’s cookie so Meta can tell which ad a visit or a sign-up came from. It sends the page visited and that a sign-up happened, never your name, email or anything in your workspace, and it never loads once you’re signed in. You can limit it in your Facebook ad settings or by blocking third-party cookies.
When you arrive from an ad, a post or a friend’s link, Roomline keeps that link’s campaign tags (or the friend’s code) in a cookie for 30 days and saves them with your account if you sign up, so we know which ads and posts bring landlords. Nothing else about your visit is kept.
After you sign up, Roomline notes when your account first reaches each step of setting up, such as each welcome question, adding a card and adding a first property, so we can see where setup is hard. It’s kept with your account, not sent anywhere else.
When Roomline advertises on Google, the public pages and the welcome page shown once after sign-up load Google’s tag, which keeps the ad click in a cookie so Google can tell which search and ad a sign-up came from. It sends the page visited and that a sign-up happened, never your name, email or anything in your workspace. You can limit it in your Google ad settings or by blocking third-party cookies.
AI suggestions
AI suggestions use TypeSafe’s Jev model through OpenRouter, and send something only at these moments. When you read a bill or a lease, or set a house up from its papers, the PDF’s words (not the file) are sent with the names of the property’s bills, rooms, agreements, and tenants; and when the Rent page shows bank deposits no rule claims, each deposit’s description, amount, and date with your agreements’ names, tenants, and rent. A lease’s words usually include tenants’ names and rent, and can include contact details.
The first time, the app shows what will be sent and asks you to allow it once for your account; nothing is sent before then. Jev only picks among the options Roomline offers, and what it picks is a suggestion you can check and change. You can turn AI suggestions off in Settings → Tools, and then nothing is sent.
When a tenant reads a language other than English, each message between you is translated once, after it’s sent: its words (not its photos or files) go through OpenRouter to a translation model, and the translation is kept with the message so both of you can see what was actually written. Turning AI suggestions off stops this too.
Roomline asks OpenRouter to route these requests only to model providers that, under OpenRouter’s policies, don’t store or train on them. OpenRouter and TypeSafe handle the data under their own privacy policies. Roomline doesn’t store what it sends.
Setup questions
After you sign up, Roomline asks a few questions: what you rent out, roughly how many properties, how you keep track today, what you want Roomline for, what you’d like it to add, how you heard about it, and anything else you choose to type. Your answers are stored in Roomline’s own database, linked to your account, and used only to set up your workspace and decide what to build. No third party receives them. Contact [email protected] to have them deleted.
Feedback
If you send feedback, your message, the topic you choose, and the Roomline page type, such as Board or Settings, are stored in Roomline’s own database. No third party receives it. Property addresses, tenant records, files, page URLs, and your email address are not attached. The message is linked to your account so it can be deleted on request. Roomline also keeps a private submission timestamp to limit feedback to once every 24 hours.
Contact [email protected] to request deletion of feedback you have sent.
Keeping a copy
You can export workspace records from your profile. Uploaded documents and photos can be downloaded from their respective records. Removing a file reference does not erase the original upload or server backups.
Retention and deletion
Records remain on the server until removed by the server operator. Self-service account deletion is not available yet. Contact the operator of this Roomline instance for deletion requests, retention details, or privacy questions.
For accounts on roomline.app, email [email protected]. To request account deletion, include the email address linked to your Roomline account and say that you want your account and associated data deleted. We may need to verify account ownership before processing the request.
Your privacy rights
You can ask to see, correct, get a copy of, or delete the personal information Roomline holds about you. Depending on where you live, laws such as the California Consumer Privacy Act may give you these rights. Roomline does not sell personal information or share it for advertising, and asking won’t change how you are treated.
If you are a tenant or applicant, your landlord added your information and decides what is kept, so ask them first; Roomline processes it for them and will help them respond. You can also email [email protected], and we will pass your request on or answer it where we can. We may need to confirm who you are first.
Back to Roomline