Last updated September 7, 2026.
This notice covers the Roomade iOS app (not the waitlist site, which has its own notice). It's written to meet Malaysia's Personal Data Protection Act 2010 as amended (PDPA) and South Korea's Personal Information Protection Act (PIPA).
Hakeemi Ridza, Jasin, Melaka, operating as “Roomade.” Contact: roomadeofficialmy@gmail.com for any privacy question, including the rights listed below.
Email address and password, handled entirely by our backend provider, and we never see or store your password in plain text. If you sign in with Apple or Google instead, we receive the name and email your account there chooses to share with us.
Display name and avatar photo. These are visible to any signed-in Roomade user, not only your own housemates. This is a deliberate tradeoff in how the app is built, so treat your profile as semi-public within the app, not private to your household.
Everything you and your housemates create to run the household: cards (Issues/Needs, Spends, Heads-Up announcements), claims and resolutions, comments and activity history, and Heads-Up acknowledgements. Anything you type into a card's title, description, or comment is stored as-is and visible to your household.
Message text, GIFs you send, who you @mention, and read receipts. Read receipts are visible to your entire household, so people can see who's read what. Typing indicators are transient and not stored. Message content is not end-to-end encrypted, so our backend can technically access it to operate and troubleshoot the service.
If you add a way for housemates to pay you back, we store, depending on what you enter: a DuitNow QR payload, a payment link (e.g. Toss, KakaoPay, PayPal.me, Wise), or a bank name, account number, and account holder name. This is a more restricted part of our database than your profile, visible only to people who share a household with you, but it is stored in full (not masked) on our servers, only masked when displayed on-screen.
Who paid, how much, who owes what share, and whether it's been marked paid, if you use the expense-splitting (Settle Up) feature.
A push-notification device token, and your notification preferences (which types of alerts you've turned on or off). Push notification previews never contain your actual message content, only generic text like “New activity in your household.”
Camera access to scan a housemate's invite QR code (not stored). Photo library access to attach images to cards, set your profile photo, or save your household's DuitNow QR code to your device so your banking app can scan it. For that last case we only request the limited “add” permission, not full read access to your photo library.
A daily activity-streak counter tied to your account.
Only your currently active household ID, stored in standard app preferences. Your login session is stored securely by our backend SDK using the iOS Keychain.
No location data, no advertising identifiers, and no tracking across other apps or websites (so no App Tracking Transparency prompt is needed). No analytics or crash-reporting SDK is active in the app.
To operate the household coordination features you use: assigning chores, tracking shared expenses, chatting with housemates, and notifying you of activity. Under the PDPA, our basis is your consent at signup plus performance of the service you've asked for. Under PIPA, the basis is contractual necessity for the household features you actively use.
We don't sell your data or share it with advertisers.
Our backend is hosted in Singapore. For our Korean users, this means personal data, including chat content and payout details, is transferred outside Korea. Per PIPA Article 28-8, here are the specifics:
Firebase Cloud Messaging and GIPHY may process data on servers outside both Malaysia and Korea (typically the US) as part of their own global infrastructure.
We keep your account data for as long as your account is active. If you delete your account or leave a household, content you've contributed (chat messages, card activity, comments, and payout details already visible to that household) stays part of the household's shared record, since other members co-own that history the same way a group chat isn't erased for everyone when one person leaves. Your login credentials and profile (name, avatar, email) are deleted from active use once your account is closed. To close your account, email roomadeofficialmy@gmail.com; we'll act within 21 days.
You can ask us to access, correct, delete, or withdraw consent for your data, and to stop processing it, which is functionally the same as deletion, since we only process it to run the app. This maps to your rights under Malaysia's PDPA (Sections 30–32 and 38) and South Korea's PIPA (Articles 35–37). Contact roomadeofficialmy@gmail.com; we'll act within 21 days.
Row-level security means payout details are visible only within your household, and chat and household data only to household members. Traffic is encrypted in transit (HTTPS).
Not directed at children. Under PIPA, we don't knowingly collect personal information from anyone under 14 without verified consent from a legal guardian. Under Malaysia's general law of capacity, we don't knowingly collect personal information from anyone under 18 without a parent's or guardian's consent.
Under the PDPA, we'll notify the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi) within 72 hours of becoming aware of a breach likely to cause significant harm, and notify affected individuals within 7 days of that Commissioner notification. Under PIPA, we'll notify affected users and the Personal Information Protection Commission (PIPC) without delay where the breach requires it.
Malaysia: Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi). Korea: Personal Information Protection Commission (PIPC), or report a breach to KISA's Privacy Call Center at 118.
Hakeemi Ridza, Jasin, Melaka. roomadeofficialmy@gmail.com