Informativa sulla privacy

1. Introduction

Rose ("Rose", "the App") is operated by Mimi Studio d.o.o., a limited liability company organized under the laws of the Republic of Slovenia, with its registered office at Trubarjeva cesta 79, 1000 Ljubljana, Slovenia ("Mimi Studio", "we", "us").

This policy explains what Rose collects, why, who it is shared with, and what you can do about it. For the purposes of the General Data Protection Regulation (GDPR), Mimi Studio is the data controller.

Rose is a daily stretching and mobility app. It is designed so that most of it works without an account at all — the routines, the timers, the library and your progress live on your phone, and you can use Rose indefinitely without telling us who you are.

2. The short version

• Your health answers never leave your phone. See section 4; this is the most important thing in this document.
• The routine builder can send the sentence you type to two other companies, and only if you allow it. It never sends your health answers. See section 5.
• You do not need an account to use Rose. One is offered only after you subscribe, and only so your progress survives a new phone.
• Rose sends no push notifications and holds no push token. Reminders are scheduled by your phone, locally.
• You can delete your Rose account from inside the app. Section 12 explains what is deleted and which records must be retained.

3. What we collect

3.1 Information you give us

• Account details — your first name and email address, if you create an account. An account can only be created after a subscription is confirmed.
• Onboarding answers — your preferred time of day, experience level, focus areas, goals, gender and age band.
• Reminder time, if you set one. This stays on your device and is never sent to us.
• Custom routine names and selections — names you enter, the exercises you choose and the changes you make. Your custom routines are stored on your device; creation and editing events, including the name, are also sent to product analytics.
• Support correspondence, if you write to us.

3.2 Information collected automatically

• Device and install identifiers — an install identifier, your device's vendor identifier, and the advertising identifier only if you allow tracking when iOS asks.
• Usage — routines completed, streaks, session timings, which exercises you finished, and interactions with the app.
• Approximate location — Mixpanel derives your city, region and country from the internet address used to send analytics. This is not GPS location; Rose does not request access to your device location.
• Derived signals — the length of a search query or a routine-builder prompt and the number of results. Search-query and builder-prompt text are not sent to analytics. Custom routine names are collected separately as described in section 3.1. Where a builder prompt travels is section 5.
• Diagnostics — crash and error reports.

3.3 Information from third parties

• Subscription state from Apple, Google or Stripe through RevenueCat: the transaction identifier, which product, whether it is active, and renewal dates. We do not receive your full payment card number or security code.

4. Your health answers stay on your phone

During onboarding Rose asks whether any of the following apply to you: osteoporosis or thinning bones; glaucoma or raised eye pressure; a hip replacement; a neck condition or past neck injury; pregnancy or recent birth; high blood pressure.

These answers are stored only in your phone's local storage. They are never transmitted to us, never stored on our servers, never shared with any analytics or advertising service, and never included in a crash report. Our database has no field for them.

They are used on your device alone, to make a relevant safety warning more prominent and to exclude unsuitable exercises from a generated routine.

Two consequences worth knowing:

• Answering is optional and refusing costs you nothing. Safety warnings are shown to everybody regardless of what you answer; your answers only make a matching one more prominent.
• They do not travel. If you get a new phone or reinstall Rose, you will be asked again. That is the trade we chose deliberately: your health information never being on a server is worth more than not re-ticking six boxes.

You can clear them at any time from the app.

5. The routine builder, and what it sends

Rose's routine builder lets you type a sentence and builds a routine from it — for example, "my lower back is stiff from driving".

With your permission, Rose sends that sentence to a server, so that it can work out which part of the body you mean. You are asked first, on a screen that lists what will be sent and names the companies that receive it. Nothing is sent until you say yes.

You can use the builder without sending your sentence. Rose then interprets it on your phone and chooses from the bundled exercises. This also happens when you are offline or a remote request fails. The local interpretation can differ from the remote interpretation; both use Rose's exercise catalogue and the safety filters on your device.

Remote interpretation requires an active subscription. You can identify it by signing into Rose or, on iOS, by letting Rose verify your existing Apple purchase without a Rose account. A daily limit of three sentences applies to the account or Apple subscription used for the request.

5.1 What is sent, and how we get it

You type the sentence yourself, into the builder, and it is sent when you ask for a routine after allowing remote processing. The request also includes the app language, the selections below and authentication for the subscription and daily-limit checks.

Of your information, only your sentence and your language are passed on to the model. The three chips and your authentication are used by Rose's server and are not passed on to the model. The model also receives Rose's fixed instructions and exercise catalogue, which contain no information about you.

5.2 What is never sent

• Your health answers. The six caution conditions in section 4 are not in the request, not on our server, and not in anything the model is shown. The request has no field for them, and never has.
• Your age band, your gender, your preferred time of day, or the focus areas you chose at setup.
• Your routines, your streak, your history or your favourites.
• Any advertising identifier or device hardware identifier. The subscription customer identifier described above is used only for subscription checks.
• Who you are, as far as the model is concerned. Our own server sees who is asking, so that it can check your subscription and count how many requests you have made today. The model is never told who you are.

5.3 Who it is sent to

What each of these two companies does with what it receives is governed by its own published privacy terms, which you can read for yourself at https://www.cloudflare.com/privacypolicy/ and at https://openai.com/policies/.

Rose's own server also asks RevenueCat whether your subscription is active. It sends the account or subscription customer identifier for that — no part of your sentence and no Apple proof from this request. RevenueCat is already listed in section 9. Apple certificate-status checks validate the proof's signing certificates; they do not send your sentence or transaction proof.

5.4 What is done with it

Your sentence is used to interpret the kind of routine you requested.

The model can suggest body regions, routine characteristics and exercise identifiers from Rose's catalogue. It can also write a short description that Rose displays if it passes the app's checks. An invalid description is omitted.

Your phone checks suggested exercise identifiers against the bundled catalogue, applies your local caution filters and composes the routine. Exercise instructions, the routine title and hold times come from Rose's own content and rules. The model does not create new exercise instructions or diagnose a condition. Its suggestions and description can be wrong; they are not medical advice.

Rose does not use your prompt for advertising or attach it to an analytics profile.

5.5 How long it is kept

• Rose's own server does not write your sentence down. It is not logged, not stored in a database, and not sent to any analytics or crash-reporting service. It is held only for as long as it takes to answer.
• Our server keeps how many requests you have made today against your account identifier or a hash of the Apple subscription's original transaction identifier. For signed-in accounts it also caches whether the subscription was active when last checked. Guest subscriptions are checked on each request. These limits are tracked separately for an account and an Apple subscription. The count resets each day, and the whole record deletes itself within seven days of the last time you used the builder. The signed Apple proof is used only to validate the request; Rose does not log or persist it. Account deletion does not immediately erase the separate Apple-subscription counter.
• We record the length of what you typed and whether a routine was produced. We never record the text. This is the same rule as section 3.2.
• Cloudflare and OpenAI process the request under the service terms described in section 5.3. Rose's application-level logging rule above does not describe every record those providers may retain under their own terms. OpenAI's published API data policy allows abuse-monitoring records to be retained for up to 30 days, or longer when required by law or reasonably necessary to protect its services or third parties from harm. Applicable provider retention controls can change this; Rose does not promise a fixed deletion deadline.

5.6 Changing your mind

You can change your answer at any time, in Profile → SETTINGS → Rose AI. The row shows whether sending is allowed, and opens the same screen you were first asked on, so that saying yes stays as informed as it was the first time. Withdrawal takes effect immediately, and does not affect anything sent before it.

6. Apple Health

If you allow it, Rose writes your finished routines to Apple Health as workouts.

Rose requests no permission to read anything from Apple Health — not heart rate, not weight, not cycle data, not steps, not anything else. The data goes from your phone to Apple's Health store, which you control. We never receive it and we keep no copy.

This is off unless you turn it on, and you can revoke it in iOS Settings at any time. Refusing costs you nothing; routines work identically.

7. How we use your information

8. Legal bases (GDPR Article 6, and Article 9 where noted)

• Contract — subscription state and, if you choose to create an account, account details. An account is not required to use subscription features.
• Consent — personalisation, marketing email, Apple Health, and sending your routine-builder sentence to the companies in section 5.
• Explicit consent (Article 9) — your health answers, which are special-category data. This is asked for separately, may be refused without losing access to the app, and may be withdrawn.
• Legitimate interests — product analytics, crash diagnostics and fraud prevention, balanced against your rights. You may object.
• Legal obligation — transaction records we are required to keep for tax and accounting purposes.

9. Who we share it with

We do not sell your personal data. We share it with the following processors, each under a data processing agreement:

Product-analytics events and profiles are also sent to our configured self-hosted PostHog service. Automatic capture of taps and session recordings are disabled in both analytics tools. Analytics uses an install identifier before sign-in and links that activity to your account identifier when you sign in.

The routine builder adds two more, and only if you allow it. What each of them receives, and what it does with it, is set out in section 5:

If you buy through Rose's website, FunnelFox operates the checkout journey and Stripe processes payment and recurring billing. Checkout, order, customer and subscription details are used to fulfil that purchase and link access to Rose. Stripe receives the payment details you enter; your full card number and security code do not pass through the Rose app. Website purchases also use RevenueCat and Supabase for entitlement and purchase recovery. Their processing can take place outside your country.

If we add a processor, this list changes before the processing does.

Your health answers appear in none of these, because they never leave your phone.

10. International transfers

Several of the processors in the first table of section 9 are in the United States. Those transfers are made under the Standard Contractual Clauses approved by the European Commission, or under the EU–US Data Privacy Framework where the processor is certified, together with the additional safeguards their agreements require.

Because your health answers never leave your device, the six answers in section 4 are transferred nowhere at all.

The routine builder is a free-text box, and if you allow it, what you type in it is sent to the two companies named in section 5. You may choose to describe a health condition there. We do not ask you to, the example text in the box does not ask for a diagnosis, and the builder is not a medical service. Avoid including information you do not want those companies to receive, or use the builder without allowing remote processing.

11. How long we keep it

12. Your rights

Under the GDPR you may: access your data; correct it; have it deleted; restrict or object to processing; receive it in a portable form; and withdraw consent at any time without affecting what was done before.

Account deletion is built into the app. Profile → Account → Delete account immediately removes your account, saved-routine identifiers and completion history from Rose's active account database, and resets Rose's local data on that device. This action cannot be reversed.

The button does not automatically erase previously collected analytics events in Mixpanel or PostHog, including events linked to your account, custom routine names and approximate location. Those events follow the 25-month retention period in section 11. To request erasure of this data, write to [email protected]; deleting your account alone does not submit that request.

The count of routine-builder requests described in section 5 is also retained separately. It contains no prompt text and deletes itself within seven days of the last time you used the builder. Marketing-consent evidence and records we are legally required to retain follow the periods in section 11.

Account deletion also does not do the following:

1. It does not cancel your subscription. Cancel an Apple or Google subscription in the store account used to buy it. For a website purchase, contact [email protected] from the checkout email address to request cancellation. Instructions for each purchase route are at https://www.getroseapp.com/en-US/cancel/. Deletion alone does not stop future charges.
2. It does not delete transaction records we are legally required to keep.

For anything else, write to [email protected]. You may also complain to your national supervisory authority; in Slovenia that is the Information Commissioner (Informacijski pooblaščenec).

13. Children

Rose is not intended for children. You must be at least 16 to use it, and we do not knowingly collect data from anyone younger. If you believe a child has given us information, write to us and we will delete it.

14. Tracking, and what iOS asks you

Rose shows no advertising inside the app.

On iOS, Rose waits for the result of Apple's App Tracking Transparency request before starting Singular, our attribution service. Rose does not start that service while the tracking decision is still unanswered.

If you allow tracking, the attribution SDK may use the advertising identifier. If you decline, or iOS restricts tracking, that identifier is unavailable, but Singular still starts: it receives selected app and purchase events and uses Apple's SKAdNetwork attribution support. Declining ATT therefore does not turn off all analytics or all communication with Singular. It does not change your access to Rose's features.

Rose does not send your caution answers, search text or builder prompts to Singular. Product analytics described in sections 3 and 9 is separate from the ATT decision.

You can change this at any time in iOS Settings → Privacy & Security → Tracking.

15. Notifications

Rose sends no push notifications and holds no push token. Reminders you set are scheduled by your own phone and never travel over the network. If you deny notification permission, Rose works normally; you just will not be reminded.

16. Security

Every table holding your data enforces row-level security, so the database itself refuses to return one person's rows to another — this is enforced by the database and not merely by our code. Elevated credentials exist only on our servers and never inside the app.

No system is perfectly secure, and we do not claim otherwise.

17. Changes

We will post any change here and update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.

18. Contact

Mimi Studio d.o.o.
Trubarjeva cesta 79
1000 Ljubljana, Slovenia

[email protected]