Privacy Policy

Last updated: May 8, 2026.

Plain English: We collect the name and facts you type, an optional photo, and basic payment info if you pay $2.99. We don't sell your data. Source uploads are typically purged within 24 hours, and we don't run third-party trackers. AI processing is done by Anthropic; payments by Stripe.

1. What we collect

Data	Why	Retention
Subject's first name (you type it)	To render the roast page	~30 days; deleted with the page
A few short facts (you type them)	Sent to AI to write personalized jokes	~30 days in the saved roast JSON
Optional photo (you upload it)	To render the roast page	Source upload purged within 24 hours of generation; rolling cleanup of stored variants within ~30 days
Stripe payment metadata (if you pay $2.99)	To process payment, prevent fraud, honor refunds	As required by Stripe and tax law
Basic request logs (IP, user-agent, timestamps)	Operating the site, abuse prevention	~30 days in Vercel logs

We do not require an account. We do not use ad tracking, marketing pixels, or analytics that fingerprint you across sites. We do not store your card numbers — Stripe handles them directly. Page views, when counted, are aggregate and do not include personal identifiers.

2. What we don't collect

Detailed personal information beyond what you submit in the form.
Biometric data, facial recognition vectors, or persistent identifiers derived from your photo.
Third-party advertising trackers, marketing pixels, or cross-site analytics.
Card numbers or full payment instruments — Stripe handles all card data; we only see metadata (status, amount, last4).

3. Subjects who didn't visit our site

If you are the Subject of a roast page someone else made about you, your first name and any facts the creator typed exist on our service because the creator submitted them. We did not collect this data from you. You can request takedown at any time at abuse@roastpage.app or via /takedown, and we will remove the page promptly. You can also email contact@roastpage.app for a copy of what we have or to ask us to delete it.

4. Cookies and similar tech

We use minimal browser storage:

rp_paid_<id> in localStorage — remembers "this roast page has been paid for" so the watermark stays hidden on return.
rp_age_confirmed in localStorage — remembers your one-time 18+ acknowledgment so we don't re-prompt.
rp_chunk_reload_attempted in sessionStorage — guards against infinite reload loops after a deploy.

We do not set advertising cookies and do not run third-party analytics.

5. Who processes your data on our behalf

Vercel — hosting, photo storage (Vercel Blob), serverless compute, request logs (standard infra logs).
Anthropic — the names and facts you type are sent to the Claude API (the LLM provider) to generate roast text. Anthropic processes the input to return a response. Anthropic's policy is not to use API inputs/outputs to train its models. We do not send Anthropic uploaded photos. The prompt and any photo URL passed to the LLM are deleted after generation.
Stripe — payment processing if you pay $2.99 to remove the watermark. Card details go directly to Stripe; we never see them.

These providers operate primarily in the United States. By using the Service you understand your data is processed in the U.S.

6. Children

RoastPage is not intended for users under 18. We do not knowingly collect data from anyone under 18. If we discover that data about a person under 18 has been submitted to the Service, we will delete it immediately. Sexual content involving minors is strictly forbidden and will be reported to NCMEC. If you believe a minor's information is on the Service, email abuse@roastpage.app and we'll remove it.

7. Your rights and choices

Deletion — anyone (creator or Subject) can request deletion at abuse@roastpage.app or via the form at /takedown.
Access / correction — email contact@roastpage.app with the roast URL. We aim to respond within 30 days.
California (CCPA / CPRA) — California residents have the right to know, delete, correct, and not be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioral advertising.
EU / UK (GDPR) — to the extent GDPR applies, our lawful basis for processing is your consent (when you submit content) and our legitimate interest in operating the Service. You have the right to access, rectify, erase, restrict, and object, and to lodge a complaint with your supervisory authority.

8. Security

We use HTTPS, scoped storage tokens, and minimal data retention. No system is perfectly secure. Don't upload photos or facts you can't tolerate being seen.

9. Where we operate from

RoastPage is registered in the State of Texas, USA.

Registered address: [REGISTERED ADDRESS]
Designated takedown agent: [DESIGNATED AGENT NAME] — RoastPage

10. Changes

We may update this policy. The current version always lives at this URL. Material changes take effect when posted.

11. Contact

Privacy questions: contact@roastpage.app
Takedowns / DMCA: dmca@roastpage.app or /takedown.
Signed: Founder, RoastPage.