RogerBack to home

This policy is being finalized.

Roger Privacy Policy

Last updated: November 2, 2026

This Privacy Policy explains how Upstream Works LLC ("Upstream Works", "we", "us", "our") collects, uses, and shares personal information when you use Roger, including our websites at roger.earth (such as www.roger.earth and go.roger.earth), the Roger web app at app.roger.earth, and related services (together, the "Service").

Upstream Works LLC is the controller of the personal information described in this policy. You can reach us at support@roger.earth.

1. Summary

  • We collect what we need to answer your questions about what to do nearby, remember what you tell Roger, run your account, and manage the waitlist.
  • Roger estimates your location from your network address. If you allow it, Roger uses your device's exact location, and those coordinates are sent to our AI providers with your question.
  • Roger remembers by default. When you ask something that states a need, a preference, or a fact about you, Roger keeps it, signed in or not, so you don't have to repeat it. You can see and remove what it keeps (see section 5 and section 9).
  • If you tell Roger about sensitive needs, such as allergies, celiac disease, religious dietary rules, or mobility needs, we treat them as sensitive data. They are sent to our AI providers with each question so Roger can plan around them (see section 5).
  • Roger aims to show that a place meets a need only when it has a source for it. When it can't confirm a need like step-free entry, it tells you to call ahead and check. Always confirm allergies, dietary needs, and accessibility directly with the venue.
  • We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
  • We do not send marketing email.

2. Information we collect

Information you give us

  • Waitlist: your email address, name, role, and language/locale. Each waitlist signup is also copied into a customer records table in the same database.
  • Account information: you can sign in with Google, with Apple, or with an email address and password. Phone sign-in by text message is built and may be turned on; when it is, Twilio delivers the code. When you sign in with Google or Apple, we receive the name and email address the provider shares and the provider's account identifier. If you sign in with an email address and password, we store the password in hashed form. We do not ask you to verify your email address.
  • Questions and conversations: what you ask Roger, typed or spoken, and Roger's answers. Your chat threads are stored in your browser on your device. When a message states a need, a preference, a retraction, or a fact about you, Roger also sends that message to our memory provider, Synap by Maximem, with the needs and preferences it found in it, so Roger can remember them. This happens whether or not you are signed in: a signed-out device is keyed to a random device id, and a signed-in account to a hashed account id. A plain ask with no need or fact in it is not sent to the memory provider. Your questions also pass through our servers and AI providers to produce an answer, and failed-request logs may capture the request text (see below).
  • Voice input: if you use the microphone, your voice audio is sent to a speech-recognition provider to turn it into text.
  • Needs and preferences: needs and preferences you state, and ones Roger infers from what you ask and tap (for example, "I don't drive" or "vegetarian"), including any sensitive needs (section 5). Roger keeps these by default and shows them in You, where you can edit or remove them.
  • Paths: plans you create or join, including the members of a shared Path and the votes they cast.
  • Communications: messages you send us, such as support requests.

Information collected automatically

  • Location: see section 6.
  • Device and usage data: we use Vercel Web Analytics on roger.earth and app.roger.earth to count page views and see how visitors arrive (such as page, referrer, country, browser, and device type). We also use Google Analytics on roger.earth and app.roger.earth, which sets its own cookies (see section 10). On app.roger.earth we also use Vercel Speed Insights to measure page performance.
  • Log and error data: our hosting provider records request logs (including IP address, time, and the page or feature used). Some error logs include the raw text of the request that failed, which can include what you asked Roger and any needs sent with it. Application errors are also sent to an error-monitoring provider. Before an error report is sent, request text, your question, your location, and your IP address are removed from it.
  • Cookies and browser storage: see section 10.
  • Push notifications: if you turn on web push notifications, we store the push subscription your browser gives us (an endpoint address and keys) in your account so we can send you notifications through your browser's push service.

Information from third parties

  • Information from Google or Apple when you sign in with them, and from Twilio when you sign in by phone (above).
  • Public information about places, events, weather, and transit that Roger uses to build answers. This is generally not information about you.

3. How we use information

We use personal information to:

  • provide the Service, including answering your questions with suggestions near you, planning around your needs, and showing where each answer came from;
  • create and manage your account and remember the needs, preferences, and facts about you that you state or that Roger infers;
  • run shared Paths, including showing group members each other's names, non-sensitive needs, and votes;
  • manage the waitlist, including contacting waitlist members personally about access to Roger;
  • send push notifications, if you turn them on;
  • understand how Roger is used and improve its features, accuracy, and performance;
  • protect the Service, prevent abuse, and find and fix errors; and
  • comply with law and enforce our Terms of Service.

We do not send marketing email. If that changes, we will update this policy before we start.

Legal bases (EEA, UK, and similar laws). Where these laws apply, we rely on:

  • Contract, to answer your questions, run your account, and run shared Paths.
  • Legitimate interests, to remember your non-sensitive needs and preferences so Roger can plan around them. You can see and remove what Roger remembers at any time, and you can object.
  • Consent, to use your device's precise location, to send push notifications, and for storage that is not strictly necessary.
  • Legitimate interests, to keep Roger secure, find and fix errors, understand how Roger is used, and contact waitlist members about access. We weigh these interests against your rights. You can ask us how.
  • Legal obligation, to meet our legal duties.

Where we rely on consent, you can withdraw it at any time in the app or in your browser or device settings. This does not affect what we did before you withdrew it.

4. AI processing

Roger uses AI models to understand your questions and write answers. With each question, we send the AI provider the text of your question, recent conversation context, your estimated or precise location (section 6), the time of day, weather, and your needs and preferences, including sensitive needs (section 5), whether you stated them or Roger inferred them.

We use these categories of AI providers:

  • Language models that write Roger's answers, for example Anthropic (our default for chat, reached through Vercel AI Gateway), OpenAI, and Google (Gemini, which we call directly as a fallback).
  • Fact-checking and search. To check facts about a place, Roger sends the place's name and address and a list of yes-or-no questions about it (for example, whether it has a step-free entrance or a gluten-free menu) to a web-search model, by default Perplexity through Vercel AI Gateway, or Google Search through Gemini when the Gateway is not configured. Those questions can reflect a need you have. A fact check does not include the text of your question, your coordinates, or who you are.
  • Voice transcription: Google Gemini receives your voice audio when you use the microphone and turns it into text. It receives the audio and a fixed instruction, not your needs or your location.
  • Memory: Synap by Maximem receives the messages described in section 2 and infers needs and preferences from them. Roger reads what Synap remembers at the start of each question and adds it to the prompt sent to the language model. Hard needs (for example, an allergy or step-free entry) are also kept for seven days in a small ledger in our hosting provider's runtime cache, so they survive an outage of the memory provider. That ledger holds the need lines only, never your own words.

Our AI providers' terms do not allow them to use what we send them, including your questions, location, and needs, to train their models. This applies to Anthropic, OpenAI, Google (Gemini), and Perplexity, whether we reach them directly or through our AI routing service, Vercel AI Gateway, which we set to use only providers that do not train on requests. Providers may keep requests for a limited time, usually up to 30 days, to detect abuse or meet legal duties. They may keep them longer if a request is flagged for misuse. When Roger checks facts with Google Search or Google Maps, Google keeps the request and answer for 30 days to provide that feature and to debug and test it. Our memory provider, Synap, does not train models on your data.

AI answers can be wrong or out of date. Roger shows its sources so you can check them. Roger aims to show a need as met only when it has a source for it. When it can't confirm a need that affects safety or access, it asks you to call ahead and check. See our Terms of Service.

5. Sensitive needs

What counts as sensitive. We treat the following as sensitive needs: food allergies and intolerances; celiac disease and other medical dietary needs; religious dietary rules (for example, halal or kosher); mobility, accessibility, and other disability-related needs; sobriety and substance-use recovery; and any other health information you tell Roger to remember.

How it is saved. When you tell Roger about a need, Roger shows a "What I heard" card that summarizes it. You can edit or remove the need from that card. Roger keeps the need by default, signed in or not, including a sensitive need. You do not have to share sensitive needs to use Roger, but without them Roger cannot plan around them.

How we use it. We use sensitive needs only to tailor Roger's suggestions to you, for example to avoid places that cannot meet your dietary or access needs. We do not use them for advertising, we do not sell them, and we do not use them to infer other characteristics about you.

Who receives it.

  • AI language model providers (section 4) receive your sensitive needs with every question, so Roger can plan around them.
  • Our memory provider, Synap by Maximem, receives the message that stated the need and the need itself, and keeps it keyed to your hashed account id or device id.
  • Our hosting provider keeps hard needs for seven days in the runtime-cache ledger described in section 4.
  • Hosting and database providers store needs you confirm as part of your account, marked as sensitive.
  • Hosting logs may contain them if they were part of a request that failed (section 2). Error-monitoring reports have request text removed before they are sent.
  • Fact-checking providers receive yes-or-no questions about a place that can reflect a sensitive need (for example, "Does it have a step-free entrance?"), but not your question, your location, or who you are. The speech provider does not receive your needs.
  • Shared Paths: other members of a shared Path can see your non-sensitive needs and your votes. They do not see your sensitive needs.

Your choices. You can view, edit, and remove any need shown in You at any time. Removing a need there stops it from being sent with future questions from that account or device. What the memory provider inferred on its own is not yet listed in You, and removing a need in You does not reach the memory provider's copy. When you change the wording of a need, the memory provider keeps the earlier version marked as replaced. See section 9 for deletion.

Unconfirmed needs. Roger aims to show a place as meeting a need (for example, “gluten-free” or “step-free entrance”) only when it has a source for it. When Roger can't confirm a need that affects safety or access, such as an allergy or step-free entry, it asks you to call ahead and check. Other needs it can't confirm are not shown as met. Always confirm allergies, dietary needs, and accessibility directly with the place before you go.

6. Location

  • Estimated location. Roger estimates your location from your network address, using the approximate city and coordinates our hosting provider attaches to each request. The estimate is usually accurate to your city or area, and we use it to find things near you.
  • Precise location (optional). If you give your browser or device permission, Roger uses your exact GPS coordinates. Those exact coordinates are included in the prompt sent to our AI providers with your question, and may be sent to place, map, weather, and transit providers to find nearby results.
  • You can turn precise location off at any time in your browser or device settings. Roger then falls back to the network-based estimate.
  • We ask your browser or device for permission before we use your precise location. We do not use geofences around health care locations.
  • We do not sell location information or use it for advertising.
  • A home area you set is kept on this device, not in your account. Location may appear in hosting logs as described in section 2; it is removed from error reports before they are sent.

7. How we share information

We share personal information only as described here.

Service providers that process data for us under contract, by category:

  • Hosting, analytics, and logs: Vercel (website and app hosting, request logs, Vercel Web Analytics on roger.earth and app.roger.earth, Speed Insights on app.roger.earth, AI Gateway routing, and the runtime cache that holds the seven-day need ledger).
  • Database: Neon (stores accounts, the needs and memories you confirm, Paths, saved places and places you ruled out, regulars, heads-ups, push subscriptions, and waitlist data, including the customer records table). Neon does not store your chat threads.
  • Memory: Synap (Maximem), which stores the messages and the needs and preferences Roger remembers for you, signed in or not.
  • Sign-in: Google (Google Sign-In) and Apple (Sign in with Apple). Twilio, which sends phone sign-in codes when phone sign-in is on, may use message details such as timing and delivery data to train its fraud-prevention systems. It does not receive your questions or needs.
  • Analytics: Google (Google Analytics) on roger.earth and app.roger.earth.
  • AI language models: for example Anthropic, OpenAI, and Google (Gemini) (section 4).
  • Fact-checking and search: Perplexity (through Vercel AI Gateway) and Google (Gemini with Google Search).
  • Voice transcription: Google (Gemini).
  • Error monitoring: Sentry, which receives error reports with request text, location, and IP address removed.
  • Push notifications: your browser's push service (for example, Google, Apple, or Mozilla) delivers notifications if you turn them on.
  • Place, map, and weather data: Google Places, OpenStreetMap services (Nominatim for geocoding and Overpass for place search when Google Places cannot answer), and Open-Meteo for weather. These requests generally include a location or search term, not your name or email address.
  • Fonts: Google Fonts on app.roger.earth, which receives your IP address when fonts load. Fonts on roger.earth are served from our own site.

Other people in shared Paths. Members of a shared Path see each other's names, whether they are coming, non-sensitive needs, and votes.

Legal and safety. When we believe it is required by law, legal process, or a government request, or needed to protect the rights, safety, or property of you, us, or others.

Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

With your permission. For example, when you invite someone to a Path.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

8. Retention

  • Waitlist data (including the customer records copy): kept as long as needed for that purpose, then deleted. To delete it sooner, email support@roger.earth.
  • Account data, confirmed needs, and Paths: kept while your account is active, and handled as described in section 9 when you use "Delete my data".
  • Memory held by the memory provider: kept until deleted. When you are signed in, "Delete my data" deletes what the memory provider holds for your account, within the limits in section 9. A signed-out device's memory stays until you ask us to delete it by writing to support@roger.earth.
  • Need ledger in the hosting runtime cache: each line is kept for seven days after it was last written, and may be dropped sooner.
  • Chat threads: stored in your browser (see section 10); the messages that stated a need or fact are also held by the memory provider.
  • Hosting logs, including error logs that may contain request text: kept as long as needed for that purpose, then deleted.
  • Error-monitoring reports: kept as long as needed for that purpose, then deleted.
  • Backups: deleted data may remain in backups as long as needed for that purpose, then deleted.
  • Data stored in your browser (section 10) stays on your device until you clear it.

9. Your choices and rights

Delete my data. You can use "Delete my data" in You. When you are signed in, this deletes from your account: your needs, nice-to-haves, and memories; your saved picks and the places you ruled out; Paths you made (people you shared them with lose them too); your place and votes in other people's shared Paths; your regulars and their history; your heads-ups; and your push subscription. On this device it clears Roger's copy of all of that, including chat threads, people you plan with, and your home area, and gives the device a new anonymous id so earlier memory is no longer attached to it. When you are signed in, "Delete my data" also deletes what the memory provider holds for your account, within the limits this section lists. It does not remove your sign-in record, de-identified audit records, failed-request logs, or your waitlist entry. Signed-out people have no deletion path for what the memory provider holds under their device id other than writing to us. Failed-request logs that captured request text are kept for the log retention period in section 8. To keep records of who has used Roger and to keep the Service secure, we keep:

  • your sign-in record (your account identifier and the email address or phone number linked to it, for whichever sign-in method you used); and
  • de-identified audit records of account activity, which no longer identify you.

"Delete my data" does not remove your waitlist entry. To delete waitlist data (including its copy in the customer records table), email support@roger.earth.

Pause memory. In You you can turn off "Let Roger remember". This stops Roger keeping new needs on this device.

Export my data. In You you can download a copy of what your account holds and of this device's copy.

Other rights. You can ask us for a copy of your data, or to correct or delete it, by writing to support@roger.earth. You can turn off precise location and push notifications at any time in your browser or device settings.

Depending on where you live, you may also have the right to object to or restrict certain processing, to withdraw consent, to limit the use of sensitive personal information, to opt out of sale, sharing, or targeted advertising (we do none of these), to appeal a decision about your request, and to complain to your local data protection authority. To appeal, reply to our answer to your request. We will respond within 45 days. If we deny your appeal, we will tell you how to contact your state attorney general. If you are in the UK and want to complain about how we handle your information, write to support@roger.earth first. We will acknowledge your complaint within 30 days. We apply the same choices to everyone, wherever you live.

We will not discriminate against you for exercising these rights. We may need to verify your identity before acting on a request. An authorized agent may make a request for you where the law allows.

10. Cookies and browser storage

We do not use advertising cookies or cross-site tracking cookies. We use:

Cookies

  • Sign-in (authentication) cookies: keep you signed in. Strictly necessary.
  • Preview-pass cookie: remembers that you entered a valid preview code, so you can reach preview areas. Lasts 30 days. Strictly necessary.
  • Feature-flag cookies: if you opt into a feature by adding a switch to the page address, Roger sets a cookie for your browser (for example, lark-guide-turn or lark-coldstart-d). These last 30 days; a map switch lasts for the browser session. They are not needed for the site to work. A leftover lark-chat-v2 cookie from an earlier version no longer does anything and is removed when the app loads.
  • Analytics cookies: Google Analytics sets its own cookies (such as _ga) on roger.earth and app.roger.earth to tell visits apart. They are not needed for the site to work.

Browser storage (localStorage)

  • Your chat threads are stored in your browser's local storage. Your Paths, Roger's memory of your needs and preferences, the people you plan with, your home area, your regulars, saved places, and places you ruled out may also be stored there, so the app loads quickly and works offline. This data stays on your device until you clear it or use "Delete my data", and anyone with access to your device and browser may be able to see it.

Analytics: Vercel Web Analytics works without cookies. Google Analytics uses the cookies listed above.

You can block or delete cookies and clear site data in your browser settings, but Roger may then stop working or sign you out.

11. International transfers

Upstream Works LLC is based in the United States. We and our service providers process personal information in the United States and other countries, which may not have the same data protection laws as where you live.

If you are in the EEA, the UK, or Switzerland, we protect personal information we send to our service providers with the European Commission's Standard Contractual Clauses, together with the UK Addendum for UK data and, where a provider offers them, the Swiss amendments for Swiss data. Some of our providers, such as Vercel, Neon, Sentry, and Twilio, are also certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

You can ask for a copy of these safeguards by writing to support@roger.earth.

12. Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, and marking sensitive needs as sensitive in our database. No system is completely secure, so we cannot guarantee absolute security.

13. Children

Roger is not directed to children. You must be at least 16 years old to use Roger. We do not knowingly collect personal information from anyone under 16. If we learn that someone under 16 is using Roger, we will stop remembering their needs and delete what we have stored. If you believe a child has given us personal information, contact us at support@roger.earth and we will delete it.

14. Changes to this policy

We may update this policy from time to time. If we make a material change, we will tell you at least 30 days before it takes effect, with a notice in Roger and by email if you have given us one. The "Last updated" date shows when this policy last changed. We will not use information we already have in a materially new way without asking you first.

15. Language

This policy is written in English. If we provide a translation, it is for convenience only, and the English version governs if there is any conflict.

16. Contact us

Upstream Works LLC

Email: support@roger.earth