Privacy

The photo you upload. It is resized in your browser before it is sent, and only the resized version leaves your device.

The roast. The text, the score and the styling tip the AI produces.

Your IP address. Recorded when you generate a roast, and used for one thing only: enforcing the 3-a-day free limit. It is not linked to your photo, not used for analytics, and not shared.

We do not ask for your name, your email, or an account. If you email us, we have your email address because you sent it.

Your roast history and daily streak live in your browser's local storage and are never sent to us. Clearing your browser data erases them, and they do not follow you to another device or browser.

If you subscribe to Pro, your licence key is stored in one cookie (rmf_license) so the server can check that your subscription is active. It is the only cookie we set, and there are no advertising or tracking cookies.

It is sent to Anthropic so their Claude model can look at the outfit and write the roast. Only the image and our instruction are sent — not your IP address and not anything identifying you.

It is stored by us in a Supabase bucket so your result page and share card keep working.

It stays private unless you publish it. A new roast is not on the leaderboard. It goes public only when you tap “Add to the leaderboard”, and that choice cannot be undone from the app — once a roast is public, someone may already have screenshotted it.

The link is the key. Anyone who has your result page URL can see the photo, published or not. Share it deliberately.

Sharing a link copies the image elsewhere. When you paste a RoastMyFit link into a chat, a post or a DM, that platform fetches the preview image and caches it on its own servers. That is how link previews work everywhere, and we cannot delete those copies.

Anthropic — generates the roast from your photo.

Supabase — stores photos and roasts. Images are served through a CDN.

Vercel — hosts the site and handles the requests.

Polar — takes the payment if you subscribe to Pro. Your card details go to Polar and never reach us; we only ever see whether a licence key is active.

We do not sell your data, and we do not share it with anyone beyond what is needed to run these four things.

Photos and roasts are kept until you ask us to delete them. Rate-limit records containing your IP address are only meaningful for 24 hours and are cleared periodically after that.

Because there are no accounts, there is no button for this and we cannot look you up. Email privacy@roastmyfit.me with the full URL of the roast you want removed — that URL is the only thing that identifies it. We will delete the photo, the roast and any leaderboard entry.

Two honest limits. Our image CDN can keep serving a deleted photo for up to an hour before its cache expires. And if the link was shared, copies cached by other platforms are outside our control.

You must be 18 or older to use RoastMyFit. That matches how the service behaves: the AI refuses to roast a photo where the subject looks like a child or a teenager, so a photo of yourself only gets a roast if you look like an adult.

If this policy changes in a way that affects what happens to your photo, the date at the top changes with it.

Questions, deletion requests, anything else: privacy@roastmyfit.me.