Sunroom is a caregiving organizer for families. This policy explains what information the app handles, where it goes, and the choices you have. It is written to be read, not skimmed; the short version is that your care records live on your phone, not on our servers.
All care records you create: care profiles, personal and health details, medication lists and dose logs, appointments, to-dos, voice recordings and their transcripts and summaries, typed notes, photos you attach, care check-in answers, and saved chat conversations. This data is stored in the app's private storage on your device. It is not synced to our servers, because we do not have any that store user content.
If you sign in with Apple, the app stores an anonymous Apple identifier on your device to remember that you signed in. We do not send it anywhere.
Your subscription is handled entirely by Apple. We never see your payment details.
Sunroom's AI features cannot run on the phone alone. When you use one, the minimum needed content is sent, encrypted, through our relay server (operated on Cloudflare) to a processing provider:
Our relay server passes these requests through and enforces rate limits. It does not store the content of your requests. Like any internet service, handling a request involves brief technical metadata: the IP address it came from, a timestamp, the feature being used, and the request's size. We use this only to route requests, enforce rate limits, and block abuse; we do not use it to identify you, profile you, or advertise to you. Cloudflare, which hosts the relay, keeps standard short-lived operational logs of this metadata under its own policies. Where UK GDPR applies, our lawful basis for this metadata is our legitimate interest in keeping the service available and secure.
Our providers process the content only to return a result. Anthropic does not use content sent through its API to train its models unless a customer opts in, and we have not opted in. Every transcription request we send to Deepgram carries its Model Improvement Program opt-out flag, so audio sent for transcription is not used to train Deepgram's models. Providers may retain content for a limited period to detect and prevent abuse, and content flagged by their safety systems may be held longer for review, in each case under their own published policies (Anthropic: anthropic.com/legal; Deepgram: deepgram.com/privacy). We do not control their retention schedules.
Our AI providers are United States companies, and the content of an AI request is transferred to the United States for processing. Because the relay runs on Cloudflare's global network, a request may pass through a nearby Cloudflare location on the way. If you use Sunroom from the United Kingdom or Australia, these transfers are protected as described in "Your legal rights" below.
You control the context: Settings → Privacy lets you exclude health details and recording summaries from what the AI sees. The recording consent line in the app is there for a reason: please make sure everyone present agrees before you record.
If you pre-order Sunroom on the App Store, Apple handles the pre-order entirely. We do not receive your email address, payment details, or any other personal information from a pre-order.
Reminders (medications, refills, appointments, check-ins) are scheduled locally on your device by the app. They do not go through our servers. Phones sleep, silence, and lose signal; please do not rely on reminders alone for doses that cannot be missed.
Because we hold no server-side copy of your care records, deleting them from your device deletes every copy under our control. Content already sent to an AI provider is covered by that provider's retention policy, linked above; we cannot reach into a provider's systems to delete it, and it is deleted on the provider's schedule.
AI requests travel over encrypted connections (HTTPS). Your care records are kept in the app's private, sandboxed storage on your device. When your device has a passcode set, iOS encrypts that storage with it; we strongly recommend using a passcode. Because we keep no server copy of your care records, there is no stored database of them on our side to breach; what we protect is content in transit, which travels encrypted and is not stored by our relay. If we learn of a security incident affecting our relay, we will assess it promptly and notify affected people and regulators as the law requires, including under Australia's Notifiable Data Breaches scheme.
Wherever you live, the most important protections are built into how Sunroom works: your care records stay on your device, and you can read, correct, or delete them yourself at any time, without asking us. This section adds what specific laws require us to tell you.
For the limited processing described above (relaying the content of your AI requests), the controller is Christopher Yoon, contactable at the address below. Our lawful bases under UK GDPR are:
AI requests are processed by Anthropic and Deepgram in the United States, so the content of an AI request is transferred to the United States. Transfers to Anthropic are made under the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge); Anthropic's certification can be checked on the Data Privacy Framework list at dataprivacyframework.gov. Transfers to Deepgram are made under the contractual safeguards in our data processing agreement with Deepgram. You can request a copy of the relevant safeguards (with commercial terms removed) by emailing us.
We keep no copy of the content of your requests: the relay passes them through without storing them, and your care records never reach us at all. The relay's brief technical metadata is described above.
You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent. Because your records live on your device and we hold no copy, most of these are in your own hands: the app itself is how you read, correct, export, and delete your data. For anything else, email us and we will help. You also have the right to complain to the Information Commissioner's Office (ico.org.uk). Sunroom makes no automated decisions about you with legal or similarly significant effects.
We handle personal information consistently with the Australian Privacy Principles. You can access and correct your information directly in the app. The only overseas disclosure is the one described above: the content of an AI request is processed in the United States by the providers named in this policy. Before this disclosure we take reasonable steps to protect your information: content travels encrypted, our relay does not store it, our providers process it under data processing agreements with contractual safeguards, and we have configured our use so that your content is not used to train their models. We remain responsible to you under the Australian Privacy Principles for this disclosure.
If you have a privacy concern or complaint, email us at the address below; we will acknowledge it within 7 days and give you a substantive response within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Sunroom uses AI to generate summaries, reflections, and chat replies for you to read, but no computer program makes a decision about you or your rights: every entry is made or confirmed by you, and nothing in the app grants, denies, or changes anything about you automatically.
We do not sell personal information, share it for cross-context behavioral advertising, or use it for profiling. We honor requests to know, correct, and delete regardless of which state you live in; because your records are on your device, the app itself fulfills those requests instantly.
Sunroom is intended for adults. You must be at least 18 to use it. Sunroom is not directed to children, and we do not knowingly collect information from anyone under 18.
If this policy changes in a way that matters, the app will tell you and the current version will always be at otom.world/privacy, with its effective date.
Christopher Yoon · New York, NY · chris65003y@gmail.com