Privacy Policy

1. Who we are

RoMacro ("we," "us," "our") is a Windows desktop application and cloud service for creating and sharing input macros. It is operated by Virage Studio, a sole proprietorship registered in Québec, Canada (NEQ: 2282248550).

Privacy officer (per Loi 25): the person responsible for the protection of personal information at Virage Studio, reachable at [email protected]. A postal address is available on request.

2. What we collect

When you create an account

• Email address — required so you can log in and we can send security notices.
• Display name — chosen by you. Can be a pseudonym.
• Password — stored only as an irreversible PBKDF2 hash. We never see, store, or log the original password.

When you use the app

• Macros you create — titles, descriptions, tags, and the macro body (the recorded sequence of actions).
• Engagement — likes, downloads, when a macro was opened.
• Sign-in timestamps — the time of your last login.
• API logs — including your IP address, used to detect abuse and debug errors. Retained for 30 days, then deleted.

What we do not collect

• Tracking cookies, ad pixels, or third-party analytics.
• Anything you type outside RoMacro.
• Anything inside macros you keep private — they're stored in our database with access restricted to your account and are never shown to other users.

3. Why we collect it

Data	Purpose	Legal basis (Loi 25 / GDPR)
Email + password	Identify you, let you log in	Performance of contract
Display name	Attribute your published macros	Performance of contract
Public macros	Show them to other users (the point of the service)	Performance of contract
Private macros	Store them under your account so you can access them when signed in	Performance of contract
Likes / downloads	Power the "Trending" and "Recent" feeds	Performance of contract
IP + sign-in logs	Rate limiting, abuse prevention, debugging	Legitimate interest

4. How long we keep it

Data	Retention
Active account data	As long as your account exists
Macros	Until you delete them or close your account
API logs (incl. IP)	30 days, rolling
Database backups	14 days, rolling
Closed account data	Hard-deleted within 30 days of account closure

5. Who we share it with

We use these third parties to operate the service:

Provider	Purpose	Location	Their privacy policy
Fly.io	Hosting the API and database	United States (Virginia)	fly.io/legal/privacy-policy
GitHub	Hosting installer downloads and auto-updates	United States	docs.github.com/site-policy
Anthropic	Powers the AI features (Claude): the AI Assistant and the AI Vision block. Only what you actively submit is transmitted — the text you send to the assistant, the macro you ask it to edit, or the screenshot an AI Vision block captures.	United States	anthropic.com/legal/privacy

The AI provider processes your input to generate a response and does not use RoMacro API traffic to train its models. AI features are optional and only send data when you actively use them.

We may add a payment processor (Stripe or Gumroad) and an email provider (Resend or Postmark) when paid plans launch. We'll update this policy before that happens.

Cross-border note for Quebec users: Your data is processed and stored in the United States. By using RoMacro, you consent to this transfer. United States data protection laws may not be equivalent to those of Québec.

6. AI features

RoMacro includes optional AI features: the AI Assistant (a chatbot that turns your request into macro blocks) and the AI Vision block. These are powered by Anthropic's Claude models, routed through our own server (see the table in section 5).

• It is an AI, not a human. Responses are generated automatically and can be wrong or incomplete. Always review AI-generated blocks before running them.
• What is sent: only what you actively submit, the message you type, the macro you ask it to edit, and any screenshot or image you attach. We do not send your other macros or account details.
• Minor safety: because RoMacro is used by a broad audience, we apply the AI provider's child-safety measures, restrict accounts to users 13 and older, and provide an in-app "Report" button to flag inappropriate responses (routed to [email protected]).
• You can simply not use the AI features. Nothing is sent to an AI provider unless you do.

7. Your rights

Under Loi 25 and standard privacy practice, you can at any time:

• Access — request a copy of everything we have on you.
• Correct — fix inaccurate information.
• Delete — close your account; we hard-delete your data within 30 days.
• Withdraw consent — same as deleting the account.
• Object or restrict processing of your data for specific purposes.

To exercise any of these, email [email protected]. We will respond within 30 days.

If you believe your rights are not being respected, you can file a complaint with the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca.

8. Local data on your computer

The desktop app stores one file locally:

• %APPDATA%\RoMacro\auth.dat — your encrypted authentication token. Encryption uses Windows DPAPI scoped to your Windows user account. The file never leaves your machine.

Uninstalling RoMacro does not remove this file automatically. Delete it manually if you want to wipe local state.

9. Children

RoMacro is not intended for users under 13 years of age. We do not knowingly collect personal information from anyone under 13, consistent with the U.S. Children's Online Privacy Protection Act (COPPA) and Québec's Loi 25. Account creation requires confirming you are 13 or older. If you are 13–17, you need permission from a parent or legal guardian to use the service.

If you are a parent or guardian and believe a child under 13 has created an account, contact [email protected] and we will delete the account and data immediately.

10. Security

• Passwords are hashed with PBKDF2 (ASP.NET Core Identity standard).
• All client-server communication uses HTTPS / TLS 1.2+.
• JWT signing keys are stored as encrypted Fly.io secrets, not in source code.
• Database access requires authentication; backups are encrypted.

We are not a Fortune 500. If there is a security breach involving your personal information, we will notify you within 72 hours of becoming aware of it, as required by Loi 25.

11. Changes to this policy

We will update this page when our data practices change. Material changes (new third parties, new types of data collected) will be announced at least 30 days in advance by email and via an in-app banner. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

• Privacy: [email protected]
• AI safety reports: [email protected]
• Support: [email protected]
• Postal mail: available on request via the email addresses above