Last updated: September 9, 2026
Roots is built by Srikant Aggarwal in the Greater Toronto Area, Ontario. When you continue with Google, we receive your name, email, and profile photo so we can create your account.
We use that information to run the community — your profile, plans, rooms, friends, and messages. We do not sell your data. We do not show ads.
Media you upload is stored so other members can see it. Location fields you choose to share (like your city or home area) are used to help you find people nearby.
If you choose Share location in an event chat and confirm, we read your current location once and store a precise map pin in that chat as a message. People who can read the chat can open or copy the pin. It is not live tracking and does not update your profile location or check you in. The small map shown on the pin is drawn by our own server, so your phone does not contact Google to display it; opening the pin in Maps does. Shared pins follow the same retention and deletion rules as messages.
Where your data lives
Your account and community content are stored in Canada, on servers in Toronto. Photos and videos you upload are stored with Cloudflare.
Who else processes it
Running Roots means a handful of other companies touch some of your data. We use each one for a single job and send it only what that job needs:
Google — sign-in, and the map and place search you see when picking a location.
Fly.io — hosts the app and database (Toronto).
Cloudflare — stores the photos and videos you upload.
Resend — sends the few emails we send, like account, support and moderation notices.
Giphy — powers GIF and sticker search. Your search words go to Giphy; your account does not.
OpenAI — four things. Text submitted to community and chat surfaces is checked automatically for hate, harassment and spam before they go out, which means that text is sent to OpenAI. The post suggestions in the composer are generated from your city, hometown and languages — never your name, email, or anything you have written. When you add a profile photo, that photo is sent to OpenAI once and asked a single question: is there a face in it? We ask because a photo is how a neighbour recognises who they agreed to meet. And if you choose to Get Verified, the selfie you take is asked one question too: is this the pose we asked for? The answers we keep are yes or no — nothing about who you are, and no copy of any photo is kept by OpenAI on our behalf. Photos are processed in the United States.
Amazon Web Services — one job: the Get Verified face match. If you choose to verify, your selfie and your profile photo are sent once to AWS Rekognition, which answers how alike the two faces are — that is what earns the green ring. No copy of either photo is kept by AWS on our behalf, and nothing goes to AWS unless you start a verification. Processed in the United States.
PostHog — records how Roots is used, including the screen recording described below. So that we can tell who is having a problem and what the people who stay have in common, your account details travel with it: your name, username, email, city, home state, languages, whether you have children and their age ranges, your age range, when you joined, whether you are verified, and the kind of device you last signed in on. Processed in the United States, and deleted from PostHog when you delete your account.
None of these companies are allowed to use your data for their own purposes, and we do not send them anything we have not described here.
How we use usage data
To fix problems and improve Roots we record how the app is used: which screens are opened, what is tapped, how long each screen is open, and what the app did in response. On phones and on the web this includes a screen recording of your session in which everything you or other members typed, and every photo, is hidden before it leaves your device. We do not record message text, your bio, or search words outside our own servers. The account details listed under PostHog above are attached to it so we can tell whose session we are looking at.
This usage data is processed for us by PostHog on servers in the United States. It is linked to your account so we can understand a problem you report, is never sold, is not used for advertising, and is deleted with your account.
Reports and message evidence
When you report a message, Roots copies that message's text, media link, sender and time into the report. This lets a Roots admin review the relevant evidence even if the original message is later removed. The person you report is not shown who made the report. Report evidence is used for safety review and is removed if either the reporter or reported account is deleted.
How long we keep it
Your account and its content stay until you delete them. Delete your account and we remove your profile, messages, room contributions, uploads, reports tied to your account and sign-in sessions — permanently, not hidden. Backups roll off within 30 days.
Deleting your account
Settings → Delete account. It asks once to confirm. Your profile disappears immediately, and everything is permanently deleted seven days later. Sign back in during those seven days to cancel. You do not have to email anyone to leave.
Questions
Email support@myindianroots.ca. If you are in Canada and think we have mishandled your information, you can also raise it with the Office of the Privacy Commissioner of Canada.