Privacy policy
Last updated 26 September 2026
Roha helps small businesses write and publish social media posts with AI. It is run by Roha Social in New Zealand ("we", "us"). This page explains, in plain English, what we collect, why, and what you can do about it.
What we collect
Your account
Your name, email address and password. We store the password only as a bcrypt hash, never the password itself.
Your business
Business name, industry, voice, location, timezone and website.
Connected accounts
When you connect Facebook or Instagram: the Page and account ids and names, your Meta user id, and the access tokens that let us post for you.
Posts and images
Your post briefs, the drafts our AI writes, your edits, schedules and published post ids, and the images you upload.
Billing
Your trial dates, subscription status and Stripe customer id. Stripe handles card details. We never see or store your card number.
Technical
Your IP address and the pages you request, in our server logs. Counts of how much AI generation you use, to apply fair usage limits.
How we use it
- To write posts that sound like your business.
- To learn your voice from the changes you make to drafts. This is used for your business only and never shared with, or used for, any other business.
- To publish posts to your connected Facebook Pages and Instagram accounts when you choose.
- To run your account: signing in, billing, and emails such as email verification, password resets, reconnect reminders and deletion confirmations.
- To keep Roha secure and working: rate limits, usage limits and error monitoring.
AI and your content
We use Anthropic's Claude API to write posts. When you generate a post, we send Anthropic your business profile, your brief, a few of your recent posts and edits as examples of your voice, and any images you turn on "Use AI" for.
We don't send your email address, password or access tokens. Anthropic's commercial terms say it does not train its models on this data. We don't train AI models on your content either.
Who we share it with
We share only what each provider needs to run Roha for you:
This means your information is stored and processed outside New Zealand, mainly in Australia, the United States and Japan, and wherever Cloudflare stores data. We may also share information if the law requires us to.
What we don't do
- Sell or rent your data.
- Share your data with advertisers.
- Use advertising trackers or analytics tools.
Cookies
We only use cookies that Roha needs to work:
- Two sign-in cookies that keep you logged in. They last up to 7 days and are removed when you log out.
- An encrypted cookie that holds your list of Facebook Pages for 10 minutes while you pick one to connect.
Our pages load fonts from Google Fonts and scripts from the jsDelivr and unpkg networks, so those services see your IP address when your browser fetches the files. Once you're logged in, the app also loads Facebook's login script so the Connect Facebook button works, and Facebook may set its own cookies through it.
Keeping it safe
- All connections use HTTPS.
- Passwords are hashed with bcrypt.
- Facebook and Instagram access tokens are encrypted in our database with AES-256-GCM.
- Database backups are encrypted before they leave our server.
No system is perfectly secure. If a breach is likely to cause you serious harm, we'll tell you and the Privacy Commissioner, as New Zealand law requires.
How long we keep it
- Your account data is kept while your account is open.
- Drafts you never schedule are deleted, with their images, after 30 days without changes.
- Server logs are kept for up to 30 days.
- Encrypted database backups are deleted automatically after 14 days.
Deleting your account
Go to Profile, then Delete account. Everything is deleted straight away: your account, business profile, posts, drafts, images and connected accounts. Any subscription is cancelled, and we ask Facebook to remove Roha from your account.
A few things are kept:
- A record that the account was deleted, with no personal data: the account id, date and confirmation code. It makes sure a restored backup never brings your account back.
- Stripe keeps your invoices for 7 years, as New Zealand tax law requires. Your saved card is removed.
- Posts already published to Facebook or Instagram stay there. You can delete them on those platforms.
- Encrypted backups expire within 14 days, and a deleted account is never restored from them.
To remove only Roha's access to Facebook or Instagram, see our data deletion page.
Your rights
Under the New Zealand Privacy Act 2020 you can ask to see and correct the information we hold about you.
- Edit your account and business details yourself in Profile.
- Download a copy of your data from Profile, then Download my data. You get a JSON file of your account, business, connected accounts, posts and subscription. Images are not included.
- For anything else, email hello@roha.social. We'll reply within 20 working days.
If you're not happy with how we handle your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Changes to this policy
When we change this policy, we'll update the date at the top. If a change is significant, we'll email you before it applies.
Contact
Roha Social, New Zealand. Our privacy officer is Max, the owner. Questions or requests about your privacy go to the same address.
hello@roha.social