This page is maintained by the Rounds team to answer common security and privacy questions about the app. It describes the controls and practices we have in place today — it is not an independent certification or audit report.
What Rounds is
Rounds is a household task and errand manager. You create a household, invite family members, and share shopping lists and tasks. When you are near a store or mall, Rounds can remind you about your lists. Your data belongs to your household and is never sold or used for advertising.
Authentication & access
- Sign in with email and password or Google OAuth. Passwords are hashed by our auth provider — we never see them in plain text.
- Every database table has Row Level Security (RLS) enabled. You can only read or write data your household owns.
- Households use role-based access: owners can manage invites and rename the household; members can create and edit lists.
- Sessions expire automatically. Sign out from any device via the Household screen.
What we collect and why
| Data | Why |
|---|---|
| Email, display name | Account creation and household identity |
| Household name, member roles | Shared household context |
| Shopping lists and items | Core app functionality |
| Store and mall locations | Geofence reminders (optional) |
| Browser location (with permission) | Nearby-store alerts only when enabled |
| Approximate live location shared with household | So Rounds can notify whoever is closest to a needed store |
We do not track you across the web, build advertising profiles, or share personal data with third parties for marketing.
Platform & hosting
Rounds runs on Lovable's platform, which uses Cloudflare's edge network for fast, global delivery. Our database and authentication are powered by Supabase (PostgreSQL). This means:
- Data is encrypted in transit (TLS 1.2+) and at rest by the database provider.
- Server-side logic executes in isolated serverless workers — there is no shared server that other tenants can access.
- Backups and point-in-time recovery are managed by the database provider.
Cookies and analytics
Rounds uses essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising pixels. We may collect anonymous error logs to fix bugs, but these do not contain personal information or household content.
Retention and deletion
- Your data is kept while your account is active.
- You can leave a household at any time from the Household screen. This removes your access but preserves lists for remaining members.
- To delete your entire account and all associated data, email us at the address below.
Subprocessors and integrations
- SupabaseDatabase, authentication, realtime
- PaystackPayment processing (South Africa)
- GoogleOAuth sign-in only
Privacy requests and contact
For data access, correction, or deletion requests — or any security concern — contact us at:
privacy@roundsapp.co.zaReport a vulnerability
If you discover a security issue, please email us at the address above with details. We review all reports and will respond as quickly as we can. We do not take legal action against good-faith security research.
Shared responsibility
Platform-level security (network, infrastructure, database encryption) is provided by our hosting partners. App-level security (access controls, data handling, invite codes, and role policies) is managed by the Rounds team. You are responsible for keeping your password safe, sharing invite codes only with trusted household members, and reviewing who has access to your household.