Privacy Policy

Effective Date: September 28, 2026·Last Updated: September 14, 2026

This Privacy Policy describes how Rocky AI LLC (“Rocky AI,” “we,” “us,” or “our”) collects, uses, and protects information when you use Rocky. We take your privacy seriously. This policy is written in plain English where the law allows, and formal where it has to be.

1. What We Collect

Information You Provide

• Account information: your name, email address, and password when you create an account.
• Deal data: property addresses, financial figures, offer terms, and other information you input is stored in your private deal memory database. This data is used exclusively to power your Rocky experience — pattern recognition, outcome tracking, and deal history. We do not sell or share your deal data, and we do not use it to train AI models. We do analyze Rocky’s own responses in aggregate — without identifying any user — to measure and improve the quality of Rocky’s output.
• Communications and feedback: any messages you send us by email, and any votes or comments you submit through Rocky’s in-app feedback buttons. A feedback record includes your vote, any comment you add, an excerpt of the reply you rated, and the message you sent before it.
• Payment information: processed by Stripe. We do not store your credit card number — Stripe handles all payment data.
• Attachments: files and images you attach are not saved to disk. A file attached to a single message exists only in memory while that request is processed and is not retained afterward. When you send several files before telling Rocky to proceed, they are held temporarily in your private database and deleted once processed.

Information Collected Automatically

• Usage data: which features you use, how often, and general interaction patterns.
• Technical data: browser type, device type, IP address, and session information for security and debugging.
• API usage: token counts and cost data for internal cost tracking — aggregated, not linked to your personal identity in reports.

What We Do Not Collect

• We do not sell, share, or analyze your deal pipeline data. Your deals are yours.
• We do not knowingly collect Social Security numbers, government IDs, bank account numbers, full dates of birth, tenant screening reports, protected-class information, or confidential third-party data.
• We do not collect data from third parties about you without your knowledge.
• We do not run advertising or allow advertisers to collect data through Rocky.

Please Do Not Upload

To protect you and the people described in your deals, please do not paste, upload, or otherwise submit the following into Rocky:

• Social Security numbers, taxpayer identification numbers, or government-issued ID numbers.
• Bank account numbers, routing numbers, full credit card numbers, or other financial account credentials.
• Full dates of birth.
• Tenant screening reports, credit reports, background check results, or eviction records identifying a tenant by name.
• Protected-class information about a tenant, seller, or third party (race, religion, national origin, disability, familial status, etc.).
• Confidential business information of a third party that you are not authorized to share.

If you accidentally submit any of the above, contact us at rocky@userocky.com and we will work with you to remove it.

2. How We Use Your Information

• To provide and operate the Rocky service. This includes transmitting property location data to third-party market data providers as described in Section 4.
• To monitor system performance and maintain security. When you report a problem — by email, by reply, or through the in-app feedback buttons — we may review the relevant portion of your conversation to diagnose it. We do not otherwise read individual conversations.
• To send you the Rocky newsletter if you have subscribed — you can unsubscribe at any time.
• To process your subscription and manage billing via Stripe.
• To respond to support requests and communicate with you about your account.
• To track aggregate usage for internal cost management — never sold or shared.

3. Your Deal Data

This is the most important section for most Rocky users.

• Your deal data belongs to you. We do not claim ownership of any deals, analyses, or documents you create using Rocky.
• Your deals are stored per user, and other Rocky users cannot see them. Operational logs and feedback records may hold excerpts of your conversations for diagnosis and quality purposes; those are never visible to other users.
• We do not use your deal data to train AI models — not ours, not Anthropic’s, not anyone else’s.
• You can request deletion of your account and all your data at any time by emailing rocky@userocky.com from your account email. We process requests within 30 days. Deletion immediately cancels any active subscription (no refund for the current period). Encrypted backups containing your data expire within 7 days after deletion. See Section 6.

4. How We Share Your Information

We do not sell your personal information. Period.

We share information only in the following limited circumstances, and only as needed to operate Rocky:

• Anthropic (AI processor): Rocky’s analysis is powered by the Anthropic Claude API. On each turn, your message, your recent conversation history, a summary of older history, and summaries of your saved deals are transmitted to Anthropic to generate Rocky’s response (see the AI Use Disclosure for the full list). Under Anthropic’s Commercial Terms of Service, which govern API use, Anthropic does not train its models on customer content (inputs or outputs). Anthropic retains API content for a limited period for abuse monitoring and operational purposes in accordance with its Commercial Terms and Privacy Policy, available at anthropic.com/legal.
• Location data services: when you submit a deal containing a property address, city, or ZIP code, Rocky transmits that location information to the following services to retrieve market data:
  • Zippopotam.us — resolves city/state to ZIP code. Only the city name and state abbreviation are transmitted. No personal information or deal financial data is sent.
  • Freddie Mac (PMMS) — Rocky retrieves current national mortgage rate data from Freddie Mac’s publicly published Primary Mortgage Market Survey. No user data is transmitted to Freddie Mac — this is a read-only public data fetch.
  • U.S. Census Bureau — Rocky retrieves median household income, median home value, and population data for the property’s ZIP code from the Census ACS API. Only the ZIP code is transmitted. No personal information or deal financial data is sent.
  • HUD Fair Market Rent — Rocky retrieves published Fair Market Rent data for the property’s ZIP code. Only the ZIP code is transmitted.
  • Rentometer — Rocky retrieves rent estimates from Rentometer, a commercial data provider. The property address and bedroom count are transmitted. Rentometer’s privacy policy governs its handling of that data.
  These services receive only the location data necessary to return market context. None of them receive your name, email, or deal financials.
• Stripe (payment processor): subscription billing and payment data. Stripe’s privacy policy governs Stripe’s handling of payment data.
• Beehiiv (newsletter platform): if you subscribe to the Rocky newsletter, your name and email are stored with Beehiiv to deliver the newsletter.
• Email infrastructure (Hostinger SMTP): transactional email (verification, password reset, trial reminders, welcome messages) is sent through our SMTP provider.
• Hosting infrastructure: Rocky is deployed on a virtual private server provided by our hosting vendor. The vendor has access to the server only as necessary to provide hosting services.
• Backup storage (Backblaze): encrypted backups of user data are stored with Backblaze. Backups are encrypted on our server before upload; Backblaze cannot read their contents.
• Legal requirements: we may disclose information if required by law, court order, subpoena, or to protect the rights, property, or safety of Rocky AI LLC, our users, or others.

5. Data Security

• Your deal data is stored on a secured VPS with access controls and encryption in transit (HTTPS).
• Data stored on our servers is not encrypted at the disk level. Security relies on access controls, authentication, and encrypted backups.
• Passwords are hashed with bcrypt — we cannot see your password.
• We do not store payment card data — Stripe handles all payment security.
• We maintain daily encrypted backups of user data, retained for 7 days. Backups are encrypted before they leave our server, and we keep no unencrypted copies.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at rocky@userocky.com.

In the event of a breach of unencrypted personal information that triggers notification obligations under the North Carolina Identity Theft Protection Act (N.C. Gen. Stat. § 75-65) or other applicable law, we will notify affected users and applicable authorities in accordance with that law’s requirements.

6. Data Retention

• Active account data is retained until you request deletion. Cancelling your subscription does not delete your data; you may return to it if you resubscribe.
• You may request deletion of your account and data at any time by emailing rocky@userocky.com from your account email — we process within 30 days. Deletion immediately cancels any active subscription (no refund for the current period).
• Backups: encrypted backup snapshots containing your data expire within 7 days after deletion. Backups are accessed only to restore service in case of system failure or data loss.
• Aggregate usage data with no personal identifiers may be retained indefinitely for internal analysis.
• Payment records are retained as required by applicable law and Stripe’s policies.

7. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account and data (encrypted backups expire within 7 days after deletion).
• Unsubscribe from the newsletter at any time via the unsubscribe link in any issue.
• Request an export of your deals, conversation history, and generated documents (provided as JSON, CSV, and document files).

To exercise any of these rights, email rocky@userocky.com from your account email. We process requests within 30 days.

8. Cookies and Tracking

Rocky’s web interface uses minimal cookies and similar storage necessary for session management and authentication (specifically, session storage to hold your authentication token while you are logged in). Stripe Checkout, when used, sets its own cookies as part of the payment flow; Stripe’s privacy policy governs those cookies. Beehiiv’s newsletter sign-up form may set cookies governed by Beehiiv’s privacy policy.

We do not use advertising cookies or third-party advertising trackers. You can disable cookies and similar storage in your browser settings, but this may affect your ability to stay logged in.

9. Children’s Privacy

Rocky is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email to your registered address at least 14 days before they take effect. The current version is always available at userocky.com.

11. Contact

Questions about this Privacy Policy? Contact us:

Rocky AI LLC

rocky@userocky.com

userocky.com