Roomy Guide: what's sent, what isn't

Draft — 28 September 2026. Planned for after launch.

Roomy Guide explains unfamiliar items, summarizes what changed, and helps you decide what deserves a closer look.

What Roomy Guide will do

Guide is a cloud-assisted add-on, planned as an optional paid extra once it launches. It is not a general chatbot, and it never talks about anything other than the item or scan you asked about:

• Explain an item (POST /v1/guide/explain) — a short plain-language title, summary, a recommendation (keep / review / likely_removable / unknown), a confidence level, the evidence behind it, and caveats.
• Summarize what changed (POST /v1/guide/changes) — turns a snapshot comparison into a headline and highlights, each with its own recommendation and caveats.
• Suggest a review order (POST /v1/guide/plan) — ranks cleanup candidates into a suggested order with a reason for each step. This is a review order, never an instruction to delete.

A free-form ask (POST /v1/guide/ask) is also available for a question about the current scan. Every one of these four calls consumes exactly one "ask" against your quota, on success only.

Exactly what gets sent

Before the first request, the app shows you this exact JSON in a consent preview — not a paraphrase of it. Guide only ever receives the metadata below for the item(s) involved, never a raw file, a directory listing, or your whole file tree. By default, names and paths are off: name and path_hint are sent as null unless you explicitly allow them for that request. When a path is allowed, Roomy redacts your Windows user name to <user> first.

A real GuideItem, with names and paths at their default (off), as sent to POST /v1/guide/explain:

{
  "item": {
    "kind": "folder",
    "name": null,
    "path_hint": null,
    "extension": null,
    "size_bytes": 4831838208,
    "file_count": 2140,
    "modified_days": 3,
    "parent_category": "browser-cache",
    "app_id": null,
    "children": [
      { "name": null, "kind": "file", "size_bytes": 812004352 },
      { "name": null, "kind": "file", "size_bytes": 603512832 }
    ]
  },
  "question": "What is this and is it safe to review?"
}

The same item with names and paths explicitly allowed for that one request looks like this instead — note the redacted user name:

{
  "item": {
    "kind": "folder",
    "name": "Cache_Data",
    "path_hint": "C:\\Users\\<user>\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache",
    "extension": null,
    "size_bytes": 4831838208,
    "file_count": 2140,
    "modified_days": 3,
    "parent_category": "browser-cache",
    "app_id": null,
    "children": [
      { "name": "data_3", "kind": "file", "size_bytes": 812004352 },
      { "name": "data_1", "kind": "file", "size_bytes": 603512832 }
    ]
  },
  "question": "What is this and is it safe to review?"
}

The response back is structured the same way every time — a title, a 1–3 sentence summary, a recommendation, a confidence level, evidence, caveats, and next steps. Nothing free-form is ever presented as more certain than that structure allows.

Provider and retention

• Provider disclosure: the cloud provider used to process a Guide request will be named in the app's Settings. No provider is committed yet — the processing vendor is still a planning assumption under evaluation, not a final choice.
• Request retention: by default, the item metadata, your question, and free-form text are not persisted. They exist only for the duration of the request and the one provider call (plus at most one retry) needed to answer it.
• What is kept, indefinitely, for cost and abuse accounting: device id, account id, endpoint name, token counts, an estimated cost, latency, and outcome (success / provider error / error). No file names, paths, or question text ever appear in this accounting table, regardless of the retention setting above.
• Session security: session tokens are random 32-byte values; only their SHA-256 hash is ever stored.

Quotas, in plain words

Guide usage is counted in asks — one ask per Guide request that succeeds. You never see a token count or a per-request cost; the app shows something like "12 of 25 asks left this period" with the date it resets. Server defaults: a subscription gets 300 asks/month (reset on the calendar month), and a trial gets 25 asks total over 14 days. When your quota runs out, Guide stops answering rather than quietly billing more — the free local core keeps working either way. Per-device request rate is also limited (10/minute by default) to prevent runaway use, and the whole service has a hard monthly cost ceiling; if that ceiling is reached, Guide returns "unavailable right now" rather than overspending.

Uncertainty and safety principles

• Every Guide answer carries a confidence level (low / medium / high) and a list of caveats, shown with equal visual weight to the answer itself — never smaller or hidden behind a disclosure toggle.
• Guide's recommendation is one of keep, review, likely_removable, or unknown — never a command, and never "safe to delete."
• A safety post-processor runs on every model response before it reaches the app: a likely_removable + high-confidence recommendation on a Windows/system/registry/paging path is automatically downgraded to keep or review with an added caveat, and any text instructing deletion of such a path is stripped and replaced.
• Guide never authorizes deletion in its own right. It explains, summarizes, and suggests review — the cleanup queue, Recycle-Bin-first removal, and the typed confirmation for permanent delete are unaffected by anything Guide says.
• Guide degrades gracefully: if you're offline, unentitled, or out of quota, the app falls back to the local knowledge base ("Roomy's local rules say…") instead of an error-only dead end.

Full privacy policy → · Back to the Guide overview →