Privacy Policy

Last updated September 30, 2026

Rosa is a password helper you use by text message. It is operated by Commerce Song, LLC (“Rosa,” “we,” or “us”). This policy explains what Rosa collects, why, who else handles it, and the choices you have. It covers Rosa’s text messages, the Rosa pages where you save and view password parts, and this website.

The short version

Rosa needs three things: your phone number, the names of the websites you save, and the password part you save for each one.
We don’t ask for your name, your email address, or the usernames you use on other websites.
Rosa is designed so that it never has your whole password. Keep your private part to yourself.
We don’t sell your information, and we don’t share your mobile number or text messaging consent with anyone for marketing.

What we collect

Your phone number. Rosa recognizes you by the number you text from. We store it so we can match your saved password parts to you and reply to you.

The websites you save. The name you type after “set” or “get” (for example, “amazon”) is saved as the label for that password part.

Your saved password parts. Whatever you enter on a Rosa link. If you use Rosa as designed, that is only part of a password. If you choose to save a complete password, we will store the complete password instead.

Your text messages. Our text messaging provider, Twilio, carries every message between you and Rosa and keeps records of them, including what you text. We can review those records to see how Rosa is used, fix problems, and help you. Rosa’s own servers don’t keep a separate transcript of your conversation.

Technical logs. Rosa’s servers keep logs so we can run and troubleshoot the service. They record things like the time of each request, the last four digits of your phone number, what you asked for (such as “get amazon”), and the website label. They are set up not to record your password parts.

Website visits. When you visit www.rosa.bot, our hosting provider records basic details of each request, such as the page, the time, your browser type, the site that referred you, and your approximate country. These records do not include your IP address. Our homepage also uses analytics and advertising tags, described below.

We don’t collect your name, email address, contacts, precise location, or the usernames you use on other websites. Rosa is free and does not collect payment information.

How we use it

To run Rosa: recognize your number, send you links, save and return your password parts, and answer your texts.
To keep Rosa working and secure: fix problems, prevent abuse, and protect you and the service.
To understand how Rosa is used overall, such as how many people use it and how often.
To see how people find Rosa and whether our ads work.

We don’t use your information to advertise to you, and Rosa doesn’t send marketing texts.

We don’t sell your information. We use two service providers to run Rosa, and they handle your information only to provide their services to us:

Amazon Web Services (AWS) hosts Rosa’s servers and stores its data in the United States.
Twilio sends and receives Rosa’s text messages, so it handles your phone number and the content of your messages. See Twilio’s privacy notice.

Google and Meta receive information about visits to our homepage, as described below. They don’t receive your phone number, your Rosa links, or anything you save with Rosa.

We may also disclose information when the law requires it (for example, a valid court order), or when it is needed to protect Rosa’s users or the service. If Rosa is ever sold or transferred to another company, your information would go with it, and this policy would continue to apply to it until the new owner gives notice of a change.

Your mobile number and text messages

We do not sell, rent, or share your mobile phone number, SMS opt-in data, or consent with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

You start the conversation by texting Rosa. Rosa texts you only in reply to your messages, apart from rare notices about your use of Rosa. Message frequency varies. Message and data rates may apply. Text STOP at any time to stop receiving texts, or HELP for instructions. Our Terms of Service describe Rosa’s text messages in full.

Cookies, analytics, and ads

Our homepage (www.rosa.bot) uses tags from Google (Google Analytics and Google Ads) and Meta (the Facebook Pixel). They help us count visits and see whether our ads bring people to Rosa, including when someone taps a “Text Rosa” button. These companies may set cookies and receive details about your visit, such as your browser, your device, and the pages you view, and they use that information under their own privacy policies. You can block these cookies in your browser without affecting Rosa.

The Rosa pages where you save and view password parts send nothing to third parties: no analytics, no advertising tags, and no fonts or page styles from other companies. Everything they load comes from Rosa.

How we protect it

Rosa’s pages and links use encrypted HTTPS connections.
Saved password parts are encrypted when stored, and Rosa’s storage is not publicly accessible.
Each Rosa link uses a random code, works only for the save or view you asked for, and expires after 10 minutes.
Rosa’s logs are set up to show only the last four digits of your phone number and not to record password parts.

Encryption protects stored data if someone gets hold of it without our key. It doesn’t stop Rosa’s own systems from reading your saved parts, because they need to do that to show them back to you. We don’t look at your saved password parts unless the law requires it.

No system is perfectly secure. That is why Rosa is designed around never having your whole password. Our Terms of Service explain the limits in plain terms.

How long we keep it

Your phone number and saved parts: until you ask us to delete them.
A part you replace: when you save a new part for a website, the old one is kept for 30 days so it can be restored if you ask, and then deleted.
Rosa links: they stop working after 10 minutes, and our record of them is deleted within a day.
Server logs and website visit logs: up to 90 days.
Requests that fail: up to 14 days, so we can fix the problem.
Twilio’s message records: kept by Twilio under its own policies.

We may keep information longer when the law requires it, or when we need it to resolve a dispute, investigate abuse, or protect Rosa’s security.

Your choices

Stop texts. Text STOP to Rosa at any time. Rosa won’t be able to answer your requests until you text START.

Delete your data. Email rosa@commercesong.com with the phone number you use with Rosa. We’ll confirm the request with you by text at that number. Then we’ll delete your phone number, your saved parts, and every earlier version of them, and text you when it’s done. Server logs and Twilio’s message records aren’t removed this way; they expire on the schedule above.

Ask what we have. Email us and we’ll tell you what Rosa holds for your number.

Changing phone numbers. Phone numbers get reassigned. Before you give up a number, retrieve what you need and ask us to delete your data.

Children

Rosa is meant for adults in the United States and Canada. Don’t use Rosa if you are under 18. If you believe a child has used Rosa, contact us and we will delete their data.

Changes to this policy

When we change this policy, we’ll post the new version here and update the date at the top. If a change significantly affects information you have already given us, we’ll let you know by text or on this website before it takes effect.

Contact us

Email rosa@commercesong.com, or text HELP to 1-864-777-8711 for instructions. Rosa is operated by Commerce Song, LLC.