Privacy Policy

Last updated October 11, 2026

Rosa is a password helper you use by text message. It is operated by Commerce Song, LLC (“Rosa,” “we,” or “us”). This policy explains what Rosa collects, why, who else handles it, and the choices you have. It covers Rosa’s text messages, the Rosa pages where you save and view password parts, and this website.

The short version

Rosa needs three things: your phone number, the names of the websites you save, and the password part you save for each one.
We don’t ask for your name, your email address, or the usernames you use on other websites.
Rosa is designed so that it never has your whole password. Keep your private part to yourself.
We don’t sell your information, and we don’t share your mobile number or text messaging consent with anyone for marketing.

What we collect

Your phone number. Rosa recognizes you by the number you text from. We store it so we can match your saved password parts to you and reply to you.

The websites you save. The name you type after “set” or “get” (for example, “amazon”) is saved as the label for that password part.

Your saved password parts. Whatever you enter on a Rosa link. If you use Rosa as designed, that is only part of a password. If you choose to save a complete password, we will store the complete password instead.

Your text messages. Our text messaging provider, Twilio, carries every message between you and Rosa and keeps records of them, including what you text. We can review those records to see how Rosa is used, fix problems, and help you. Rosa’s own servers don’t keep a separate transcript of your conversation.

Usage reports. We keep internal reports of how many texts each number sends and receives each day and how many password parts it currently has saved. These reports use a random reporting ID and, where available, a country calling code and area code. They do not contain complete phone numbers, message contents, attachments, website names, password parts, or Rosa links. The IDs let us recognize the same user across reports, so we protect these records as personal information. Only authorized administrators can view them.

Technical logs. Rosa’s servers keep logs so we can run and troubleshoot the service. They record things like the time of each request, the last four digits of your phone number, what you asked for (such as “get amazon”), and the website label. They are set up not to record your password parts.

Website visits. When you visit www.rosa.bot, our hosting provider records basic details of each request, such as the page, the time, your browser type, the site that referred you, and your approximate country. These records do not include your IP address. Our homepage also uses analytics and advertising tags, described below.

We don’t collect your name, email address, contacts, precise location, or the usernames you use on other websites. Rosa is free and does not collect payment information.

How we use it

To run Rosa: recognize your number, send you links, save and return your password parts, and answer your texts.
To keep Rosa working and secure: fix problems, prevent abuse, and protect you and the service.
To understand how Rosa is used, including daily text totals and how activity and saved password parts are distributed across users.
To see how people find Rosa and whether our ads work.

We don’t use your information to advertise to you, and Rosa doesn’t send marketing texts.

We don’t sell your information. We use two service providers to run Rosa, and they handle your information only to provide their services to us:

Amazon Web Services (AWS) hosts Rosa’s servers and stores its data in the United States.
Twilio sends and receives Rosa’s text messages, so it handles your phone number and the content of your messages. See Twilio’s privacy notice.

Google and Meta receive information about visits to our homepage, as described below. They don’t receive your phone number, your Rosa links, or anything you save with Rosa.

We may also disclose information when the law requires it (for example, a valid court order), or when it is needed to protect Rosa’s users or the service. If Rosa is ever sold or transferred to another company, your information would go with it, and this policy would continue to apply to it until the new owner gives notice of a change.

Your mobile number and text messages

We do not sell, rent, or share your mobile phone number, SMS opt-in data, or consent with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

You start the conversation by texting Rosa. Rosa texts you only in reply to your messages, apart from rare notices about your use of Rosa. Message frequency varies. Message and data rates may apply. Text STOP at any time to stop receiving texts, or HELP for instructions. Our Terms of Service describe Rosa’s text messages in full.

Cookies, analytics, and ads

Our homepage (www.rosa.bot) uses tags from Google (Google Analytics and Google Ads) and Meta (the Facebook Pixel). They help us count visits and see whether our ads bring people to Rosa, including when someone taps a “Text Rosa” button. These companies may set cookies and receive details about your visit, such as your browser, your device, and the pages you view, and they use that information under their own privacy policies. You can block these cookies in your browser without affecting Rosa.

The Rosa pages where you save and view password parts send nothing to third parties: no analytics, no advertising tags, and no fonts or page styles from other companies. Everything they load comes from Rosa.

If you visit from an ad, a “Text Rosa” button may prepare a greeting that says you saw our ad. You can edit it before sending. We use Twilio’s received-message records to count how many people respond to that greeting. Our campaign reports contain totals, not phone numbers or message contents, and we do not send your texts or phone number to Meta or Google for this measurement.

How we protect it

Rosa’s pages and links use encrypted HTTPS connections.
Saved password parts are encrypted when stored, and Rosa’s storage is not publicly accessible.
Each Rosa link uses a random code, works only for the save or view you asked for, and expires after 10 minutes.
Rosa’s logs are set up to show only the last four digits of your phone number and not to record password parts.

Encryption protects stored data if someone gets hold of it without our key. It doesn’t stop Rosa’s own systems from reading your saved parts, because they need to do that to show them back to you. We don’t look at your saved password parts unless the law requires it.

No system is perfectly secure. That is why Rosa is designed around never having your whole password. Our Terms of Service explain the limits in plain terms.

How long we keep it

Your phone number and saved parts: until you ask us to delete them.
A part you replace: when you save a new part for a website, the old one is kept for 30 days so it can be restored if you ask, and then deleted.
Rosa links: they stop working after 10 minutes, and our record of them is deleted within a day.
Server logs and website visit logs: up to 90 days.
Requests that fail: up to 14 days, so we can fix the problem.
Usage reports: daily text activity for the most recent 90 days, plus a current count of saved password parts. A user leaves the report when they have no saved parts and no activity in that period. We keep limited deletion records when needed to prevent previously deleted information from reappearing.
Twilio’s message records: available in Twilio’s regular message logs for 400 days. Our current settings also retain message backups indefinitely. Those records can include the contents of texts sent to or from Rosa.

We may keep information longer when the law requires it, or when we need it to resolve a dispute, investigate abuse, or protect Rosa’s security.

Your choices

Stop texts. Text STOP to Rosa at any time. Rosa won’t be able to answer your requests until you text START.

Delete your data. Email rosa@commercesong.com with the phone number you use with Rosa. We’ll confirm the request with you by text at that number. Then we’ll delete your phone number, your saved parts, and every earlier version of them, and text you when it’s done. We also remove your row and earlier activity from our usage reports within 24 hours of confirming your deletion, and prevent that activity from reappearing in later reports. Server logs and Twilio’s message records aren’t removed this way. Server logs expire on the schedule above; Twilio’s message backups currently have no automatic expiry.

Ask what we have. Email us and we’ll tell you what Rosa holds for your number.

Changing phone numbers. Phone numbers get reassigned. Before you give up a number, retrieve what you need and ask us to delete your data.

Children

Rosa is meant for adults in the United States and Canada. Don’t use Rosa if you are under 18. If you believe a child has used Rosa, contact us and we will delete their data.

Changes to this policy

When we change this policy, we’ll post the new version here and update the date at the top. If a change significantly affects information you have already given us, we’ll let you know by text or on this website before it takes effect.

Contact us

Email rosa@commercesong.com, or text HELP to 1-864-777-8711 for instructions. Rosa is operated by Commerce Song, LLC.