Privacy Policy

Who we are

Roostly is a private family-organiser app operated by Roostly ("we", "us"). Our service lives at https://roostly.family .

What data we collect

Account data

Your name, email address, password hash, timezone, and sign-in security settings such as two-factor authentication and passkeys, plus the versions of the Terms of Service and this Privacy Policy you accepted and your marketing email preference. Account data is provided by you when you register, and Google Sign-In can provide your Google Account ID, name, email address, and basic profile details when you choose to sign in with Google.

Your name and email address are needed to create an account. Everything else is optional: an avatar or profile photo, phone number, birthday, bio, nickname, favourite colour, hobby, fun facts, and an emergency contact's name, relationship, and phone number. If you leave these out, the related profile details are simply not shown.

Data you provide about other people

Some data comes from another member rather than the person it describes: the email address and suggested name in an invitation, a managed child profile entered by a parent or guardian (see Children below), and an emergency contact added to a profile. Only add someone else's details when you have their permission or the authority to do so.

Family content

Shared lists and list items, calendar events, chores, rooms, and files you attach inside your family space.

Billing and payment data

Paddle handles checkout and subscription billing as the merchant of record. Paddle collects and processes payment details, billing addresses, tax information, invoices, receipts, refunds, disputes, and cancellation records under its own privacy terms. Roostly does not store full card or bank account numbers or card security codes. Roostly stores verified household billing-contact bindings, catalog mappings, checkout attempts, subscription access snapshots, and webhook receipts. Billing access changes only after verified provider events or authenticated provider reconciliation. Portal sessions are created on demand and their URLs are not stored. Historical billing records from Stripe, our former payment provider, remain retained; new financial records are managed in Paddle.

Usage, security, and diagnostic data

IP address, device and browser details, pages or routes visited, timestamps, session cookies, network and security logs, error reports, performance traces, and abuse-prevention signals. Roostly uses these to keep you signed in, protect the Service, troubleshoot errors, and improve reliability. We use Sentry, hosted in the United States, for error and performance monitoring, and send it diagnostic metadata such as user and tenant IDs, route and error details, stack traces, performance data, and masked session replays; text and media are masked or blocked, and common personal-data form fields are scrubbed before browser events are sent.

Data accessed from Google (only if you connect Google)

Roostly accesses Google user data through Google OAuth and official Google APIs only after you grant permission. We request only the scopes needed for the capability you enable. Google Sign-In and each sync capability are optional and are requested in context.

• Google Sign-In (openid, email, profile) — your Google Account ID, name, email address, and profile image returned by Google. Roostly uses your Google Account ID, name, and email address to create, link, and recognise your Roostly account, and can import your Google profile image as your Roostly avatar.
• Google Calendar, read-only (https://www.googleapis.com/auth/calendar.events.owned.readonly) — calendar event IDs, titles, descriptions, locations, start and end times, time zones, recurrence rules, event status, visibility, organizer and creator email addresses, conference links, Google Calendar links, and attachment metadata for events in the connected calendar.
• OAuth connection data — access tokens, refresh tokens, token expiry, approved scopes, provider account ID, provider email address, sync cursors, and webhook channel metadata needed to keep your chosen Google integration connected. Access and refresh tokens are encrypted by Roostly before storage.

Roostly currently requests only the Google Sign-In and Google Calendar scopes listed above. Additional Google scopes are not requested unless a future capability is completed, enabled, and disclosed in this policy before use.

Data accessed from Apple Calendar (only if you connect it)

Apple Calendar is optional and is used only when you choose to connect it. Roostly connects to Apple's iCloud calendar (CalDAV) servers with the Apple ID email address and app-specific password you enter, and reads selected-calendar metadata, sync tokens or change tags, and calendar event data such as titles, descriptions, locations, start and end times, recurrence rules, organizer details, visibility, availability, and attachment metadata.

Store search (only if you use it)

When you search for nearby stores to add to a list, Roostly sends your device's approximate location, which your browser shares only with your permission, and any search words you type to the Google Places API. Roostly sends these from its own servers, without your name, email address, or Google account, and shows the stores Google returns. Google processes these requests under Google's Privacy Policy.

How we use account, household, and diagnostic data

We use non-Google personal data only to provide, protect, support, and improve Roostly:

• to create and manage accounts, family spaces, invitations, roles, and household features;
• to show and sync the content you add, such as calendars, lists, chores, and attached files;
• to send account, invitation, security, password, and service emails;
• to open Paddle checkout and customer portal sessions, process verified catalog and subscription events, reconcile subscription access, and decide whether a family has access to paid features;
• to respond to support requests, prevent abuse, debug errors, monitor reliability, and comply with legal obligations.

How we use Google user data

We use Google user data only to provide the Roostly features you choose:

• Google Sign-In data is used to sign you in, link your Google identity to your Roostly account, and optionally show your imported Google profile image as your Roostly avatar.
• Google Calendar data is used to display synced events in your household calendar, keep those events updated with incremental sync and webhooks, detect events removed in Google, and show Google event attachments as event attachments in Roostly.
• OAuth tokens, scopes, sync cursors, and webhook metadata are used to refresh short-lived access, maintain the integrations you enabled, stop webhooks when you disconnect, and show connection health in Settings → Integrations.

We do not sell your data. We do not use your data for advertising, retargeting, or credit decisions. We do not use Google user data, including Google Workspace API data, to train artificial-intelligence or machine-learning models.

How data is stored and deleted

Roostly is hosted on Laravel Cloud, which runs on Amazon Web Services in the United States (us-east-1), and stores account, household, and connected-provider data there. Provider credentials such as OAuth access tokens, refresh tokens, sync cursors, and Apple app-specific passwords are encrypted before storage. Data is retained only for the time reasonably needed for the purpose described here, subject to limited backup and legal retention needs.

• Deleted accounts are removed from Roostly's live application database through the account deletion flow: immediately in most cases, or within minutes when an active subscription must first be closed with Paddle, unless a narrow active legal hold applies.
• When founder pricing applies, the founder lock is stored on the household record. Canceling a subscription does not remove it. If the household is permanently deleted, the household record and founder lock are deleted too.
• Encrypted disaster-recovery backups may retain deleted data for up to 30 days and are used only for restore, security, or reliability incidents. If a restore reintroduces deleted data, Roostly reruns deletion cleanup.
• Account export ZIP files are kept for 7 days and then deleted from storage.
• Daily application logs are kept for 14 days. Mail channel logs, including Resend delivery diagnostics, are kept for 30 days.
• Resend webhook and inbound event rows are kept for 90 days for deliverability, bounce or complaint investigation, abuse prevention, and support, then soft-deleted before permanent deletion.
• User-facing notifications and notification job logs are kept for 90 days, then soft-deleted before permanent deletion.
• Billing records, including Paddle billing-contact bindings, checkout attempts, transaction and subscription snapshots, and webhook receipts, plus historical records from Stripe (customer and subscription snapshots, invoice and payment identifiers, tax details, and webhook audit events), are kept while needed to provide the subscription, support disputes or refunds, maintain access controls, meet tax and accounting obligations, and comply with legal requirements.
• Sentry events are configured for 30-day retention where available. Roostly does not send default PII to Sentry and scrubs personal data before events are sent.
• Synced records marked as removed by an external provider are kept active for 30 days before soft-delete. Removed family memberships keep a 24-hour undo window before purge. When a guardian removes a child profile from its last household, the child's profile and personal data are permanently deleted after that undo window. Automatic pruning uses a 90-day soft-delete recovery window before permanent deletion unless a legal hold applies.

When you disconnect an integration, Roostly stops syncing, requests that supported providers stop active webhook or subscription channels where provider credentials still allow it, deletes stored provider credentials with the integration record, and lets you choose whether to delete data that was synced from that integration. Deleting your Roostly account removes your personal data from our live database. If deletion also permanently deletes your household, any founder pricing lock stored on that household is removed too. Provider-managed backups may retain encrypted copies for a limited period and are used only for disaster recovery.

OAuth tokens, Apple app-specific passwords, sync cursors, and webhook state are retained only while the integration is active and are deleted on disconnect, provider revocation, account deletion, or legal-hold release deletion. After disconnect, Roostly may keep minimal non-secret support metadata for up to 30 days; reusable credentials are never included in account exports. Active legal holds pause pruning only for the scoped records and only for legal, security, or compliance reasons.

How data is shared

We do not sell, rent, or transfer Google user data to advertising platforms, data brokers, or information resellers. We share personal data only in the following limited ways needed to operate Roostly. The service providers below are Roostly's current subprocessors.

• Your Roostly household — synced calendar events and your imported Google profile image are visible inside the family space and sharing settings you choose.
• Laravel Cloud and Amazon Web Services — application hosting, managed database, cache, queue, and file storage, and provider-managed backups, in the United States (us-east-1).
• Google — when you connect Google, API requests are made on your behalf to retrieve or sync the data listed above and to maintain webhook channels for the Google capability you enabled. When you search for stores, the Google Places API receives your approximate location and search words, as described above.
• Apple — when you connect Apple Calendar, Roostly makes requests to Apple's iCloud calendar servers with the credentials you entered to retrieve or sync calendar data and maintain the connection.
• Paddle — the merchant of record for subscription checkout, payment methods, invoices, receipts, taxes, cancellations, refunds, and disputes. Roostly uses verified Paddle catalog and subscription events to maintain billing mappings and access controls. Paddle processes payment and transaction data under its own privacy terms; see Paddle's Privacy Policy .
• Resend — our transactional email provider, to send account, security, invitation, and service emails and process delivery or bounce events. See Resend's Privacy Policy .
• Sentry — error and performance monitoring, hosted in the United States, to process diagnostic events, stack traces, masked session replays, and performance data so we can find and fix errors. See Sentry's Privacy Policy .
• Cloudflare — DNS, domain security, and Turnstile bot-protection challenges. Roostly traffic is proxied through Cloudflare, which provides CDN/reverse proxy, request filtering, traffic analytics, security, and abuse-protection services. Cloudflare may process IP addresses, request metadata, device and browser signals, security events, challenge outcomes, and related logs to deliver and protect Roostly; see the Cloudflare Turnstile product page and Cloudflare's Privacy Policy for details.

Roostly personnel do not read your Google user data unless you ask for support with specific content, it is necessary for security or abuse investigation, or we are required to comply with applicable law.

Authorized personnel, agents, and contractors must follow this policy and may access only the minimum Google user data needed for those narrow purposes.

Your controls

• Disconnect a Google integration at any time after signing in from Settings → Integrations . We immediately delete stored tokens and stop syncing; you can choose whether to delete the data synced from that integration.
• Revoke Roostly's access directly from your Google Account permissions page.
• Export or delete your account and its data from your account page after signing in.
• Manage billing from Settings → Billing . Family owners can start hosted Checkout or open the Paddle customer portal to manage payment methods, invoices, subscription status, and cancellation where available. Cancellations may take effect immediately or at the end of the current billing period depending on the Paddle subscription state and portal options.

Legal bases and international transfers

If the GDPR or UK GDPR applies to your use of Roostly, Roostly acts as the controller for account, household, support, security, and connected-provider data processed to operate the Service.

• Contract — to create and manage your account, provide household features, sync the integrations you enable, process subscriptions and invoices through Paddle, enforce paid access, and send service messages.
• Consent — for optional provider connections, optional profile imports, and any optional communications where consent is required. You can withdraw consent by disconnecting an integration, revoking provider access, updating account settings, or contacting us.
• Legitimate interests — to keep Roostly secure, prevent abuse, debug problems, respond to support requests, and improve reliability without overriding your privacy rights.
• Legal obligations — to comply with applicable law, preserve required billing, tax, accounting, security, and legal records, and respond to lawful requests.

Roostly is operated from the United States, and our infrastructure and service providers may process data in the United States or other countries outside the European Economic Area or United Kingdom. Where required, we rely on appropriate transfer safeguards such as provider data-processing terms, Standard Contractual Clauses, or equivalent lawful transfer mechanisms.

Roostly does not use solely automated decision-making that produces legal or similarly significant effects for users.

Roostly has not appointed a data protection officer. Send privacy questions and requests to [email protected].

EEA and UK privacy rights

If you are located in the European Economic Area or the United Kingdom, you may have the right to access, correct, delete, export, restrict, or object to certain processing of your personal data. You may also have the right to withdraw consent where processing is based on consent, and to lodge a complaint with your local data protection authority.

To make a privacy request, email [email protected]. We may need to verify your identity before completing a request.

US state privacy rights

Depending on where you live, state privacy laws may give you rights to know or access personal data we collect, correct inaccurate personal data, delete personal data, obtain a portable copy of personal data, opt out of sale or sharing for targeted advertising, limit certain uses of sensitive data, appeal a denied request, or be free from discrimination for exercising privacy rights.

Roostly does not sell personal data or share personal data for cross-context behavioural or targeted advertising. You can make a state privacy request or appeal a request decision by emailing [email protected], and we may need to verify your identity or authority to act for a household member before completing it.

Cookies, tracking, and security diagnostics

Roostly uses session, authentication, remember-device, CSRF, security, and preference cookies to keep you signed in and protect the Service. Cloudflare or Turnstile may set security or challenge cookies when those protections are enabled. Sentry may receive diagnostic metadata and masked replay events when error monitoring is enabled.

Roostly does not currently use advertising cookies, behavioural advertising pixels, or retargeting trackers. If that changes, we will update this policy and any required consent or opt-out controls before using them.

Roostly does not track you across other websites or online services over time, and does not allow third parties to do so through Roostly. Because there is no cross-site tracking to stop, Roostly does not change its behaviour in response to browser "Do Not Track" signals.

Security and vulnerability reports

If you believe you found a security vulnerability, email [email protected] with the subject "Security report", affected URLs or accounts, steps to reproduce, screenshots or logs if safe to share, and your contact information. Please avoid accessing, changing, deleting, or disclosing other people's data while reporting a vulnerability.

Future feature disclosures

Google Tasks, Google Photos or Photos Picker imports, Microsoft sign-in and calendar sync, memories and albums, expenses, rewards and achievements, AI features, and mobile app store releases are not described here as live Roostly features. Before any of those features launches, Roostly will update this policy, in-product disclosures, submitted provider scopes or app-store privacy forms, and related tests or review materials as needed.

Children

Roostly is a general-audience service for families. Accounts may only be created by users who are at least 13 years old (16 in the European Economic Area). Roostly does not knowingly collect personal data directly from children under 13.

A parent or guardian in a household may add a managed child profile for a household member under 18 so the family can assign chores and share lists. The guardian enters the child's first and last name and birthdate, and may add optional profile details: an email address, profile photo, nickname, favourite colour, hobby, bio, fun facts, and an emergency contact. Household members see the child's profile, assigned chores, and list items. A managed child profile cannot sign in to Roostly or connect external provider accounts, Roostly never contacts the child, and Roostly does not use children's data for advertising or profiling or share it with anyone other than the service providers listed above.

Roostly keeps a child's profile data only to provide the household features the guardian uses, such as chore assignments and shared lists, and only while the child belongs to at least one household.

The household's adults can edit a child profile, and the household owner (or an adult the owner allows) can remove it at any time. When a child profile is removed from its last household, the child's profile and personal data are permanently deleted after a 24-hour undo window. A parent or guardian can also ask us to review or delete a child's data by contacting [email protected]. If you believe a child under 13 created an account or gave us personal data directly, contact us and we will delete it.

Changes to this policy

We will update the "last updated" date above and, for material changes, notify active users by email before the change takes effect.