Privacy notice

Roostly is run by one person in the UK, and is free. Contact for anything on this page, including a request to see or delete what is held: hello@myroostly.app.

Roostly has not appointed a data protection officer, and at this size is not required to.

Your account. An email address and a password, held by Supabase Auth. The password is stored as a hash, so nobody at Roostly can read it. If you sign in with Google, Roostly is told your email address and nothing else.

What you put in. Your household name, the people in it and the names or initials you give them, and then the things you add: tasks and who they are for, events, bins, shopping, meals, key dates such as an MOT, and, only if you turn the money layer on, bills, pots and amounts. Files you attach to a thing, for example a boiler warranty. Notes you write.

What Roostly records about using it. A count of seven kinds of event: signing up, signing in, creating a household, joining one, opening a feature, adding Roostly to a home screen, and turning notifications on. Each is stored as the event name and the ids of the person and household, with no text from anything you added. You can turn this off in Settings, under Privacy.

Crash reports. When something breaks, Roostly records what broke, on which screen, and the message. Not the contents of your household.

Notifications. If you turn reminders on, the browser gives Roostly a subscription for your device so a reminder can be sent to it. Roostly stores that, and a log of what was sent so the same reminder is not sent twice.

What Roostly does not store. No bank details, no card details, no location, no contacts from your phone, no analytics from anybody else, no advertising identifiers. There is no billing, so there is nothing to bill.

For the household itself, Roostly relies on contract: you asked for an app that holds your household’s calendar and jobs, and it cannot do that without storing them.

For reminders, consent, which is the browser permission prompt, and which you can withdraw by turning notifications off.

For the counts and the crash reports, legitimate interests: knowing whether a feature is used at all, and that the app is not broken. The counts can be turned off and the app works the same.

Your household can. Everybody in a household sees that household’s rows. That is what a shared home base is, and it is enforced in the database rather than in the app: one household cannot read another’s rows even if the app has a bug.

Anybody with a share link can see what that link is for. A family view link shows the household board, a child link shows one child’s own jobs and no money, and a calendar feed link shows the calendar to a calendar app. These work without signing in, which is their purpose, so treat one like a key. Each can be revoked on its own, in Settings under Sharing.

Roostly’s administrator can see counts and crash reports in an admin dashboard, and whatever you send through “Send feedback”. Not your tasks, events, notes or attachments, and not your household’s name: the dashboard identifies a household by an id, because its name is usually its address.

Nobody buys it. Your data is never sold, never shared with an advertiser, and never used to train anything.

Supabase holds the database, the sign-in and the files. Servers in the EU.

Hetzner runs the machine the app itself is served from, in Germany.

Resend sends email, when email is switched on. At the time of writing it is not, so no email is sent at all.

Google, Apple, Mozilla and Microsoft run the push services that carry a notification to a device. A notification carries the words of the reminder, so keep that in mind when naming a job.

Your council, if you use a council bin feed: Roostly fetches the published collection calendar for your postcode. The council is told a postcode is being looked up.

For the solicitor: each of these needs checking as a processor, and the international transfer position confirming for the push services, whose endpoints are outside the UK and EU.

Everything below is enforced by a scheduled job in the database, not by intention. Where a row says “until you delete it”, deleting your account deletes it.

Your household: tasks, events, bins, shopping, meals, key dates, notes, attachments, and money if you turn it on

Until you delete it. Deleting the household deletes all of it.

Your account and email address

Until you delete the account.

The activity feed, who ticked what off and when

24 months, then deleted nightly.

Counts of the seven events, by id

24 months. Deleting your account detaches the counts from you straight away and leaves the total.

Crash reports

90 days, then deleted nightly.

Notification subscriptions for your devices

Until you turn notifications off, or a day after the push service says the device is gone.

The log of which reminders were sent, so none is sent twice

90 days, then deleted nightly.

One-tap links in a reminder, for example "done"

Two days after they are used or expire.

Family, child and calendar feed links

Until revoked, or until the expiry you chose. Revoking deletes the link.

Feedback you send from inside the app, and a screenshot if you attach one

24 months, then deleted nightly.

Server and platform logs are the exception, and the honest answer is that Roostly does not control them: Supabase, Hetzner and the push services keep their own operational logs on their own schedules, described in their terms. Roostly writes no request log of its own.

Roostly is for a household, and a household has children in it. Children do not get accounts. A child takes part through a link a parent creates, which shows that child’s own jobs and nothing else: no money, no other people’s jobs, no settings, and no way to change the household.

A child link stores the name the parent typed and what that child ticked off. It does not ask the child for anything: no email address, no password, no date of birth. It can be revoked at any time, and revoking it deletes the link.

For the solicitor: the reasoning, and the decisions already taken, are in the impact assessment kept with the code. The questions worth confirming are whether a parent creating a link is a sufficient basis for a child’s first name and tick history, and whether the age-appropriate design code applies to a view with no account behind it.

A copy. Settings, then Privacy, then Take a copy. It is a file, straight away, with no request to make.

Deletion. Settings, then Account. Deleting an account removes you and what is only yours. Household rows belong to the household, so the last person to leave a household takes it with them.

Correction, objection, or a copy in another form. Email hello@myroostly.app.

You can complain to the Information Commissioner’s Office at ico.org.uk, and you do not have to ask Roostly first.

The date at the top is the date the wording last changed. A change that affects what is collected or who sees it will be said in the app, not only here.