Privacy policy

What Rosterly is

Rosterly lets flight crew share their rosters with people they choose to approve. This page explains what information the app keeps, who can see it and how it's protected.

What we collect

• From Google or Microsoft when you sign in: your name, email address and profile photo. We use this only to create and identify your account.
• What you enter: your username, display name, airline, role, home base, profile photo and visibility setting, and, as features arrive, the flights, hotels, notes and messages you add.
• Technical data: sign-in session records (including the device's IP address and browser type) so we can keep you signed in securely.

Who can see what

• Your profile card (photo, display name, username, airline, role and home base) can be seen by signed-in Rosterly users who find you: through search if your profile is public, or by typing your exact username if it's private.
• Your roster is only visible to people whose follow request you approve. You can remove a follower at any time and their access ends immediately.
• Your email address is never shown to other people. Someone who already knows it can find your profile by searching for the whole address, but they never see it in the app.

How it's protected

All traffic is encrypted (HTTPS). Personal content such as profile photos is additionally encrypted with AES-256 before it's stored, and sign-in tokens from Google and Microsoft are encrypted too. Every request is checked on the server, so nobody can see information they haven't been given access to.

Google and Microsoft account data

Rosterly uses Google and Microsoft only to confirm who you are. It never reads your email, files, contacts or calendar. Information received from Google APIs is used in line with the Google API Services User Data Policy, including its Limited Use requirements.

Sharing

We don't sell your data, show ads or share it with anyone for marketing. It's stored and processed only by the services that run the app: Vercel (hosting), Neon (database) and Google or Microsoft (sign-in). When live flight status arrives, flight-data providers will receive flight numbers and dates only, never who is on the flight.

Weather forecasts come from Open-Meteo (CC BY 4.0). Our server asks for the forecast at an airport's location; nothing about you or your flights is sent.

Vercel Web Analytics and Speed Insights count page views and measure how fast pages load. They use no cookies and collect no personal data; usernames are removed from page addresses before anything is sent.

Keeping and deleting your data

Your information is kept while your account exists. You can delete your account at any time in Profile & settings → Delete account. That immediately and permanently removes your profile, photo and everything you've added. If you signed in but never finished setting up, you can cancel from the sign-up page and nothing is kept.

Changes

If this policy changes, the date at the top will be updated.