Roster · by Anits

Your privacy matters

Last updated: 1 July 2026 · Effective: 1 July 2026

Roster is built to track your work hours and earnings. We collect only what is necessary to provide this service — nothing more.

1. Who we are

Roster is developed and operated by Anits, based in India. You can reach us at anits.in or by email at the address listed at the bottom of this page.

2. What information we collect

We collect the following information when you create and use a Roster account:

Email address — used to create your account, sign in, and send password reset emails.
First and last name — used to personalise your experience within the app.
Country / region — used to detect public holidays and set appropriate default pay rate settings.
Device identifier — a technical ID unique to your device, used to sync data across sessions and prevent trial abuse when creating new accounts. This is not linked to your name or personal identity.
Shift and earnings data — times, dates, hours worked, job details, and earnings you log in the app. This data is stored securely and is only accessible to you.

We do not collect phone numbers, physical addresses, payment card details, social media profiles, or any data from your contacts, camera, or microphone.

3. How we use your information

To provide the Roster service — storing your shifts, calculating earnings, and syncing data across your devices.
To send you transactional emails — account confirmation and password resets only. We do not send marketing emails.
To detect relevant public holidays for your country so penalty rates are applied correctly.
To manage your subscription if you choose to subscribe to Roster Pro.
To prevent trial abuse — ensuring each user receives only one free trial period.

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

4. Data storage and security

Your data is stored in two places:

On your device — an encrypted local database (SQLite) stores your shifts for offline access.
In the cloud — your data is synced to Supabase, a secure database platform hosted on AWS infrastructure. Data is encrypted in transit (HTTPS/TLS) and at rest.

Authentication tokens are stored in your device's secure hardware-backed storage (Android Keystore), not in plain text. Your password is never stored — Supabase uses industry-standard bcrypt hashing.

5. Account deletion and data retention

You can request account deletion at any time from Profile → Delete account. When you do:

30-day grace period — Your account is placed in a pending deletion state. Your data remains intact and you can reactivate your account at any time during this window by signing back in.

After 30 days — All personal data is permanently deleted from our servers. This includes your shifts, jobs, earnings history, name, country, and all profile information.

Anti-abuse retention (90 days) — A one-way SHA-256 cryptographic hash of your email address and your device identifier are retained for up to 90 days after deletion. This is used solely to prevent free trial abuse (e.g. repeatedly creating accounts to obtain new trials). The hash cannot be reversed to obtain your original email address — it is mathematically impossible to reconstruct the email from the hash.

After 90 days — All remaining records including the hash are permanently deleted. No data about your account is retained after this point.

During the 30-day grace period, access to the app is disabled. To reactivate simply sign in again — you will be presented with a reactivation option and all your data will be restored immediately.

6. Third-party services

Roster uses the following third-party services:

Supabase (Privacy Policy) — database, authentication, and cloud sync.
Google Play Billing (Privacy Policy) — processes subscription payments. We do not store your payment card details.
Nager.Date API — a public API used to fetch public holiday data for your country. No personal data is sent to this service.

We do not use Google Analytics, Facebook Pixel, or any advertising or analytics trackers.

7. Your rights

You have the right to:

Access your data — export all your shift data as a CSV file from within the app at any time.
Correct your data — edit any shift, job, or profile information directly in the app.
Delete your data — use the "Delete account" option in Profile settings to permanently remove all your data.
Reactivate — if you request deletion, you have 30 days to reactivate your account and recover all data before it is permanently deleted.
Data portability — export your data as CSV at any time from the app.

8. Children's privacy

Roster is a workplace tool designed for adults. We do not knowingly collect personal information from anyone under the age of 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of Roster after changes constitutes acceptance of the updated policy.

10. Contact us

Questions about your privacy?

Anits · India