Privacy Policy

1. Who we are

Roster is a personal project built and operated by Mike Potter, an individual developer based in Ontario, Canada. There's no company entity behind it. When this policy refers to "Roster," "we," "us," or "our," it means Mike, acting in his personal capacity. This policy applies to the Roster mobile applications, the Roster website at rosterai.app, and any related services that link to this policy (collectively, the "Service").

2. Information we collect

Information you give us

• Account information. Your name, email address, and authentication identifiers when you sign in (including via Apple ID, Google, or your Anthropic / Claude account).
• Agent configuration. The agents you install or build, including their names, instructions, permission settings, tool selections, and memory scopes.
• Content you provide to agents. Messages, prompts, files, and any other content you share with an agent so it can do its job.
• Support and feedback. Anything you send us when you contact support or share feedback.

Information we collect automatically

• Device and app data. Device model, operating system version, app version, language, time zone, crash reports, and similar technical information.
• Usage data. Pages or screens you view, features you use, agents you run, and approximate timing of those events. We use this to understand how the Service is performing and to fix bugs.
• Log data. IP address, request timestamps, and error logs from our servers.

Information we do not collect

We do not sell personal information. We do not run advertising trackers in the app. We do not require contact list access, photo library access, or location data to use core features; if a specific agent needs one of those, the iOS system will prompt you and the agent will only get it after you say yes.

3. How we use information

We use the information we collect to:

• Operate, maintain, and improve the Service;
• Run the agents you've installed or built, on your behalf;
• Authenticate you and keep your account secure;
• Provide customer support and respond to your requests;
• Detect, prevent, and address fraud, abuse, security incidents, and bugs;
• Comply with legal obligations and enforce our Terms of Service.

4. Your Claude account and Anthropic

Roster is a "bring your own Claude" platform. When you sign in with your Anthropic / Claude account, the underlying language-model calls your agents make are billed to your Claude subscription and processed by Anthropic, PBC under Anthropic's terms and privacy policy. The content you send to an agent — including the agent's instructions, your messages, and any tool outputs the agent uses — is sent to Anthropic so that the model can produce a response.

Roster does not control how Anthropic processes that content. Please review Anthropic's Privacy Policy for details on how Anthropic handles model inputs and outputs.

5. Third-party integrations you connect

You may connect your Roster agents to third-party services (for example, an email provider, calendar, or knowledge base). When you do, you authorize Roster to access those services on your behalf, within the scopes you approve. We use those credentials only to perform the actions your agents are configured to perform.

You can disconnect any integration at any time from the app's settings. Disconnecting revokes our access going forward; it does not delete data already used by an agent.

6. Agent memory, instructions, and outputs

Each agent has a memory scope you configure. By default, an agent's memory is private to that agent and stored on your device. You can choose to back up agent memory and configuration to Roster's servers so that it syncs across your devices; in that case, the data is stored encrypted at rest.

Agent outputs (drafts, summaries, replies, files) are stored on your device. If you choose to enable cloud sync, they are also stored on our servers in the same encrypted form.

We do not use your agent content to train models. We don't fine-tune, evaluate, or otherwise train AI models on your prompts, agent instructions, agent memory, or agent outputs.

7. When we share information

We share information only in the following limited circumstances:

• With Anthropic, to run the language model that powers your agents, as described above.
• With service providers who help us operate the Service (for example, cloud hosting, error monitoring, and customer-support tools), under contracts that limit them to processing data on our behalf.
• With third-party services you authorize, only for the actions you've authorized them to perform.
• For legal reasons, when we believe in good faith that disclosure is required to comply with applicable law, legal process, or a lawful government request, or to protect the rights, property, or safety of Roster, our users, or the public.
• In a business transfer, in connection with a merger, acquisition, financing, or sale of assets — in which case we will notify affected users.

8. Data retention

We keep account information for as long as your account is active. Agent configuration and memory are kept until you delete the agent or your account. Server logs are typically retained for up to 90 days. When you delete your account, we delete or de-identify your personal information within 30 days, except where we are required to retain it for legal, accounting, or security reasons.

9. Security

We use industry-standard technical and organizational measures to protect personal information, including TLS in transit, encryption at rest for synced data, scoped access controls inside Roster, and audit logs for sensitive operations. No system is perfectly secure; please use a strong, unique password and let us know if you suspect your account has been compromised.

10. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and associated data;
• Export your data in a portable format;
• Object to or restrict certain processing; and
• Lodge a complaint with your local data-protection authority (in the EU/UK) or attorney general (in the US).

You can exercise most of these rights directly from the app's settings, or by emailing hello@rosterai.app. We respond to verified requests within 30 days.

11. Children

Roster is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

12. International transfers

Roster operates from Canada, and the information we collect is processed in Canada and in other countries where our service providers operate — most notably the United States, where Anthropic and our cloud-hosting providers are located. Where required by law, we rely on appropriate transfer mechanisms (such as the European Commission's Standard Contractual Clauses) to protect your information when it is transferred internationally.

13. Changes to this policy

We may update this policy from time to time. If we make a material change, we will notify you through the app or by email before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

14. Contact

Questions about this policy or about how we handle your information? Email hello@rosterai.app and Mike will get back to you.