Last updated: July 27, 2026
At Roostly, we believe your home data belongs to you. This Privacy Policy explains what information we collect, why we collect it, how we protect it, and the choices you have regarding your information.
| Data | Why we collect it |
|---|---|
| Email address, password (stored as a one-way hash, never in plain text) | To create and secure your account |
| Home address, latitude/longitude, year built, heating type, appliance info | To compute real historical weather data for that exact location and generate a maintenance schedule for that specific home |
| Documents you upload (receipts, warranties, manuals) | To store in your Digital Binder for your own reference |
| Photos you upload (appliances, maintenance issues, home components, your home's profile photo) | To store in your Digital Binder, and — when you use a scan feature or Ask Roostly — to power AI-based recognition, analysis, or answers about that specific photo |
| Messages you send through Ask Roostly | To generate a response to your question and keep your current conversation coherent |
| Which maintenance tasks you've marked complete | To calculate your Home Health Score |
| Home Inventory entries (item name, category, room, brand, model, serial number, purchase details, notes, and an optional photo) | To store your belongings catalog for your own insurance/planning reference |
| Family member names, and which name a task is assigned to | To label task assignments on your own account — see "Family sharing" below for what this does not include |
| Notes you add to inventory items, expenses, or emergency shutoffs | To store alongside the specific record you added them to |
| Emergency contacts, insurance policy details, and shutoff locations/photos | To store in your Emergency Passport for household reference, and optionally share via a link (see "Emergency Passport sharing" below) |
| Push-notification token and delivery platform (iOS/Android) | To deliver task-reminder and weather-alert notifications to your device |
| Notification preference (on/off) | To determine whether we send you notifications at all |
| Subscription status (trial/active/canceled) and billing dates | To determine whether your account has access — see "Who else sees your data" for who actually holds your payment details |
We do not intentionally request additional personal information beyond what's described above. Our infrastructure may also process limited technical information, such as IP address, timestamps, and request paths, for security, reliability, and abuse prevention — see "Where your data lives" below for detail on that. Separately, we never see or store your payment or card details — that's handled entirely by Google Play or Apple's App Store (below).
The homepage advertises "family sharing" — here's exactly what that means today. Adding a family member creates a name label on your own account, stored so you can assign tasks to that name (e.g., "Assigned to: Alex"). It is not a real invite: no account, login, email address, or notification is created for that person, and they don't get their own access to Roostly. Only you, the subscriber, can see the schedule and task assignments through your own login — a family member "sees" them only if they're looking at your device or you show them directly. If you want real multi-user access (separate logins, individual notifications) for household members, that isn't built yet — let us know at support@roostly.ca if that's something you need.
Separately from family sharing above, the Emergency Passport screen lets you generate a private, revocable link that shows your emergency contacts, insurance details, shutoff locations and photos, "what to do first" instructions, and basic appliance info (name, brand, model, serial number, room — not price, photos, or other inventory notes) to anyone who has that link, without them needing to log in or have a Roostly account at all. This is entirely your choice: no link exists until you generate one from that screen, and you can revoke it at any time, which immediately breaks the link. Because it's link-based rather than tied to a specific person, treat the link itself as sensitive once generated — anyone who has it can view that information until you revoke it.
Roostly uses AI (currently Anthropic's Claude) to write your maintenance schedule's text, power the Ask Roostly chat feature, and analyze photos or documents you submit to a scan feature. These AI-generated responses are for informational purposes only — they may not always be accurate or complete, and they aren't a substitute for a licensed inspector, contractor, or engineer. Recommendations are generated automatically from your data and a set of general maintenance rules; use your own judgment, and get professional advice before acting on anything safety-critical (electrical, gas, structural, plumbing, or anything else where a wrong answer could cause injury or property damage).
We don't collect microphone recordings, your device's contacts list, your text messages, your browsing history outside the app, or an advertising identifier used for advertising. Roostly also has no access to your device's GPS location — the weather and schedule are generated entirely from the address you type in, never from device location tracking. We don't run any analytics or crash-reporting service that profiles your individual behavior in the app; the only third-party push infrastructure we use (Firebase Cloud Messaging) exists solely to deliver maintenance-reminder and weather-alert notifications to your own device.
Your account and home data are stored in a database we manage. Uploaded documents and photos are stored in cloud file storage. Both are protected by your login — no other user's account can read or modify your home, schedule, or uploaded files (this is enforced on every request, not just hidden in the app's interface). Photos and documents are only sent to an AI provider when you actively use a feature that needs it (a scan, or a message in Ask Roostly) — never passively or in the background.
Like virtually any web service, our servers and hosting provider keep routine connection logs (e.g. IP address, timestamp, request path) briefly for security purposes and to prevent abuse — for example, to rate-limit repeated failed login attempts. This is standard infrastructure logging, not a profile of your activity, and it isn't linked to your account for any other purpose.
If data-protection law where you live requires us to state a legal basis for processing your data, it's one of these: processing your account, home, and subscription data is necessary to provide the service you signed up for (contract performance); processing photos, documents, and chat messages through an AI provider is also necessary to provide the specific photo-analysis, document-scan, or Ask Roostly feature you're using at that moment; and where none of that applies, we rely on your consent, which you can withdraw as above.
Roostly is operated from Alberta, Canada, but is available to users worldwide, and our infrastructure (hosting, database, file storage, and the third-party services listed above) is not necessarily located in your own country — most of it runs on US-based infrastructure today. If you're accessing Roostly from the EU, UK, Canada, or elsewhere with data-residency rules, your data will likely be transferred to and processed outside your country, including in the United States and Canada. We only work with established providers (Anthropic, Cloudflare, Neon, Railway, Google, Apple, Resend) who are themselves obligated to protect data transferred internationally, but a full, jurisdiction-by-jurisdiction legal review of each vendor's specific transfer safeguards (e.g. Standard Contractual Clauses) hasn't been done — this policy discloses the fact of the transfer honestly rather than asserting that every safeguard is formally documented.
We keep your account and home data for as long as your account is active. If you ask us to delete your account (see above), we delete it from our active database and file storage immediately — there's no extended "just in case" retention period we maintain ourselves. Our infrastructure providers' own routine, encrypted backup systems may retain a copy for a short additional period as part of their normal backup rotation before it's fully overwritten; we don't separately extract or restore data from those backups after a deletion request. If your business needs a stricter, formally documented retention schedule (e.g. for tax, legal-hold, or dispute purposes), that's a policy decision to set with a lawyer, not something this app currently enforces on its own.
Roostly isn't directed at, or knowingly used by, children. Creating an account already requires being old enough under the law where you live to agree to the Terms of Service on your own (see terms.html) — we don't knowingly collect data from anyone below that age.
Roostly is operated from Alberta. Canadian privacy law (the federal Personal Information Protection and Electronic Documents Act, and Alberta's Personal Information Protection Act) gives you the right to access the personal information we hold about you, request corrections, and withdraw consent — all of which are covered under "Your rights over your data" above. If you believe we've mishandled your personal information, we'd appreciate the chance to fix it directly first at support@roostly.ca; you also have the right to complain to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.
In addition to the rights listed above, you have the right to lodge a complaint with your local data protection supervisory authority if you believe we've mishandled your data. We'd appreciate the chance to fix a problem directly first — support@roostly.ca — but that's your right regardless.
Under California law (CCPA/CPRA), you have the right to know what personal information we collect (see the table above), the right to delete it, and the right to non-discrimination for exercising these rights — we won't charge you more or provide worse service because you asked. We do not sell your personal information, and we don't share it for cross-context behavioral advertising, so there's no "opt-out of sale" toggle to build — there's nothing being sold to opt out of.
Passwords are hashed (never stored or logged in plain text), all traffic between the app and our servers is encrypted (HTTPS), and every account's data is isolated from every other account's at the server level. Login and password-reset endpoints are rate-limited to slow down automated password-guessing attempts. No method of transmission or storage is 100% secure, and we can't guarantee absolute security, but we don't treat that as an excuse — we patch dependencies, keep secrets out of source control, and fix issues we find promptly.
We may update this policy as the app changes. If we make a material change to what we collect or how we use it, we'll make a reasonable effort to let existing users know before it takes effect.
Questions about this policy or your data: support@roostly.ca
Roostly