Privacy Policy

Last updated: 2026-09-26

This Policy provides notice about our data practices. Where consent is legally required or a feature is optional, we ask separately in the App. Safety moderation of content submitted to community and communication features is a required part of providing those features and cannot be disabled while using them.

This Privacy Policy explains how Silvauren Software LLC, a Wyoming limited liability company ("Company", "we", "our", "us"), collects, uses, and shares information when you use the Roster mobile application and related websites (collectively, "Roster" or "the App"). Roster is offered only to adults 18 and older in the United States.

Key points:

• We do not sell personal information, and we do not use or share it for targeted or cross-context behavioral advertising. The App contains no third-party advertising or ad-attribution SDKs.
• Anonymous cross-roster matching is on by default. Contact details you add for a partner are turned into one-way tokens and compared with other members' tokens. You can hide any partner, or all of them, for free, and you can turn matching off (Section 1.3).
• Some information we hold is about people who do not use Roster, entered by our users (Section 1.6). Those people can contact us; Section 5.1 explains what we can and cannot do.
• Roster does not collect your device's location. Date-safety features share only the venue you type.
• Some things you share can be seen widely: Public posts and stories by anyone on Roster, business profiles by anyone on Roster, and a Share my date plan link by anyone who has it (Sections 1.13 to 1.15).
• We use OpenAI, an AI service provider, for safety moderation and a few optional features (Section 1.4).
• Roster is not an emergency service.

1. INFORMATION WE COLLECT

1.1 Information You Provide Voluntarily

• Account Information: Name, email address, a password (kept by our authentication provider, Firebase Authentication, in hashed form), your @username, and your confirmation that you are 18 or older and a U.S. resident. We do not ask for your date of birth. You may also add an age and gender to your profile
• Profile Data: Photos, videos, ratings, reviews, notes, posts, stories, and other content you upload
• Business Account Information (optional): If you switch to a business account, the category, website, address, contact email, and contact phone number you enter, and any verified-badge request (Section 1.14)
• Partner Information (information about other people): Data about individuals you add to your roster, including names, photos, phone numbers, email addresses, and social media and payment handles, plus anything else you choose to record about them. This information comes from you, not from the person it describes, and most of those people do not use Roster. It is processed as user-generated content to provide the features you use, including anonymous cross-roster matching (Section 1.3), and is never independently verified or treated as factual by the Company. Non-users whose information may have been submitted may contact help@myrosterapp.com to request review and removal (see Section 5.1 for what we can and cannot locate).
• Communication Data: Messages, friend requests, invitations, and other communications
• Safety Feature Data: Scheduled-date details you enter (such as who you are meeting, when, and the venue you type), check-in status, your "When I miss a check-in" choice, emergency-contact and trusted-circle selections, safety updates, emergency messages, "Home safe" messages and check-on-me requests to your Trusted Circle, and the date-plan links you create and what you choose to show on them (Section 1.15). Date-safety features do not collect your device's location
• Contact Information (optional — "Find Friends"): If you choose to use the Find Friends feature, we access your device's address book with your permission. Phone numbers and email addresses from your contacts are converted into one-way hashes on your device and only those hashes are sent to us. While contact discovery is on, we keep those hashes with your account and use them only to show you contacts who already use Roster and to tell you when one of them joins ("A contact joined Roster"). We do not store your contacts' raw phone numbers or email addresses, and we do not contact, add, or share information about people in your address book. This feature is entirely optional and can be skipped; turning it off in Settings > Privacy deletes the uploaded hashes.
• Verified Phone Number (optional): If you choose to verify a phone number, our authentication provider (Firebase Authentication) texts you a code and keeps the number with your account. For finding friends we store only a salted, one-way hash of it, not the number itself. "Let people who have my number find me" (Settings > Privacy) is on once you verify, and you can turn it off at any time, which deletes that hash. While it is on, people who have your number in their contacts and use Find Friends can find you, and may get an "A contact joined Roster" notice when you join or verify your number. While it is off, nobody is told that you joined. You can also remove the number at any time. Like any hash of a phone number, it can be matched by someone who already has the number; that is how the feature works
• Email Address Hash: We also keep a one-way hash of your account email address, so people who have your email address in their contacts and use Find Friends can find you. Turning off "Let people who have my number find me" stops the joined notices and phone matching, but not matching by email address
• Payment Information: Purchase and subscription records, such as the plan, price, billing period, any introductory offer, and renewal status, from Apple, Google Play, and RevenueCat. Payments are processed by Apple or Google; we do not receive your card details
• Preferences: Settings, customization choices, and notification preferences

1.2 Information Collected Automatically

• Device Information: Device type, model, operating system, unique device identifiers, including a random identifier the App creates for its installation on your device (used for account security, fraud prevention, and ban enforcement, Section 1.12)
• Usage Data: Features accessed, time spent, interaction patterns, and app performance
• Location Data: We do not collect your device's GPS or other precise location, and the App does not ask for location permission. We do not work out your city or region from your IP address. We record the country and time zone set on your device
• Log Data: IP address (kept with your sign-in activity for account security, and in hashed form to detect referral abuse), browser type, access times, pages viewed, crash reports
• Analytics Data: Aggregated usage statistics for service improvement

1.3 Anonymous Cross-Roster Matching

Matching is on by default. When you add a partner with a phone number, email address, or Instagram, Snapchat, TikTok, Facebook, Cash App, or Venmo handle, your device creates one-way matching tokens from those identifiers and publishes them, in a bundle with your other shared partners' tokens, under a pseudonymous publisher ID. Names, photos, notes, and other details are not used for matching. For matching we process:

• Cryptographically blinded values derived from those identifiers, sent by your device to our server so it can apply our monthly key
• Token bundles (one-way hashes of the tokens), each tied to a monthly or daily period
• An internal routing record that links a bundle to your account, so we can update or withdraw it, route connection requests, and enforce our Terms
• Match results: for each partner you scan, how many other rosters currently hold a matching token, which identifier types matched, and a confidence estimate. Results do not reveal other users' identities

Who can link what. Other users cannot turn a token back into an identifier, see your bundle, or learn which account published it. We can link a bundle to your account using the routing record. When a member scans, they learn only the counts and matched identifier types for their own partners; in an anonymous connection request, the recipient sees the sender's own label for the person and the matched types, not the sender's identity.

Your choices. Hiding a partner is free and removes them from matching both ways: a hidden partner is not shared and is not scanned. You can hide all partners at once for free, or turn matching off entirely in Privacy & Consent. Anonymous Mode, a paid add-on ($4.99 per month, or included with Elite), hides every partner while still letting you scan all of them. Section 16 of the Terms explains each control, and Section 4 explains how long bundles are kept.

We want to be precise about what this protection does and does not do. Tokens are pseudonymous rather than anonymous in every sense, and we treat them as personal information. The blinding happens on your device, so our servers never receive the raw identifier and cannot read it out of the value we store. Those values are not reversible by working backwards from the stored value alone. They are, however, deterministic within each monthly period and are derived using a secret key that we hold. That means someone with access to that key could test whether an identifier they had already guessed is present — it does not let them recover an identifier they do not already have. We restrict access to that key, rotate the derivation every month, and delete the published values on a rolling basis.

1.4 Safety Moderation and Third-Party AI (OpenAI)

We send some information to OpenAI, a third-party artificial-intelligence service provider, for these purposes only:

• Safety moderation: when you submit messages, posts, comments, story captions, sticker text, reports, appeals, photos, or videos, we may send that content and limited recent context to OpenAI to check for illegal or harmful content. For a video, we send a few still pictures taken from it, not the sound.
• Reports and appeals: to help sort reports, support appeals, and assist our safety team.
• Import from screenshot: only when you use it (Section 1.8).
• Account Access Assistant: only when you use it, and only what you type, after we remove email addresses, phone numbers, links, and recovery codes (Section 1.16).
• Understanding feedback: short excerpts (up to 300 characters) of feedback you send us, and of posts and comments that talk about the App, without the author's name or account details, so we can summarize what people like and what to fix.

Automated results may block content, create a moderation record, apply an account restriction, or route an item for human review. We minimize direct identifiers in these requests where practicable.

Safety moderation is required for community, messaging, reporting, and media-upload features. If you do not want content processed for safety moderation, do not submit content through those features. By accepting this Policy you agree to this processing. If the App asks for your permission before a feature sends content to OpenAI and you say no, that feature will not be available to you. OpenAI states that API business data is not used to train its models by default; OpenAI may process or retain API data for service operation, security, and abuse monitoring under its then-current business/API terms. See OpenAI's enterprise privacy commitments.

1.5 Sensitive Information

Some things you may record about your own dating life, such as notes about intimacy or sexual health, can be sensitive. Record only what you are comfortable keeping, and see Section 6.1 for how each kind of information is stored. We use sensitive personal information only to provide the features you ask for, to keep the App and its users safe and secure, to prevent fraud and abuse, and to comply with law. We do not sell it or use it for advertising, and we do not use it to infer characteristics about you except as needed for a feature you choose to use.

1.6 Categories and Sources at a Glance

• Identifiers and account details (name, email, phone number, username, account ID): from you
• Information about other people (Partner Information, including third-party phone numbers, emails, and handles): from our users, not from the people it describes
• Matching tokens and match counts: created by your device and our servers from Partner Information, as described in Section 1.3
• Content and communications (messages, posts, comments, photos, reports): from you and from other users
• Safety and moderation records: from you, from other users' reports, and from our automated systems
• Purchase and subscription records: from Apple, Google Play, and RevenueCat
• Device, usage, and log information: collected automatically
• Inferences: the App computes a match confidence estimate that only the scanning member sees. We do not build profiles of people who do not use Roster.

1.7 Invites, Friends, and Usernames

• Personal invite links: your link carries a random invite code tied to your account. It is not made from your account ID, and you can reset it in Invite Friends ("Reset my invite link"), which stops old links from working. If someone creates an account through your link and verifies their email, we record that they joined through you and make the two of you friends on Roster automatically. If they type your public @username code instead, we record the invite and send you their friend request.
• Safety-contact invites: when someone accepts a "be my safety contact" invite, we make the two of you friends and add them to the inviter's emergency contacts or trusted circle.
• Invite rewards and abuse checks: to grant invite rewards and stop fake or self-referrals, we keep invite records and hashed forms of the new member's email address and network address.
• Usernames: to apply the username rules in Section 18.1 of the Terms, we keep the dates of your recent username changes, and when you change your username we keep a record that the old one was yours for the 14 days it is held. When an account is deleted, its username is held for 30 days without that link, and its change history is deleted.

1.8 Import from Screenshot

If you use "Import from screenshot", the App resizes the screenshots you pick (up to 3) and sends them to our server, which sends them to OpenAI only to read a person's name, age, location, bio, and occupation into the form. The images are held in memory for that request and then discarded; we do not store them or the text read from them, unless you choose one of them as the person's profile picture, which is then saved like any other photo you add. We keep only a count of your imports for the daily limit and usage and cost records that contain no image content. OpenAI processes the images under the terms described in Section 1.4.

1.9 Anonymous Chats

In anonymous chats, other members see an alias and a random participant key, not your account. We keep a private record linking each key to its account, which only our servers and authorized staff can use, to run the feature, route messages, apply blocks, act on reports, and meet legal obligations. Anonymous chats are moderated like other messages (Section 1.4) and are not end-to-end encrypted (Section 6.1).

1.10 Notifications

We send push and in-app notifications for the features you use, such as messages, friend requests, safety alerts, and "A contact joined Roster" notices (Section 1.1). We may also send gentle reminders after a few days away: at most one every 3 days, not overnight, and never with names. You can turn them off with "Gentle Reminders" in Settings > Notifications, and you can hide notification content on your lock screen.

Quiet mode pauses ordinary push notifications for 1 to 12 hours. Safety and account-security alerts still come through, and in-app notifications are still saved. If you turn on its auto-reply, the first message you get in each one-to-one chat during that time gets one short automatic reply from you saying you are in quiet mode.

1.11 Settings Kept on Your Device

Some settings and records stay only on your device and are not sent to us: your app-lock settings, "Hide Roster in the app switcher", your intimacy log and its consent, subscription-reminder banners, and unfinished post and story drafts (Section 1.13). The app lock uses your device's own Face ID, fingerprint, or passcode check; the device tells the App only whether the check succeeded, and we do not receive biometric data. On some sensitive screens the App blocks screenshots and screen recording.

1.12 Fraud, Automation, and Ban-Enforcement Signals

To keep members' information from being scraped and to stop banned people from coming back, we use a few security signals:

• Automation checks: for each account we count, for a short time, how often profiles, search, friend lists, and suggestions are used, how many different people were viewed in an hour, the timing of requests, and whether requests came from a genuine copy of the App. We use this only to detect automated collection of members' information and to apply the checks in Terms Section 3. These records are kept for about 30 days after the last use, and related security events for up to 90 days.
• Ban-enforcement signals: when an account signs up or signs in, and when a phone number is verified, we compare protected one-way forms (salted cryptographic hashes that we cannot turn back into the original) of its email address (after removing aliases, such as dots and "+" tags in Gmail addresses), verified phone number, App installation identifier, Apple or Google sign-in identifier, app-store purchase records, network (IP) address, and name with those of banned accounts. We do not store the readable values for this purpose. A strong match can block the new account; weaker matches, such as the same network, are only reviewed by a person.
• Spam checks: to stop spam and scams, we count the friend requests and first messages an account sends, record how people respond (accepted, declined, ignored, blocked, or reported), and check whether first messages to new contacts look like lures or copies of each other, using salted one-way fingerprints of recent first messages. We act only when there is more than one sign (Terms Section 3). A first message that is held for review is kept for a person on our team to look at. These records are kept for 30 days after the account's last activity, and held messages for 30 days.
• Retention: signals for an active account are deleted with the account, and network-address signals are kept for no more than 30 days. If an account is banned, its protected signals are kept for up to 2 years (network signals for up to 30 days) to enforce the ban, and are removed if the ban is lifted.
• Your choices: these checks are needed to operate the App safely and cannot be switched off. If you think a decision was wrong, request a review from the sign-in screen or write to help@myrosterapp.com.

1.13 Posts, Stories, Videos, and Who Sees Them

• Who sees it: you choose when you share. "Friends only" means your friends. "Close Friends" (stories only) means only the friends on your Close Friends list. "Public" means anyone on Roster who opens your profile, together with any place you typed. People you blocked, or who blocked you, never see it.
• World: when World is available, Public posts that pass extra safety checks may be shown to other members in the World tab. They are ranked by likes and comments, and may be shown first to people whose profile city is near the place you typed. Turn off "Show My Public Posts in World" in Settings > Privacy to keep yours out.
• Close Friends list: only you can see your list. Nobody is told when you add or remove them.
• Stories disappear after 24 hours. Our servers then delete the story, its photos, and the record of who viewed it, usually within a few hours. You can see who viewed your story, and people whose stories you view can see that you did. If a story is reported, we keep its photos for up to 90 days so our safety team can review them.
• Videos: posts can include videos of up to 30 seconds, with sound. Your phone may shrink a large video before uploading it. Before anyone else can see it, our servers check still pictures taken from it (Section 1.4), convert it to a smaller file, and remove hidden details stored in the file, such as where and on which device it was recorded. The original upload is then deleted.
• Stickers and filters on post and story photos are added on your device and saved into the photo. Sticker text is checked by our moderation. You can mention a friend in a sticker only if their "Allow others to tag me in posts" setting allows it; the mention becomes part of the photo, and we do not store it separately or notify them.
• Polls: anyone who can see a post can vote on its poll. We store each vote so it can be counted and changed. Only the voter can see their own vote; the author and everyone else see only totals.
• Pinned posts: you can pin up to 3 posts to the top of your profile. Pinning does not change who can see them.
• Drafts: an unfinished post or story is saved only on your device, so you can finish it later. We do not receive it. It is deleted when you share or discard it, when you sign out, or after 14 days. Your phone's own backups may include it.
• Places: when you search for a place to add to a post, story, or business profile, the search goes to Google Places through our servers.

1.14 Business Accounts

When business accounts are available, you can switch your account between Personal and Business in Settings.

• What we keep: the category, website, and address you pick, a contact email address and phone number if you enter them, and whether to show them. We also keep a short history of your account-type switches to prevent abuse.
• What others see: anyone on Roster can see the category, website, address, verified badge, and follower count on a business profile. The contact email and phone number are shown only if you choose to show them. We never show the email address you sign in with.
• Followers: when you follow a business, we keep a record of that so its Public posts appear on your Board. The business sees how many followers it has, not who they are.
• Messages: people can message a business without being friends. A business can reply but cannot start a chat. These messages are handled like any other chat (Sections 1.4 and 6.1).
• Verified badge: if you ask for one, we keep your request (your website and your note on how we can check the business) and our decision.

1.15 Share My Date Plan Links

• What it is: a link to a simple web page about a date you are on or have planned, so someone you trust can follow along. Anyone who has the link can open the page in a web browser, without a Roster account. Search engines are told not to list it.
• What it can show: you choose, per link, from your first name, the venue and address you entered, the time window, whether you have checked in, and a note to call or text you. It never shows your phone number or your location.
• Details about your date: these are off unless you turn them on for that link: your date's first name, their main photo from your roster, and one social handle you pick (Instagram, Snapchat, TikTok, X, Facebook, or LinkedIn). The page never shows your date's phone number, email address, notes, or other details. Because handles are encrypted on your device, your device sends us the one handle you picked. The photo is sent to the viewer by our servers, and only while the link works.
• Visits: we count how many times the link is opened and show you the count. To stop abuse, we limit how often a link can be opened, using a one-way hash of the visitor's network address, never the address itself.
• When it ends: a link for a date in progress stops working 4 hours after the date ends, and never more than 24 hours after you create it. A link for a planned date stops working 8 hours after the planned start, or 4 hours after you mark the date done. You can turn off any link at any time.
• Deletion: we delete your date's details from the link when you turn it off, and otherwise no later than about an hour after the link's last possible end time (24 hours after you create it for a date in progress, or 8 hours after the planned start). A record of the link, without your date's details, stays with your account until you delete your account.

1.16 Account Access Assistant

If you cannot sign in or need help with your account, you can describe the problem to the Account Access Assistant, from "Can't sign in?" or from Settings. We remove email addresses, phone numbers, links, and recovery codes from what you type and send the rest to OpenAI, which only sorts it into one of a few kinds of problems. Our own systems, not OpenAI, decide what happens next, such as sending a password-reset email to the account's own address. The assistant never says whether an account exists. We keep a record of each request for up to 90 days to prevent abuse and to check that the assistant works. If your case needs a person, we open a support request. Do not type your password or recovery codes into it.

2. HOW WE USE YOUR INFORMATION

We use your information to:

• Provide and maintain the App
• Process transactions and send related information
• Send administrative messages, updates, and security alerts
• Respond to your comments, questions, and requests
• Analyze usage patterns to improve the App
• Detect, prevent, and address fraud and security issues
• Moderate user content, investigate reports and appeals, enforce our rules, and meet legal reporting obligations
• Deliver optional date-safety check-ins, trusted-circle updates, missed-check-in alerts (when that feature is on), and emergency messages that you initiate, including the venue details you enter
• Create friendships and send friend requests from invites, and grant invite rewards, as described in Section 1.7
• Read partner details from screenshots you choose to import (Section 1.8)
• Send notifications, including gentle reminders you can turn off (Section 1.10)
• Run anonymous cross-roster matching, route anonymous connection requests, and send overlap alerts, as described in Section 1.3
• Show your posts, stories, videos, polls, and business profile to the people you chose, and run World when it is available (Sections 1.13 and 1.14)
• Show the date-plan pages you create to the people who have the link (Section 1.15)
• Help you get back into your account (Section 1.16) and send account-security emails
• Stop spam, scams, automated scraping, and banned members coming back (Section 1.12)
• Comply with legal obligations

We do not use Partner Information or matching tokens for advertising, to build marketing profiles, or to sell information about anyone.

3. HOW WE SHARE YOUR INFORMATION

We disclose information to service providers only for the purposes described in this Policy, including:

• Google Firebase and Google Cloud: authentication, databases, storage, hosting, server functions, security, and crash/performance services
• OpenAI: automated safety moderation of text, photos, and still pictures from videos, report triage, and appeal support; reading the screenshots you choose to import (Section 1.8); sorting Account Access Assistant requests (Section 1.16); and summarizing feedback excerpts, as described in Section 1.4
• Apple, Google Play, and RevenueCat: purchases, subscriptions, receipts, entitlements, fraud prevention, and customer support
• Expo: push-notification delivery and related mobile infrastructure
• Resend: sending account-security emails to your account email address, such as a sign-in on a new device, account recovery, new recovery codes, and Cloud Recovery restore notices. Emails that verify your address or reset your password are sent by Firebase Authentication
• Google Places: place searches you start, for date planning, post and story locations, and business addresses
• Other members (friends, invites, and safety): what the App shows your friends; the fact that you joined through someone's invite, to that person; and, if you add them as emergency contacts, the safety alerts and venue details described in Section 1.1
• Other members (posts, stories, and business profiles): what you share with the audience you choose, including Public posts, stories, and business profiles that anyone on Roster can see (Sections 1.13 and 1.14)
• People with your date-plan link: whatever you chose to show on that link, including any details about your date that you turned on, until the link stops working (Section 1.15)
• Other members (matching): only the limited signals described in Section 1.3, meaning counts, matched identifier types, and a confidence estimate, and in a connection request the sender's own label for the person. We do not show other members who you are or what else is on your roster
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with mergers, acquisitions, or asset sales
• With Your Consent: When you give us permission

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or targeted advertising, and the App contains no third-party advertising or ad-attribution SDKs. Optional analytics, marketing, data-sharing, crash-reporting, contacts, camera, and photo access are controlled through App or device settings where applicable.

4. DATA RETENTION

We retain information only as long as reasonably needed to provide the App, protect users, prevent fraud, resolve disputes, enforce agreements, and meet legal obligations. Retention varies by category:

• Account and feature data is generally retained while your account is active
• User Content is retained until you or an authorized moderator deletes it, subject to safety and legal holds
• Moderation, security, audit, transaction, and consent records may be retained longer where reasonably necessary for safety, fraud prevention, dispute resolution, accounting, or law
• Automation-check records are kept for about 30 days after last use; ban-enforcement signals of a banned account for up to 2 years (network signals up to 30 days), as described in Section 1.12
• Disaster-recovery backups: we prune monthly authentication backups older than 35 days and daily database backup date folders older than 31 days. Pruning runs daily, so data about a deleted account can remain in these snapshots until the next daily cleanup after the applicable window expires. Authentication backups include password hashes and salts needed to restore sign-in. Provider-managed recovery copies and legally required holds may take additional time to cycle
• Stories are deleted after 24 hours, with their photos and view records; photos of a reported story are kept for up to 90 days (Section 1.13)
• The original file of a video you upload is deleted once it has been checked and converted; the converted video is kept with its post
• Details about your date on a date-plan link are deleted as described in Section 1.15
• Spam-check records are kept for 30 days after the account's last activity, and held first messages for 30 days (Section 1.12)
• Account Access Assistant requests are kept for up to 90 days (Section 1.16), and records of account-security emails we send for 30 days
• Screenshots you import are not retained (Section 1.8). Uploaded contact hashes are deleted when you turn contact discovery off. A reset invite code is kept, inactive, so rewards already earned through it can still be settled
• Matching bundles: each monthly bundle expires 9 days after the end of its month (a daily bundle, 2 days after the start of its day), is ignored for matching from that moment, and is then deleted automatically, usually within about a day. Bundles are not included in our database backups. When you hide a partner, turn matching off, turn on Anonymous Mode, delete a partner, or delete your account, we withdraw the affected bundles right away (or as soon as your device reconnects or our servers process the change). Older bundles that cannot be tied to an account expire on the same schedule. Withdrawal stops future matches but cannot undo what a member learned from an earlier scan

You can request deletion in the App or through help@myrosterapp.com. We ordinarily complete verified account and non-user removal requests within 30 days, except where law or a documented safety, fraud, dispute, or record-preservation need requires limited retention. Deleting an account does not automatically cancel an Apple or Google store subscription.

5. YOUR RIGHTS

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your data
• Portability: Receive your data in a portable format
• Opt-Out: Opt out of certain data processing activities
• Withdraw Consent: Revoke consent for data processing

To exercise these rights, contact us at: help@myrosterapp.com

We will not discriminate against you for exercising a privacy right. We may need to verify your identity or authority before completing a request. A non-user may also ask us to review and remove information they believe a user submitted about them. Because contact identifiers (phone numbers, email addresses, social and payment handles) are encrypted on the submitting user's device, we cannot search for them, confirm or deny whether a particular person appears in a roster, or suppress them from future submissions. We can remove readable content a requester points us to, such as a name or photo in a specific post, comment, profile, or report, and act on reports of abuse.

5.1 If You Do Not Use Roster

If you believe a Roster user entered information about you, email help@myrosterapp.com with the subject "Non-User Request". We will remove readable content you point us to, such as your name or photo in a specific post, comment, profile, or report; act on reports of abuse; and tell you what we did. Honest limits: contact identifiers in rosters are encrypted on each user's device, and matching tokens are one-way, so our removal process cannot search rosters or tokens for your phone number, email address, or handles, cannot confirm or deny whether you appear in anyone's roster, and cannot stop a user from entering your information again. Matching tokens made from your information stop matching and are deleted on the schedule in Section 4. We ask only for the information we need to verify and act on your request, and we use it for nothing else.

5.2 U.S. State Privacy Rights

Residents of California and of other states with comprehensive privacy laws (for example Colorado, Connecticut, Virginia, Utah, Texas, and Oregon) may have the rights listed above, plus the right to know the categories and specific pieces of personal information we collect, where it comes from, and why (Sections 1 and 2), to correct it, and to opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We do not sell personal information, share it for cross-context behavioral or targeted advertising, or use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of; our public website also honors Global Privacy Control signals. We use sensitive personal information only for purposes that the law allows without a right to limit, as described in Section 1.5.

You may use an authorized agent; we may ask the agent for proof of authority and ask you to verify your identity directly. We respond within the time the law requires (generally 45 days, which some laws let us extend once). If we decline your request, you may appeal by replying to our decision with the word "Appeal". We will answer the appeal in writing within the time the law requires, and if you are not satisfied you may contact your state attorney general. California residents may also ask about disclosures of personal information to third parties for their direct-marketing purposes (California Civil Code Section 1798.83); we make no such disclosures.

6. DATA SECURITY

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit and at rest
• Access controls and authentication
• Regular security audits
• Secure data storage practices
• Anonymous counts of encryption-key recovery attempts (to detect and prevent data loss before it affects you)
• Rate limits and server-side checks on matching, including the rule that a member can scan only partners they share unless they use Anonymous Mode, to make probing the network harder

6.1 How Different Data Is Protected

Not all data is protected the same way, and we want to be transparent about the difference:

• Your roster is stored in two tiers, and we are specific about which is which. Basic display details for each person you add — name, photo, age, gender, job title, relationship type, star sign, and the date you met — are stored in readable form on our servers. That is deliberate: it is what lets shared Tea Rooms, notifications, and safety moderation work, and it is what a friend sees if you choose to share that person with them. The private details are encrypted on your device with a key that stays on your device — phone numbers, emails, social handles, payment handles, notes, ratings, expense entries, gift logs, birthdays, and locations. For that encrypted content we store only unreadable ciphertext and cannot read, decrypt, or recover it, including if you lose the device holding the key. Cross-roster matching is performed on cryptographically blinded values, so our servers never receive the raw identifiers.
• Your intimacy log stays on your device. Intimacy entries are sensitive, health-related information, so they are kept only in encrypted storage on the device where you add them. They are not sent to our servers or shared with friends, and they are not included in cloud or phone backups. We cannot restore or recover them: they are lost if you delete the App or change phones, unless you export a copy yourself with "Export my intimacy log". Deleting your account also erases them from the device you delete it on. Before your first entry, the App asks you to confirm you understand this.
• Attached pictures are stored differently, and are not end-to-end encrypted. Pictures and screenshots you attach to a person are stored as image files in access-controlled cloud storage: the list of which pictures belong to which person is encrypted on your device, but the image files themselves are not, and each picture is checked by our automated safety systems, including a third-party AI provider (see Section 1.4), when it is uploaded.
• The one exception is Cloud Recovery, and it is off unless you switch it on. Because device-held keys mean a lost device normally means lost private content, you can opt in to Cloud Recovery. If you do, we store a copy of your vault key that is itself encrypted by a key held inside Google Cloud KMS. While Cloud Recovery is on, we are technically able to unlock your private content — that is what makes recovery possible, and it is why the feature is off by default and asks you to confirm. Restoring never happens instantly: it waits 48 hours and alerts every device signed in to your account, so it cannot be done quietly by someone who has your password. You can switch Cloud Recovery off at any time, which deletes our copy of your key, and we delete it automatically when you delete your account.
• Messages, feed posts, and comments are encrypted in transit and at rest, but are NOT end-to-end encrypted. This content is accessible to our automated safety and moderation systems and, where necessary, trained reviewers. We do this deliberately so we can detect and act on illegal or harmful content — including child sexual abuse material (CSAM), non-consensual intimate imagery, credible threats, and harassment — and to comply with our legal reporting obligations. Do not treat chat as a private, end-to-end-encrypted channel.

However, no method of transmission over the Internet is 100% secure.

7. CHILDREN'S PRIVACY

The App is only for adults 18 and older. We do not knowingly collect personal information from anyone under 18, and users may not enter information about anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its information, subject to legal holds. If you believe a minor is using Roster or appears in the App, contact help@myrosterapp.com.

8. INTERNATIONAL DATA TRANSFERS

The App is operated from the United States, and our service providers may process information in the United States or other locations where they operate. Where applicable law requires a transfer mechanism or additional safeguard, we will use one appropriate to the processing. The App is not currently offered to residents outside the United States.

9. THIRD-PARTY SERVICES

Third-party providers process information under their own terms and privacy notices as well as our contractual instructions where applicable. We select providers for defined operational purposes, but we do not control every aspect of their independent systems. The App may also contain links to third-party sites; review their notices before providing information directly to them.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes through the App or by email and, where required, request renewed consent or acceptance. The version shown above identifies the Policy associated with your account acceptance.

11. CONTACT US

Data controller/operator: Silvauren Software LLC

Email: help@myrosterapp.com

App website: https://www.myrosterapp.com

Formal notices may be mailed to:

Silvauren Software LLC

c/o Northwest Registered Agent Service, Inc.

30 N Gould St Ste N

Sheridan, Wyoming 82801

United States

12. PUBLIC WEBSITE PRIVACY

This section applies only to the public marketing pages at https://www.myrosterapp.com, not to authenticated activity inside the Roster mobile application.

The public website does not run visitor analytics, advertising pixels, session replay, or third-party fonts. It does not create analytics cookies or browser-storage identifiers. Its no-referrer policy prevents destination websites from receiving the Roster page address when you follow a link.

Firebase Hosting and network intermediaries necessarily process connection metadata such as your IP address to deliver and protect the public pages. If you submit the waitlist form, the form sends the address you enter to Roster's Firebase backend. App-store, email, and other external links disclose your request to the destination you choose, but not the Roster page that referred you.