Roster: privacy

Roster privacy
Effective 21 October 2026.
Provided by Moola. Support: https://project-moola-401d0.web.app/support

You can use Roster without an account. Your device-only shifts, tasks, notes and preferences then remain in local SQLite storage. Signing in creates a separate account planner. Your existing device planner is uploaded only when you choose to move it, or deliberately activate a saved pattern in the signed-in account. Account data includes your Firebase account identifier and the sign-in details you choose: with Sign in with Apple, an email address (which can be an Apple private relay address); with Google, your Google account email, name and profile photo link, which Firebase Authentication stores with the sign-in; or your mobile number if you sign in with a text-message code. It also includes schedules, task contents, notes, completion and synchronization records.

Google Firebase supplies authentication, Firestore, Cloud Functions, app attestation and hosting. We use these services to keep your planner across devices, recover your account, prevent unauthorized access and process deletion. Device/app integrity checks and service infrastructure may process technical identifiers, IP addresses and diagnostic request information. Data may be processed outside your country under the providers' terms and safeguards. We do not claim end-to-end encryption. Apple and Google provide their sign-in services under their own policies, and Firebase Authentication sends phone sign-in codes by text message to the number you enter. No advertising, external AI or task-content analytics is integrated.

Apple or Google processes purchases and payment details under its own policies. Roster receives product, environment, transaction or purchase-reference information and an opaque account association to verify the permanent unlock, restore access, prevent duplicate ownership and handle refunds. We do not receive your full card details. A planner backup cannot create a paid entitlement. Store test transactions do not grant normal production purchase rights.

Your device stores an account-specific offline cache, unsynced changes, conflict recovery versions, setup drafts and, after an explicit migration, an original device-planner recovery copy. Do not enter sensitive information on shared devices. Signing out removes confirmed account caches and drafts here; unsynced work must be synced or deliberately retained for that account after exporting. Android app backup is disabled; other platform/older OS backups and exported files remain under your control. Unuploaded changes may not survive reinstall.

Account planner data remains until you erase it or delete the account. Erasing an account planner synchronizes the empty planner; it does not delete your sign-in or purchase. Deletion removes Roster's live account tree, billing-account mapping and membership access. Shared Firebase sign-in is removed only if no other Moola app membership survives. Completed deletion receipts, inactive membership markers and last-account cleanup records are scheduled to expire after 30 days. Sync retry records expire after seven days. TTL removal is asynchronous. Minimum detached store references may be retained for up to 90 days after deletion for refund/fraud reconciliation, then scheduled for removal. The original store keeps its own transaction records under its policies. Support recovery is required for a purchase previously linked to a deleted account; it is never silently transferred to a new account.

Our deletion completion confirms removal of the live application records. It does not claim instant erasure of provider infrastructure backups: Firebase describes authentication removal from live/backup systems within up to 180 days after its customer initiates deletion. Scheduled Firestore backup and infrastructure retention follow their configured/provider periods. We cannot remove exports, old OS backups or copies on devices that remain offline; a device must reconnect to learn that access has been revoked. Operational cloud logs are intended to retain only technical request/error information, not planner contents or credentials, for the configured 30-day period.

You can export your planner, correct records and request in-app deletion. If you cannot access the app, request deletion from Moola support (https://project-moola-401d0.web.app/support) using the email address or mobile number linked to your account. We confirm ownership without asking for a password or sign-in code. We aim to resolve such support requests within 30 days. Support correspondence retention is 12 months after the issue closes, unless an unresolved dispute or applicable obligation requires longer. Request access, correction or removal through the same support route. Applicable statutory rights and complaint routes remain available.

Provider information: https://firebase.google.com/support/privacy, https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy. Changes to collection or purpose will be reflected here before the changed service is released.