Privacy Policy

Roost (“Roost”, “we”, “us”) is a family safety app. It lets a parent see how much their child uses each app, set screen-time and internet rules for the child's phone, see where the child's phone is if they turn location on, and be alerted when a message on the child's phone appears to concern bullying, self-harm, drugs or similar risks.

This policy explains exactly what leaves each phone, where it goes, who can see it and how to get rid of it. It covers two people: the parent, who holds the account, and the child, whose phone is monitored.

Roost is for a parent or legal guardian to look out for their own child under 18, with that child's knowledge. The child's phone shows a permanent notice whenever Roost is on, and the child can see everything that is shared. Roost must not be installed on another adult's phone, or on a child's phone without a parent's authority.

1. What we collect from the parent

Data	Why
Email address and password	To create and secure your account. Passwords are handled by Google Firebase Authentication; we never see or store the password itself.
Profile details you enter: how you'd like to be addressed, a phone number, your time zone, postal code and country	To address you in the app, to have a number for support, to send summaries in your time zone, and to work out any tax on a subscription.
Child profiles you add: a first name and the month and year of birth	To label what you see and suit guidance to your child's age. We don't ask for a full date of birth.
Your settings and rules: alert categories and how sensitive each is; schedules, daily app limits, Free time and pauses; internet filter choices (blocked categories, and sites you allow or block); whether location and location history are on	To decide what is reported, and to apply your rules on your child's phone.
Places you save: a name, a position and a size	To tell you when your child's phone arrives at or leaves them. See Location.
Your device code, as a salted, slow-to-compute hash with an expiry, never the code itself	So your child's phone can check a code you give them before uninstall protection is turned off. See Uninstall protection.
The home network filter level you chose (off, safer, or family-friendly)	To remember your choice. The filtering itself happens on your router. See Home network filtering.
A notification token for your phone	To deliver alerts to you.
If you turn on alert emails: your account's verified email address	To send you a short email for each alert. It says what kind of alert it is, never the flagged message itself, and is delivered by our email provider, Resend.
If you subscribe: your plan, when it renews, and a fingerprint of the store purchase	So Premium works on every phone you sign in on, and one subscription unlocks one account. Payment details are handled by Google Play or the App Store; we never see them.

2. What we collect from the child's phone

On an Android phone, once it is linked to your account:

Data	Why
App usage: which apps were used and for how many minutes each day	To show you screen time. Read through Android's Usage Access, which the child must allow in system settings.
The names of apps installed on the phone	So you can set limits on and block particular apps, and to tell you when a new app is installed.
Short excerpts of messages that were flagged, with the category and how serious it looks	So you can understand an alert and act on it. Unflagged messages are never sent. See How message checking works.
Device model and battery level	To tell you whether the phone is reporting, and whether it is about to go flat.
Which protections are switched on (such as notification access, location, the internet filter and uninstall protection), and when one is switched off or your device code is used	To tell you if something stops working or has been turned off.
Internet filter totals: how many sites were checked and blocked each day, by category, for the last 7 days, and the names of up to 50 of the most recently blocked sites	To show you what the filter stopped. Sites your child was allowed to visit are counted, never named. See Internet filter.
Location, only if you turn it on: the phone's latest position, its accuracy and the nearest street address	To show you where the phone is, and to tell you when it arrives at or leaves a place you saved.
Location history, only if you also turn that on (it is off by default): positions from the last 7 days	To show you where the phone has been this week.
Check-ins your child chooses to send: a short note (such as “On my way”) with the phone's position	So your child can tell you where they are.
SOS: that your child pressed SOS, with the phone's position and address when Roost has location permission	So you can find and help them.
Requests your child sends to unblock a site or app: its name and an optional note	So you can decide on the request.

On an iPhone or iPad, a child's device applies your schedules through Apple's Screen Time. Apple keeps the apps you choose private, even from Roost, and doesn't let apps read notifications or measure app use. From a child's iPhone we receive only what is needed to keep it linked: that it is connected, and when it last checked in.

3. What we don't collect

We don't collect your child's ordinary messages. Notification text is checked on the child's own phone. A message that isn't flagged is discarded there and never transmitted.
We don't collect conversation history from any app, and Roost can't read messages that never appeared as a notification.
We don't collect browsing history or search terms. The internet filter never records or sends the names of sites your child is allowed to visit; it only counts them. Only blocked sites are named.
We don't collect photos, contacts, call logs, text-message databases, microphone or camera data. Roost doesn't request the permissions that would allow it.
We don't collect location unless you turn it on for that child, and we keep no history of where the phone has been unless you also turn on location history.
We don't sell personal data, and nothing Roost collects about you or your child is used for advertising. A child's phone never shows an ad. The only ads in Roost are the optional ones a parent can choose to watch for Premium time; see Ads.

4. How message checking works

When a notification arrives on the child's phone, Roost reads its text and checks it against the categories you have turned on. This happens on the phone. Text waiting to be checked is encrypted with a key held in the phone's hardware-backed keystore, is excluded from device backups, and is erased as soon as it has been checked.

If nothing is flagged, the text is deleted and nothing is sent. If something is flagged, only a short excerpt and the category are added to your account.

Some builds of Roost can be set up to use Google's Perspective API for more accurate checking. Where that is on, message text is sent to Google for scoring and is not kept by us; Google's handling is governed by its own terms. If your copy of Roost uses it, the monitoring screen inside the app says so.

5. Location

Location is off until a parent turns it on for a child. Android then asks the child to allow it, after Roost explains what will be shared. The permanent notice on the child's phone mentions location, and Roost on that phone says plainly while it is being shared.

What is sent: the phone's latest position, how accurate it is, and the nearest street address.
When: about every 15 minutes, when the phone arrives at or leaves a place you saved, when your child checks in, and when they press SOS.
What is kept: the latest position, which each new one replaces. An arrival, departure, check-in or SOS is an alert, and the position at that moment is kept with it until you delete it.
Location history is a separate switch, off by default. When it is on, Roost keeps positions from the last 7 days, adding one when the phone has moved about 150 metres or 30 minutes have passed, up to 400 positions. Older ones drop off automatically, and turning history off deletes it.
Addresses: a position is turned into the nearest street address by the phone's own geocoding service (on Android, provided by Google Play services, which receives the position). Searching for an address when you save a place uses the same service on your phone.
Maps: Roost doesn't draw maps itself. When you tap Open in Maps or Directions, the position is handed to the maps app on your phone, such as Google Maps, which handles it under its own privacy policy.
Turning it off: you can turn location off at any time. Your child's phone then deletes the latest position and any history the next time it connects; removing the phone from your account deletes them at once. Your child can also withdraw the permission in Android's settings; you are then told that location was switched off.

6. Internet filter

When you set internet rules, the child's phone runs a filter that Android shows as a VPN, after the child allows it. It handles only the lookups that turn a website's name into an address. Each lookup is checked on the phone against your rules: a blocked site doesn't open, and SafeSearch and YouTube Restricted Mode are applied by directing lookups for those services to their restricted versions.

Allowed lookups go to the phone's usual DNS servers, or to Cloudflare (1.1.1.1) or Google (8.8.8.8) public DNS when those can't be used. When you pause the internet, the filter holds back the phone's traffic on the phone itself. Nothing the phone sends passes through our servers.

To show you what the filter stopped, the phone keeps a running count of sites checked and blocked each day by category, and the names of the most recently blocked sites, and shares these with you (see section 2). It never records or sends the names of sites that were allowed.

7. Home network filtering

Roost can show you how to set your home router, or a single device, to use Cloudflare for Families, a free service from Cloudflare that blocks categories of websites for every device on your WiFi. Lookups from those devices then go to Cloudflare under Cloudflare's privacy policy; they never pass through Roost. We store only the level you chose.

When you tap Check this WiFi, your phone looks up two test addresses (example.com, and a Cloudflare test address) through your current network to see whether filtering is on. The result stays on your phone.

8. Uninstall protection and the device code

On a child's Android phone, Roost can be made a device administrator, which stops it being uninstalled until that protection is turned off. Roost uses it for nothing else: it asks for no administrator powers, so it cannot lock, wipe or change the phone. Android always lets it be switched off in Settings. If it is, you are told at the phone's next check-in, unless your child first entered a device code from you.

The device code itself is never stored. Only a salted, slow-to-compute hash of it is kept, with an expiry, so the code can't be read back from the child's phone.

9. Crash reports and app usage

If Roost crashes or hits an error, it sends a report through Firebase Crashlytics, a Google service. A report contains the device model, the operating system and app versions, a random identifier for that install of the app, the last few screens and actions in the parent's app before the crash, and technical details of the error. We use reports only to find and fix bugs. They are not used for advertising, and Crashlytics keeps them for 90 days.

In the parent's app only, Roost also uses Google Analytics for Firebase to learn which screens and features parents use and where setup gets stuck, so we can improve the app. It records events such as “a setup step was shown”, “an alert was opened” (with its category) or “the Premium screen was viewed”, with a random identifier for the install, the app version, device model, language and approximate country. It never records names, email addresses, message text, places or anything about your child, and never your advertising ID. A child's phone sends no analytics at all. Google keeps this data for up to 14 months.

10. Ads (optional, parents only)

A parent without a subscription can choose to watch a short video ad to unlock location history, web insights and the weekly recap for 24 hours; each ad adds another 24 hours, up to seven days. Ads appear only in the parent's app, and only when you tap to watch one. Roost never shows an ad on a child's phone, and nothing about your child is used for ads.

The ads are served by Google AdMob. While you watch one, Google may collect your device's advertising ID, your IP address and approximate location, and how you interact with the ad, to show and measure it and to prevent fraud, as set out in Google's advertising policies. Ads are limited to content rated for general audiences. To unlock the features, Google tells Roost's server that the ad was watched, along with your account's ID. We keep the time the unlock runs until on your account, and an anonymous marker for each ad so a reward counts once.

Where the law requires it, such as in the EEA and the UK, Roost asks for your consent before the first ad, and you can change your choice at any time in Settings › Ad privacy choices. You can also reset or delete your advertising ID in your phone's settings.

11. Where data is stored

Data is stored with Google Firebase (Authentication, Cloud Firestore, Cloud Messaging and Crashlytics). The database is hosted in Google's asia-south1 region, in India. Access rules are enforced on Google's servers: data is kept under the parent's account, and a request for another family's data is refused whatever the app asks for. A child's phone may only write its own reports and read the rules and places that apply to it; it can't read your alerts or anything belonging to another family.

When something needs to reach a phone quickly, a small service we run on Cloudflare Workers sends it through Firebase Cloud Messaging: alerts to your phone, and requests to your child's phone to check in or to fetch rules you just changed. The same service sends alert emails if you turned them on, checks subscription purchases with Google Play and the App Store, and receives Google Play's notices about subscription changes. It reads what it needs from the database at that moment and keeps nothing itself.

12. Who can see it

The parent who owns the account the phone is linked to.
A co-parent, if that parent invites one: they see the family's alerts, locations and reports and can change its rules, just as the owner does. The owner can remove them at any time, and they can leave.
The child, on their own phone, on Roost's “What is collected” screen.
Google, as our infrastructure provider (Firebase) under its data processing terms; on Android as the provider of the geocoding service; for crash reports; and for message scoring where Perspective is on.
Cloudflare, which runs the service that delivers notifications, under its data processing terms.
Resend, if you turn on alert emails: it delivers them, and sees your address and the email's short text.
Your phone's maps app, such as Google Maps, when you choose to open a position in it, as described in Location.
Apple and Google, which deliver notifications to phones and handle subscription payments under their own terms.
Us, only where strictly necessary to investigate a fault or an abuse report, and never routinely.
We will disclose data if legally required to, and will tell the account holder unless we are prohibited from doing so.

13. How long we keep it

Alerts, including flagged excerpts, check-ins, SOS, arrivals and departures with their positions: until you delete them, or delete your account.
Screen time and activity history: until you remove that child from Roost, ask us to delete it, or delete your account.
The installed-apps list: replaced each time the phone reports.
Latest location: replaced by each new position, and deleted when you turn location off (by the child's phone, the next time it connects) or remove that phone.
Location history: 7 days, older positions dropping off automatically; deleted when you turn history off (the same way) or remove that phone.
Internet filter totals: the last 7 days, and the 50 most recently blocked sites.
Device code hash: until it expires or you set a new code.
Crash reports: 90 days.
Time unlocked by ads: on your account until you delete it. Each ad also leaves an anonymous marker (a scrambled form of Google's ID for that ad, and the time), so a reward counts once; it does not identify you.
Unflagged message text: never stored; discarded on the phone within seconds of being checked.
Account data: while the account exists.
After you delete your account: removed from our live systems straight away, and from backups within 90 days. See Delete your account and data.

14. Children's privacy

Roost is used by a parent and applied to a child's phone. A child doesn't create an account, and we collect information from a child's phone only as described here, on the parent's instruction. The parent is responsible for any consent required where they live.

In line with the US Children's Online Privacy Protection Act (COPPA), the parent is the account holder and controls the data, and can review and delete their child's data at any time in the app, or by contacting us. In keeping with the principles of the UK Children's Code, Roost is visible to the child, location is off by default, and we collect only what each feature needs.

Recording or intercepting another person's communications is regulated in many countries and US states, and some require the consent of everyone involved. It is the parent's responsibility to make sure their use of Roost is lawful where they live.

15. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your data, to object to or restrict how it is used, and to complain to a data protection authority, such as the Information Commissioner's Office in the UK. Under the UK and EU GDPR, our lawful basis is the performance of our contract with the parent, and our legitimate interest, and the child's, in the child's safety.

If you live in California, you have the right to know what personal information we collect and how we use it, and to have it corrected or deleted. We don't sell or share personal information as those terms are defined in California law, and we won't treat you differently for using your rights.

To use any of these rights, use the controls in the app or email us at support@roostfamily.online. We respond within 30 days.

16. International transfers

Your data is stored in India and may be processed by our service providers in other countries, including the United States. Where UK or EU law requires it, these transfers rely on our providers' standard contractual clauses or other approved safeguards.

17. Security

Traffic between the apps and our services is encrypted in transit (TLS).
Message text waiting to be checked on the child's phone is encrypted with a hardware-backed key and excluded from device backups.
Access rules are enforced on the server, not merely in the app.
The device code is stored only as a salted, slow-to-compute hash.
No system is perfectly secure, and we don't claim otherwise. If a breach affects your data, we will tell you as the law requires.

18. Changes

If we change this policy in a meaningful way, we will update the date above and tell account holders in the app before the change takes effect.

19. Contact

Questions about this policy or your data? Email us at support@roostfamily.online, or see Support.