Last updated: August 28, 2026
At Roostly, we believe your home data belongs to you. This Privacy Policy explains what information we collect, why we collect it, how we protect it, and the choices you have regarding your information.
Roostly is owned and operated by Sarang AI Technologies Inc. ("Sarang AI," "we," "us," or "our"), a corporation incorporated in Alberta, Canada.
| Data | Why we collect it |
|---|---|
| Email address, password (stored as a one-way hash, never in plain text) | To create and secure your account |
| Home address, latitude/longitude, year built, heating type, appliance info | To compute real historical weather data for that exact location and generate a maintenance schedule for that specific home |
| Documents you upload (receipts, warranties, manuals) | To store in your Digital Binder for your own reference |
| Photos you upload (appliances, maintenance issues, home components, your home's profile photo) | To store in your Digital Binder, and — when you use a scan feature or Ask Roostly — to power AI-based recognition, analysis, or answers about that specific photo |
| Messages you send through Ask Roostly | To generate a response to your question and keep your current conversation coherent |
| Which maintenance tasks you've marked complete | To calculate your Home Health Score |
| Home Inventory entries (item name, category, room, brand, model, serial number, purchase details, notes, and an optional photo) | To store your belongings catalog for your own insurance/planning reference |
| Family member names, and which name a task is assigned to | To label task assignments on your own account — see "Family sharing" below for what this does not include |
| Notes you add to inventory items, expenses, or emergency shutoffs | To store alongside the specific record you added them to |
| Emergency contacts, insurance policy details, and shutoff locations/photos | To store in your Emergency Passport for household reference, and optionally share via a link (see "Emergency Passport sharing" below) |
| Push-notification token and delivery platform (iOS/Android) | To deliver task-reminder and weather-alert notifications to your device |
| Notification preference (on/off) | To determine whether we send you notifications at all |
| Subscription status (trial/active/canceled) and billing dates | To determine whether your account has access — see "Who else sees your data" for who actually holds your payment details |
We do not intentionally request additional personal information beyond what's described above. Our infrastructure may also process limited technical information, such as IP address, timestamps, and request paths, for security, reliability, and abuse prevention — see "Where your data lives" below for detail on that. Separately, we never see or store your payment or card details — that's handled entirely by Google Play or Apple's App Store (below).
The homepage advertises "family sharing" — here's exactly what that means today. Adding a family member creates a name label on your own account, stored so you can assign tasks to that name (e.g., "Assigned to: Alex"). It is not a real invite: no account, login, email address, or notification is created for that person, and they don't get their own access to Roostly. Only you, the subscriber, can see the schedule and task assignments through your own login — a family member "sees" them only if they're looking at your device or you show them directly. If you want real multi-user access (separate logins, individual notifications) for household members, that isn't built yet — let us know at support@roostly.ca if that's something you need.
Separately from family sharing above, the Emergency Passport screen lets you generate a private, revocable link that shows your emergency contacts, insurance details, shutoff locations and photos, "what to do first" instructions, and basic info about your appliances (name, brand, model, room — never serial numbers, prices, photos, or any non-appliance inventory items) to anyone who has that link, without them needing to log in or have a Roostly account at all. This is entirely your choice: no link exists until you generate one from that screen, and you can revoke it at any time, which immediately breaks the link. Because it's link-based rather than tied to a specific person, treat the link itself as sensitive once generated — anyone who has it can view that information until you revoke it.
Roostly uses AI (currently Anthropic's Claude) to write your maintenance schedule's text, power the Ask Roostly chat feature, and analyze photos or documents you submit to a scan feature. These AI-generated responses are for informational purposes only — they may not always be accurate or complete, and they aren't a substitute for a licensed inspector, contractor, or engineer. Recommendations are generated automatically from your data and a set of general maintenance rules; use your own judgment, and get professional advice before acting on anything safety-critical (electrical, gas, structural, plumbing, or anything else where a wrong answer could cause injury or property damage).
These AI features produce suggestions and information, not decisions that have legal or similarly significant effects on you — nothing about your account, access, or rights is decided automatically by AI. If your local law (for example, Quebec's Law 25) gives you the right to be informed about, or to request human review of, a decision based exclusively on automated processing, contact us at support@roostly.ca and a person will look into it.
We don't collect microphone recordings, your device's contacts list, your text messages, your browsing history outside the app, or an advertising identifier used for advertising. Roostly also has no access to your device's GPS location — the weather and schedule are generated entirely from the address you type in, never from device location tracking. We don't run any third-party product-analytics or advertising SDK. We do keep a minimal record of when you last opened the app (derived from your Home Health Score history) so we can send an occasional re-engagement reminder if you've been away, and we may tailor your daily maintenance tip to an appliance you recently added — used only to make the app more useful to you, never sold, never shared with advertisers, and switchable off with the notification toggle. We do use an error-monitoring service (Sentry) purely for reliability — it receives technical details of a server error when one occurs (such as the error message and request context) so we can find and fix bugs, not to track what you do. The only third-party push infrastructure we use — Firebase Cloud Messaging (Android) and Apple's Push Notification service (iOS) — deliver the notifications you've enabled: maintenance reminders, weather alerts, a weekly summary, milestone celebrations, and the occasional re-engagement reminder if you've been away. You can turn all of these off with the in-app notification toggle. Our marketing website (roostly.ca) doesn't use cookies or any similar tracking technology, either — it's static content with no analytics script of any kind.
Your account and home data are stored in a database we manage. Uploaded documents and photos are stored in cloud file storage. We use account-level authorization and server-side access controls designed to prevent one user's account from reading or modifying another user's home, schedule, or uploaded files — these checks are applied on our servers, not just hidden in the app's interface. Photos and documents are only sent to an AI provider when you actively use a feature that needs it (a scan, a cost estimate, a photo you ask us to identify or verify, your daily tip, or a message in Ask Roostly) — never for AI purposes passively or in the background. Separately, every file you upload is run through an automated malware scan (Cloudmersive — see "Who else sees your data") before it's stored; that's a safety check on the file itself, not a use of its contents to profile you.
Like virtually any web service, our servers and hosting provider keep routine connection logs (e.g. IP address, timestamp, request path) briefly for security purposes and to prevent abuse — for example, to rate-limit repeated failed login attempts. This is standard infrastructure logging, not a profile of your activity, and it isn't linked to your account for any other purpose.
To exercise any of these rights, email support@roostly.ca from your account email, or use the in-app controls where noted. We'll respond within the time your law requires — within 30 days for most requests (extendable once, with notice, if a request is complex), and within 45 days for California requests. We may need to verify your identity (for example, by confirming control of your account email) before acting, and we won't charge you for a reasonable request. You may also use an authorized agent to submit a request on your behalf; we'll ask for proof of their authorization.
If data-protection law where you live requires us to state a legal basis for processing your data, it's one of these: processing your account, home, and subscription data is necessary to provide the service you signed up for (contract performance); processing photos, documents, and chat messages through an AI provider is also necessary to provide the specific photo-analysis, document-scan, or Ask Roostly feature you're using at that moment; we rely on our legitimate interests for a narrow set of things necessary to run a safe, reliable service: keeping brief security logs and rate-limiting to prevent abuse and account takeover; scanning uploaded files for malware; monitoring errors to fix bugs; and sending occasional re-engagement reminders (which you can switch off at any time) — we've weighed these against your rights and limited them to what's needed, and you can object to any of them by contacting us; and where none of that applies, we rely on your consent, which you can withdraw as above.
Roostly is operated by Sarang AI Technologies Inc. from Alberta, Canada, but is available to users worldwide, and our infrastructure (hosting, database, file storage, and the third-party services listed above) is not necessarily located in your own country — most of it runs on US-based infrastructure today. If you're accessing Roostly from the EU, UK, Canada, or elsewhere with data-residency rules, your data will likely be transferred to and processed outside your country, including in the United States and Canada. We only work with established providers (the third-party services listed in "Who else sees your data" above) who are themselves obligated to protect data transferred internationally, but a full, jurisdiction-by-jurisdiction legal review of each vendor's specific transfer safeguards (e.g. Standard Contractual Clauses) hasn't been done — this policy discloses the fact of the transfer honestly rather than asserting that every safeguard is formally documented. For transfers of EU/UK data to Canada, we note that Canada benefits from a European Commission adequacy decision for commercial organizations; for transfers to the United States and to our other providers, we rely on those providers' own contractual data-protection commitments. Where Quebec's Law 25 requires an assessment before transferring a Quebec resident's information outside the province, we will complete one.
We keep your account and home data for as long as your account is active. Account information is deleted from our active database and file storage after your deletion request is processed — this happens immediately, in the same request, and there's no extended "just in case" retention period we maintain ourselves. Temporary copies may remain in encrypted backups until they're overwritten through our providers' normal backup-rotation process:
If your business needs a stricter, formally documented retention schedule (e.g. for tax, legal-hold, or dispute purposes), that's a policy decision to set with a lawyer, not something this app currently enforces on its own. Security and connection logs are kept briefly (typically days to a few weeks) and then rotated out; transactional-email delivery records held by Resend follow their own retention; and anonymous or aggregated data that can no longer identify you may be kept longer.
Roostly isn't directed at, or knowingly used by, children. Creating an account already requires being old enough under the law where you live to agree to the Terms of Service on your own (see terms.html) — we don't knowingly collect data from anyone below that age. Roostly is not intended for anyone under 16, and we don't knowingly collect personal information from children (including, in the U.S., children under 13 for COPPA purposes). If you believe a child has provided us information, contact support@roostly.ca and we'll delete it.
Roostly is operated by Sarang AI Technologies Inc. from Alberta. Canadian privacy law (the federal Personal Information Protection and Electronic Documents Act, and Alberta's Personal Information Protection Act) gives you the right to access the personal information we hold about you, request corrections, and withdraw consent — all of which are covered under "Your rights over your data" above. If you believe we've mishandled your personal information, we'd appreciate the chance to fix it directly first at support@roostly.ca; you also have the right to complain to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.
In addition to the rights listed above, you have the right to lodge a complaint with your local data protection supervisory authority if you believe we've mishandled your data. We'd appreciate the chance to fix a problem directly first — support@roostly.ca — but that's your right regardless.
Roostly is operated from Canada and does not currently maintain a physical establishment in the EU or UK. If and where Article 27 of the (UK) GDPR requires us to designate a local representative, we will appoint one and publish their contact details here. In the meantime, you can reach our privacy contact directly at support@roostly.ca, and you retain the right to complain to your local supervisory authority.
Under California law (CCPA/CPRA), you have the right to know what personal information we collect (see the table above), the right to delete it, and the right to non-discrimination for exercising these rights — we won't charge you more or provide worse service because you asked. We do not sell your personal information, and we don't share it for cross-context behavioral advertising, so there's no "opt-out of sale" toggle to build — there's nothing being sold to opt out of. You also have the right to correct inaccurate personal information.
Some of what we collect — your home's precise location and your insurance details — may count as "sensitive personal information" under California law. We use it only to provide the features you asked for (your weather-driven schedule, your Emergency Passport), never to infer characteristics about you and never for advertising, so the right to "limit the use of sensitive personal information" has nothing to restrict here. We collect the categories in the table above directly from you and from your device when you use the app, and we disclose personal information to service providers only for the business purposes described in "Who else sees your data," never for money or cross-context behavioral advertising. You may use an authorized agent to submit a request on your behalf; we'll ask for proof of their authorization.
Roostly and our website (roostly.ca) don't track you across other companies' websites or apps, so there's nothing for a browser "Do Not Track" signal to change — we don't behave differently based on it because we don't do cross-site tracking in the first place, and we don't knowingly allow third parties to collect your information across sites through Roostly.
Passwords are hashed (never stored or logged in plain text), all traffic between the app and our servers is encrypted (HTTPS), and we use account-level authorization designed to keep every account's data separate from every other account's. Login and password-reset endpoints are rate-limited to slow down automated password-guessing attempts. No method of transmission or storage is 100% secure, and we can't guarantee absolute security, but we don't treat that as an excuse — we patch dependencies, keep secrets out of source control, and fix issues we find promptly. If you notice anything that looks like unauthorized activity on your account, contact us immediately at support@roostly.ca.
If we discover a security breach that affects your personal information and creates a real risk of significant harm to you, we will notify you and the appropriate privacy regulator without undue delay, as required by the law that applies to you (within 72 hours of becoming aware, where the GDPR applies). Our notice will describe, as best we can at the time, what happened, what information was involved, what we're doing about it, and what you can do to protect yourself. We keep an internal record of security incidents as required by applicable law.
If Sarang AI Technologies Inc. is ever acquired, merged with another company, or transfers substantially all of its assets, your information may be transferred as part of that transaction. We'd still be bound by this Privacy Policy's commitments unless you're notified of, and agree to, a materially different policy.
We may update this policy as the app changes. If we make a material change to what we collect or how we use it, we'll make a reasonable effort to let existing users know before it takes effect.
Sarang AI Technologies Inc. is the controller responsible for your personal information. Our Privacy Officer (the person in charge of personal-information protection) is reachable at support@roostly.ca; a postal mailing address is available on request. For any question about this policy, your data, or to exercise your rights, email support@roostly.ca.