Privacy

Last updated 26 October 2026 · RoostBook. This page is public: you do not need an account, or to be signed in, to read it or to act on it.

RoostBook is a record of the birds in your garden. It holds what you write down, any photographs you add of your birds, your email address, and a small record of how the app itself is being used, which cannot contain anything you have written. There is no advertising in it and no analytics company.

Who we are

RoostBook is run by Undead Fish Studio, the trading name of Content by Chris Mansfeldt, a sole proprietorship (enkeltpersonforetak) registered in Norway, organisation number 925 499 374, Steenstrups gate 3, 0554 Oslo, Norway, which is the data controller for the information described here. Write to hello@roostbook.app about anything on this page. Using the app is also governed by the terms.

What we store

Your account

• Your email address, so you can sign in and get your record back on a new phone.
• Your password, stored only as a cryptographic hash. We cannot read it and neither can anybody else.
• A display name, if you choose to set one. It is optional.

What you write down

Everything you record in the app, which is yours and is the reason the app exists: your flocks and their names, your birds and their names, breeds, sex, hatch dates and leg bands, daily egg counts, weights, medicines and the withdrawal periods you copy from the label, health events, diary entries, what things cost, and egg sales including any customer name you type.

Photographs of your birds

A photograph is optional. A bird without one is drawn instead.

• It comes from your photo library, never the camera. You pick a picture you already have and crop it square, and the app sends a compressed copy of that square. The app does not open the camera. On Android the permissions list can still name the camera, because the photo-picking tool the app is built with declares it; the app never asks for it.
• It is kept in private storage. It goes to the same provider and the same place as the rest of your record, filed under the bird it belongs to. It has no public web address: it is only handed to an account allowed to see that bird, as a link that stops working after an hour.
• It is never on a shared link. A link you make for a pet-sitter or a vet shows no photographs at all.
• Where it was taken is taken out first. Phones often write the place a picture was taken into the file itself. Before a photograph leaves your phone, the app blanks that location in the file, on Android and on an iPhone, so the copy we store does not say where your garden is.
• Changing it keeps the old one. Choosing a new photograph does not delete the previous file. It stays in storage with the record and is not shown anywhere. A bird who has gone keeps her photograph on her record, the same as everything else about her. All of them are deleted when your account is.

What the app records about itself

So that we can tell when the app is broken for somebody, and which parts people use, the app keeps a short record of what it does. These records cannot contain anything you have written. They go to our own database, next to your record, and to nobody else.

• Only for an account. Nothing is recorded about somebody without one, so browsing the example flock or reading the introduction sends us nothing. The record that an account was created is made as it is created and waits on the phone until that account first signs in.
• Each record is a name from a fixed list, below, and nothing else that could hold a word: when it happened, which version of the app, whether it was Android, an iPhone or the web, that it was RoostBook, and a random number made when the app starts and forgotten when it closes, so records from one sitting can be grouped and nothing can follow you from one day to the next.
• The only details a record can carry are numbers and yes-or-no answers, such as how many milliseconds something took or whether it worked. The database refuses anything else, so a bird's name cannot get in even by mistake.
• An error is a number, never a message. When something goes wrong, the type of error and a code that groups it with the same error elsewhere are recorded. What the error said, and where in the app it happened, stay on your phone.
• They wait on your phone when there is no signal, up to the last 500, and are sent with everything else once there is. Signing out deletes any not yet sent.

This is the whole list. The app will not record a name that is not on it, and the database refuses a name it does not know.

• app.open The app was started.
• app.foreground The app came back to the front.
• account.signed_up An account was created.
• account.signed_in Somebody signed in.
• account.signed_out Somebody signed out.
• flock.created A flock was created. Not its name.
• bird.added A bird was added, and whether that happened with no signal. Not her name, breed or anything else about her.
• eggs.logged An egg count was written down or corrected, and whether with no signal. Not the count.
• starter_tasks.added The everyday jobs were put on your list when the flock was set up, and how many. Not what they are.
• notify_ask.shown The app offered notifications, at which of three moments, and whether it was the first, second or third offer.
• notify_ask.answered That offer was answered: yes or not now, and whether your phone allowed it.
• morning_summary.toggled The morning note was switched on or off, and whether your phone allowed it.
• invite_offer.shown The app suggested sharing the flock with somebody who looks after it.
• invite_offer.answered That suggestion was answered: yes or not now. Not who, or whether anybody was asked.
• helper_question.answered The question about who else looks after your birds was answered: a neighbour or sitter, family, or just you, as a number. Never a name.
• helper.invite_sent Somebody was invited to look after the flock with you. Not who, or how they were asked.
• email_jobs.toggled The switch for the first-mornings emails in Settings was turned on or off.
• feedback.asked The app asked what you think of it, and whether it was the first or second time.
• feedback.opened The feedback form was opened, from that question or from More.
• feedback.sent A message was sent, from where, and whether an email address came with it. Not the message.
• feedback.dismissed The question was put off.
• care.logged A health event or a diary entry was written, and whether with no signal. Not what it says.
• measurement.recorded A weight was recorded, and whether with no signal. Not the weight.
• expense.logged A cost was recorded, and whether with no signal. Not what it was or what it cost.
• offline.write_queued Something was saved with no signal, and how many entries were waiting to send.
• offline.drained Entries saved with no signal finished sending: how many went, how many could not, and how long it took.
• error.uncaught Something went wrong: the type of error as a number, a code that groups it with the same error elsewhere, and whether the app had to close. Never the error's message.
• error.rejection Something went wrong in the background: the same type and code, and nothing else.

Some things are timed: a record when they start, one when they finish saying whether they worked and how long they took, and one if they are still going after eight seconds.

• op.store.write.start Saving something.
• op.store.write.end Saving something.
• op.store.write.stall Saving something.
• op.sync.drain.start Sending entries that were saved with no signal.
• op.sync.drain.end Sending entries that were saved with no signal.
• op.sync.drain.stall Sending entries that were saved with no signal.

And which screen was opened, by the screen's name in the app. Never which bird, flock or entry was on it.

• screen.tasks Tasks
• screen.addtask Something to do
• screen.job A job
• screen.routine Every day
• screen.eggs Eggs
• screen.logeggs Log today's eggs
• screen.correcteggs Correct an entry
• screen.coop The coop
• screen.bird A bird
• screen.addbird Add a bird
• screen.editbird Edit a bird
• screen.breedpicker Which breed?
• screen.archivebird She has gone
• screen.movebird Move her
• screen.broody Sitting
• screen.clutch A clutch
• screen.candling Candling
• screen.hatch How it went
• screen.healthevent Register something
• screen.medicine Medicines
• screen.weigh Weigh her
• screen.diary The diary
• screen.diaryentry An entry
• screen.costs What they cost
• screen.addcost Something you bought
• screen.sales Egg sales
• screen.more More
• screen.reminders Reminders
• screen.settings Settings
• screen.flocks Your flocks
• screen.sharing Who can see your birds
• screen.export Export your record
• screen.plan Your plan
• screen.signin Sign in
• screen.signup Create an account
• screen.forgotpassword Forgotten password
• screen.taskstab The Tasks tab
• screen.eggstab The Eggs tab
• screen.cooptab The Coop tab
• screen.coststab The Costs tab
• screen.moretab The More tab

Who can read them: nobody using the app, including you, because the app can add these records and has no way to read them back. We can, and we look at them added up across everybody to find what is broken. If you want the ones about your account, write to hello@roostbook.app and we will send them.

How long they are kept: for as long as your account exists. They are deleted with it.

Emails we send

Besides the emails that run your account (confirming your address, resetting a password), we send two: on the first and the third morning after you join, at seven where you are, each with one tip about using RoostBook and, under it, that day’s jobs for your flock if there are any. That is all. Each one has a link that stops them without signing in, and More → Settings turns them off or on again. To send them at seven your time, the app tells us your phone’s time zone.

They are sent by Resend, so your address, your first name, your flock’s name and the jobs’ titles pass through it. The pictures in them load from roostbook.app.

Feedback from inside the app

On your third visit the app may ask what you think of it, and the More tab has a Send feedback row that is always there. What you type is kept and read by us, and it is never published in your words.

With the message we keep three facts about the app it came from: whether it is the Android, iPhone or web app, its build number, and whether you wrote it from that question or from the More tab. We do not store which account sent it. Your account is checked when you press Send, so that one account cannot send more than five messages an hour, and that check is gone within the hour.

The email box is optional. If you fill it in, we use the address to answer you and for nothing else. The app also counts how often the question is shown, opened, put off and answered, as numbers with no words in them, the same way as everything above.

Agreeing to the terms

When you tick “I agree to the Terms”, when you make an account or later in the app, we record that your account agreed, which version of RoostBook’s terms it was, when (by our server’s clock, not your phone’s), and whether it was at sign-up or in the app. It is the record of what you agreed to, which is why nobody can change it, you and us included. It is kept while your account exists and is deleted with it.

Buying RoostBook Pro

Pro is not on sale yet. When it is, it will be bought in the Android app, and Google Play takes the payment. We never see your card or bank details. Google tells RevenueCat, the company that keeps track of subscriptions for us, which plan you bought, its price and currency, and when it renews or ends; RevenueCat tells our server, so the app can turn Pro on. RevenueCat knows you by your account’s random number, not by your name or email address.

We keep which plan you are on and when it renews or ends for as long as your account exists, and deleting your account removes it. Deleting your account does not cancel a subscription in Google Play: cancel it there first, or it keeps renewing.

Where the app came from

If you installed RoostBook from an advertisement or a link, we would like to know which one, so that we can tell whether it was worth paying for.

• What is read. On Android, the note Google Play hands to the app about the link it was installed from. On the web, the campaign tags on the address you arrived at (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and, if the link carried one, the advertiser's click code. It is read once, when the app first opens.
• What is kept. Which kind of source it was (Google, Meta, Google Play with no campaign, one of our own links, something else, or unknown), those tags, the click code, the note itself, whether it was Android, an iPhone or the web, and when the app was first opened. Anybody can make a link say anything, so each value is kept only if it is short, plain printable text with no angle brackets; anything else is left out rather than cut down.
• It waits on your device until you have an account. Then one record is saved against your account, and never changed: if you arrive a second time from a different link, the first one stands. If you never make an account it is never sent, and it goes when you delete the app.
• It is RoostBook's own. The same account used in another of our apps has a separate record there. The app does not send any of this to Google, Meta or anybody else, and it does not read your phone's advertising ID.
• Who can read it, and for how long: the same as the records above. Nobody using the app, including you; we can; kept while your account exists and deleted with it.

What we do not collect

This list is as much the policy as the one above it.

• No analytics company and no tracking. The app contains no analytics or advertising SDK. The records described above go to our own database and nowhere else, and nothing follows you across other apps or websites.
• No camera. The app never opens it. A photograph only ever comes from your library, when you choose one.
• No location. The app never asks where you are, and it blanks the location a phone writes into a photograph before sending it, as described above.
• No contacts, no calendar, no microphone.
• No card details. If you buy Pro, Google Play takes the payment and we never see your card or bank details.
• No advertising and no advertising ID. There is no ad network in this app, and it never reads your phone's advertising identifier. The only thing an advertiser could recognise is a click code on the link you arrived from, kept as described under “Where the app came from”.
• No crash reporter. No error message and no stack trace ever leaves your phone; only the type and grouping code described above.
• No selling or sharing of your data. Not to anybody, for any purpose, ever.

Where it is kept

Your record is stored with Supabase, our hosting provider, in a database in London, United Kingdom, and photographs of your birds in private storage alongside it. Everything travels encrypted (HTTPS) and the database enforces, row by row and file by file, that an account can only reach the records it has been let into.

Supabase processes the data on our instructions and for no purpose of its own. Three other companies handle a part of it for us, and only for the job named: Resend delivers the emails we send (confirming your address, resetting a password, and confirming a withdrawal), so your address and what the email says pass through it; Vercel serves this website; and, if you buy Pro, RevenueCat records the purchase Google Play took, in the United States, as described above.

Who else can see your record

Nobody, until you decide otherwise. There are exactly two ways to let somebody in, both started by you and both stoppable by you:

• Somebody in the house. You add an existing RoostBook account by email. They can see the record and write things down. They cannot rename the flock, add or remove birds, share it with anybody else, or see anything about money. You can stop it at any time.
• A link, for a pet-sitter or a vet. A read-only web address that expires after 30 days. It shows your birds and what has been written down in the last month, and never a photograph, anything you sell or what you charge for it. Anybody holding the link can open it, including somebody it is forwarded to, so treat it as you would a key. Stopping it works immediately.

On your phone

The app keeps a copy of your record on the device so it works in a garden with no signal, and anything you write down while offline is queued and sent when you have a connection again. It also keeps a copy of each photograph added from that phone, so the bird still has her face with no signal. Signing out deletes those copies, and deleting the app removes all of it.

Reminders are local to your phone. They are scheduled by the device itself. There is no push service, we do not hold a device token, and nothing about a reminder leaves your phone.

This website

No cookies, no analytics, no tracking pixels. Our hosting provider, Vercel, processes standard server request logs, including IP addresses, to serve and secure the site.

The waitlist

If you put your address on the waitlist, we store the address, which page you typed it on, and the time. Nothing else, and it is not connected to any account.

Our rate limiter also keeps a salted, one-way hash of your IP address for one hour, so that one machine cannot submit the form hundreds of times. It is a hash, it cannot be turned back into an address, and it is deleted on the next submission after the hour is up.

The waitlist is for iPhone. You get one email, on the day RoostBook is on the App Store, with a leave link in it. The tick-box on the form says so before you tick it, and you can ask us to take you off at any time at hello@roostbook.app. The lawful basis is your consent, which you give by ticking that box and can withdraw whenever you like.

The withdrawal page

The page at /withdraw is where you withdraw from a Pro purchase within 14 days (terms, section 14). It keeps what you type into it: your name, the email address for the confirmation, the plan, the date you bought it, and the Google Play order number and the email on your account if you give them, with the date and time you confirmed and whether our two emails about it were sent. Resend delivers those two emails, one to you and one to us.

We use it to confirm your withdrawal, to find the purchase in Google Play and refund it, and as the record that you withdrew and when. It is not linked to your account and is not deleted with it: we keep it for five years after the end of the year you withdrew, which is how long Norwegian bookkeeping law has us keep records of a sale and its refund, and then it is deleted. Confirming also writes a one-way hash of your IP address, kept for one hour, so the page cannot be used to send a flood of emails.

Why we are allowed to hold it

• Performance of a contract — we cannot give you a record of your birds without storing it.
• Legitimate interests — keeping the service running and secure, finding out when it is broken, and knowing which advertisements and links bring people to it. The records that serve those are the ones described above, and none of them can hold anything you have written.
• Legal obligation — keeping the record of a withdrawal for as long as bookkeeping law requires.

How long we keep it

Your record is kept for as long as your account exists, because a record you cannot look back through is not a record. When you ask us to delete your account we delete it — see Delete your account.

Your rights

Under data protection law (the GDPR, and in the United Kingdom the UK GDPR) you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to it. Write to hello@roostbook.app.

If you think we have got this wrong you can complain to a supervisory authority. RoostBook is run from Norway, so that is Datatilsynet, the Norwegian Data Protection Authority, at datatilsynet.no. If you are in the United Kingdom you may instead complain to the Information Commissioner’s Office at ico.org.uk.

Children

RoostBook is not directed at children and we do not knowingly collect data from anyone under 13.

Changes

If this policy changes we will update the date at the top, and we will tell you in the app before any change that affects what we collect.