Privacy Policy

Roster ("Roster", "the console", "we") is operated by Pillar Technology LLC, a limited liability company established in Virginia, United States. Pillar Technology LLC is the controller of the information described in this policy. You can reach us at ryan@pillartechnologyllc.com.

Roster is a private, invitation-only tool. It has no public sign-up: accounts are issued to the management team that operates it and, while a platform review is in progress, to authorized reviewers who are given access to demonstration data only.

This policy describes two groups of people.

Account holders. The creators, clients and businesses who authorize Roster to connect one of their accounts — an Instagram professional account, a Gmail mailbox and calendar, a Bluesky account, or a JotForm account. They decide to connect, and they can disconnect at will.

People who correspond with them. If you send a direct message, an email, or a booking-form submission to a connected account, your message and the name or handle attached to it are shown to the management team inside the console, exactly as they would be shown in the platform's own app. We display that correspondence; we do not copy it into our database, build a profile from it, or use it for any purpose other than showing the team the conversation they are answering.

Access is granted by the account holder through Instagram's and Google's official authorization flows, or by a revocable key they generate themselves. Roster never asks for, receives, or stores an account password. Each permission we request, and what it is used for:

We request no permission beyond this list. If we ever need an additional one, the account holder has to authorize it explicitly, and this policy will be updated before we ask.

Our database holds four things and nothing else:

• Workspace records — the display name the team gives each person they represent, and the labels they choose for that person's channels.
• Connection records — for each connected account: the platform, the account identifier, the username or email address, a profile-picture URL, the list of granted permissions, timestamps describing when the connection was made and last used, and the access and refresh tokens, encrypted.
• A short-lived record of a connection in progress — held between the moment you authorize an account and the moment the team confirms which person it belongs to, then discarded.
• Per-conversation read markers — for a conversation the team has opened or answered in Roster: a reference to the connection, the platform's conversation identifier, and a timestamp. This is how the console knows what still needs attention. No message content — and the markers are deleted with their connection.

Message bodies, email contents, calendar entries and form answers are not among them. Those are requested from the platform when a team member opens a conversation and are gone when the page is closed.

• We do not sell, rent, or trade information to anyone.
• We do not share it with third parties for their own purposes, and we do not disclose it for advertising.
• We do not use it for advertising, profiling, scoring, or to train artificial-intelligence models.
• We send no automated messages. No bot replies, no scheduled sends, no bulk messaging — every outgoing message was typed by a person on the management team.
• We run no advertising trackers, no analytics service, and no third-party scripts on the pages behind sign-in.
• We do not ask for, receive, or store account passwords.

Roster is a small piece of software and relies on two infrastructure providers, both of which act on our instructions only and neither of which may use anything for their own purposes:

• Vercel — hosts the application and serves it over HTTPS.
• MongoDB Atlas — stores the workspace and connection records described in section 4.

We also communicate with the platforms you connect — Meta, Google, Bluesky and JotForm — because that is where your messages actually live. Their own privacy policies govern what they do with your information on their side.

We may disclose information if the law requires it, but we will tell the affected account holder unless we are legally prohibited from doing so.

• Access and refresh tokens are encrypted with AES-256-GCM before they are written to the database. The encryption key is held separately from the data, in the hosting environment.
• Tokens are never sent to the browser, never appear in a URL, and are never written to logs.
• All traffic is served over HTTPS.
• Reaching any workspace requires an authenticated session, and every request that names a workspace is checked against the caller's access before any data is returned.
• Reviewer sessions are confined to demonstration workspaces and cannot reach a real client's data at all.

No system is perfectly secure, and we will not pretend otherwise. If we ever discover a breach affecting a connected account, we will notify the account holder promptly and describe what happened.

Connection records, including encrypted tokens, are kept only while the connection is active. Disconnecting an account deletes its tokens and identifiers immediately. Deleting a workspace deletes every record associated with it. A connection in progress that is never confirmed expires on its own.

Because message content is never stored, there is no message archive to expire, export, or delete.

If you are an account holder, you are in control of the connection at all times and do not need our cooperation to end it:

• Instagram — Settings → Apps and websites → remove Roster.
• Google — Google Account → Security → Third-party access → remove Roster.
• Bluesky — Settings → Privacy and security → App passwords → revoke.
• JotForm — Account settings → API → delete the key.

Revoking access invalidates our stored tokens the moment you do it. To have the records themselves erased as well, follow section 10.

Depending on where you live you may also have the right to ask what information we hold about you, to have it corrected, or to have it erased. Write to us and we will answer; we do not charge for this and we will not make you create an account to ask.

Anyone whose information Roster holds can have it deleted. There are three routes, and any one of them is enough:

1. Email us. Write to ryan@pillartechnologyllc.com from the address or with the account handle concerned, and say what you want deleted. We will delete it and confirm in writing within 30 days, usually far sooner. You do not need an account with us to make this request.
2. Ask the team that manages the account to disconnect it in the console, under Workspace → Channels → Disconnect. That deletes the stored tokens and identifiers for that account straight away.
3. Revoke access yourself using the platform settings listed in section 9. This immediately invalidates what we hold; email us afterwards if you also want the records erased.

Because we never store message content, a deletion request covers the identifiers, tokens and workspace records described in section 4 — which is everything we have.

Roster is a business tool and is not directed at children. We do not knowingly hold information about anyone under 13, and connected accounts must belong to adults. If you believe a child's information has reached us, write to us and we will delete it.

Roster is operated from the United States, and the providers in section 6 process data there. If you are writing to a connected account from elsewhere, your message is shown to the team in the United States — the same as it would be if they read it in Instagram's or Gmail's own app.

If this policy changes we will update the date at the top of the page, and we will not apply a materially different use to information we already hold without asking the account holder first.

Questions, requests, and deletion requests go to ryan@pillartechnologyllc.com, which reaches Pillar Technology LLC directly. We answer every message about data, including from people who have never used the console.

See also our Terms of Service.