Privacy Policy
1. Introduction
Rosternado ("the app", "we", "us") is a flight roster and flight-tracking app for aviation professionals and the people they choose to share their schedule with. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have.
The app is operated by İnanç Atil ("the developer"). By creating an account and using the app, you agree to the practices described here.
Rosternado is not affiliated with, endorsed by, or sponsored by any airline. Airline names and codes are used only to identify your employer and your duties.
2. Data We Collect
2.1 Account & profile data
When you register, we collect and store:
| Data | Purpose |
|---|---|
| First name & last name | Identify you to your friends and in friend search |
| Email address | Account login, account recovery, security notices |
| Password | Account login — stored only as a salted hash, never in plain text |
| Account type (crew / non-crew) | Determine app features available to you |
| Airline, base airport, crew ID | Crew accounts only — roster context and duty pre-fill |
| Profile photo (optional) | Displayed to your friends; you choose whether to add one |
2.2 Sign in with Google / Apple
If you choose to sign in with Google or Apple, the provider returns your name and email address to create your account. We do not receive your Google or Apple password. If you use Apple's "Hide My Email"feature, we receive only the private relay address Apple generates; we treat it as your contact email until you choose to provide a different one.
2.3 Roster & duty data
The core of the app is your flight roster — flights, standby, training, days off, leave and other duties, including airports, times (in UTC), and flight numbers. This data is created in one of two ways:
- Manual entry — you add or edit duties yourself.
- Roster import — see Section 3 below.
2.4 Friendships
We store the friend requests you send and receive, their accepted/pending/rejected status, and (for non-crew users) which friend you have marked as a favorite.
2.5 Device & technical data
- Push notification token — a device identifier issued by Apple/Google so we can send you friend-request notifications.
- Subscription status — whether you hold an active Pro subscription, and your monthly usage counters.
- App preferences — theme and time-display settings. These are stored only on your device and are never uploaded.
We do not use third-party advertising or analytics SDKs, and we do not track you across other apps or websites.
3. Roster Import via In-App Browser
Crew users can import a roster directly from their airline's own crew/roster website. This works as follows, and it is important you understand it:
- The app opens your airline's official roster website inside an in-app browser window.
- You log in to that website using your own airline credentials, directly on the airline's page.
- Rosternado does not collect, read, store, or transmit your airline username, password, or login session. Those credentials are entered on the airline's website, not into Rosternado.
- When you tap Save, the app reads the roster information displayed on that page and converts it into duty entries. Only the resulting roster data (flights, times, duty codes) is sent to our servers.
- We do not access your airline email, payslips, personal messages, or any page other than the roster you are viewing.
You are responsible for using your airline's website in accordance with that airline's own terms of use.
4. How Roster Sharing & Consent Works
Your roster is private by default. No one can see it unless you take action.
- Sharing happens only through a two-way friendship. One person sends a friend request; the other must explicitly accept it. Either side can remove the friendship at any time.
- Once a friendship is accepted, that friend can view your current and upcoming duties. Past duties that have already ended are not shared.
- Accepting a friend request is your consent to share your active and future roster with that person. If you do not want someone to see your roster, do not accept (or remove) the friendship.
- In friend search, other users can find you by first and last name only. Your email address is never shown in search or exposed to other users.
- Non-crew users do not have a roster and only view the roster of crew friends who have accepted them.
5. How We Use Your Data
- Create and operate your account and authenticate you at login.
- Store and display your roster, and share it with friends you have approved.
- Operate the friend-request and friend-search features.
- Send push notifications for friend requests and acceptances.
- Manage subscriptions and enforce free-tier usage limits.
- Provide account recovery (password reset, email change) and respond to support requests.
- Protect the security and integrity of the service.
We do not sell your personal data, and we do not use it for advertising.
6. Third-Party Service Providers
We rely on a small number of trusted providers ("processors") to run the app. They process data only on our behalf:
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Database, authentication, file storage and hosting of all account and roster data | All account, roster and friendship data; profile photos |
| RevenueCat | Subscription and in-app purchase management | Your account ID and subscription status |
| Apple App Store / Google Play | Process subscription payments | Payment details — handled entirely by Apple/Google; we never see your card data |
| Expo push service, Apple APNs, Google FCM | Deliver push notifications | Your push notification token and the notification content |
| Google / Apple Sign-In | Optional social login | Your name and email, only if you choose this login method |
Each provider operates under its own privacy policy. We share with them only what is needed to perform their function.
7. Data Storage, Location & Security
- Your data is stored on Supabase's managed infrastructure. Depending on your location, this may involve transferring data to servers in another country; where required, appropriate safeguards apply.
- All data is transmitted over encrypted (HTTPS/TLS) connections.
- Database access is restricted by row-level security rules so that each user can access only their own data and the rosters of accepted friends.
- Passwords are stored only as salted hashes.
- No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we take reasonable measures to protect your data.
8. Data Retention
We keep your account and roster data for as long as your account is active. When you delete your account, your personal data — profile, roster, friendships and associated records — is permanently removed from our systems. Some records may persist briefly in encrypted backups before being overwritten. Subscription/payment records held by Apple or Google are retained by them under their own policies.
To prevent abuse of one-time free benefits (such as the free roster upload) by repeatedly deleting and recreating accounts, we retain a one-way, irreversible hash of your email address and social sign-in identifier after deletion. This value cannot be reversed to recover your email or identify you, is never used to contact you or to rebuild your profile, and is kept solely for fraud prevention on the basis of our legitimate interest.
9. Your Rights & Choices
Delete your account
You can permanently delete your account at any time from Settings → Delete Account inside the app. This removes your profile, roster and friendships.
Access & correction
You can view and edit your profile and roster directly in the app. For any data not editable in-app, contact us using the details below.
Push notifications
You can disable notifications at any time in your device settings.
Legal rights
Depending on where you live (for example the EEA, the UK, California, or Turkey), you may have additional rights — including the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing. To exercise these rights, contact us at the email below. You also have the right to lodge a complaint with your local data protection authority.
10. Children's Privacy
Rosternado is intended for aviation professionals and adults. It is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page. Significant changes will be communicated through the app. Continued use of the app after an update means you accept the revised policy.