Privacy Policy

1. Who we are and what this policy covers

Wasdesign, LLC, a Utah limited liability company ("Rostr," "we," "us," or "our"), operates Rostr at https://joinrostr.com. This policy explains how we handle personal information when you visit our website, contact us, or use our event coordination, account, and messaging features. Contact us at support@joinrostr.com with privacy questions or requests.

Public sample events use fictional information and do not create real signups or send messages. Availability of account, subscription and messaging features is shown in the app. Optional event texts require separate consent. Visiting a preview does not enroll you in an event or text-message program.

2. Information we collect and where it comes from

• Account information: When account features are available, your mobile number, display name, account identifier, authentication and session records, and account preferences. We receive verification results from our authentication provider. Never send sign-in codes to support.
• Event and participation information: Information you or an organizer provide, such as event names, descriptions, locations, dates, organizer identities, signups, guest counts, attendance responses, waitlist status, saved events, and optional reservation records. An organizer or other participant may provide information about an event involving you. Guest spots do not require a separate guest profile; do not enter another person's sensitive information in an event field.
• Messaging information: Your number, message content, requests for verification codes, communication preferences, app installation identifiers and notification tokens, consent or withdrawal records, timestamps, delivery information, and replies such as STOP or HELP. Our messaging providers and carriers provide delivery and opt-out information when messaging is enabled.
• Support information: Your email address and the information, attachments, and correspondence you choose to send us. Please avoid sending financial account numbers, government identifiers, medical information, or other sensitive information that is unnecessary for your request.
• Technical information: Our service and hosting providers process information such as IP address, browser and device characteristics, requested pages, timestamps, request identifiers, errors, and security or abuse-prevention signals. An IP address may indicate an approximate location; we do not request your device's precise location. An event location is information supplied for the event, not a continuous record of your movements.
• Payment information: Stripe processes web payments and Apple processes in-app purchases. RevenueCat helps verify subscriptions and provides purchase analytics. Rostr receives account-linked subscription, transaction and payment-status records, rather than your full payment-card number. The offer identifies its price and renewal terms before you authorize a charge.

We do not buy contact lists to enroll people in Rostr messages. You may choose not to provide information, although a feature that needs it may not work.

3. How we use information

We use information to provide requested features; verify identity and maintain sessions; coordinate events and participation; deliver requested or consented communications; respond to support and privacy requests; diagnose problems and improve reliability; prevent spam, fraud, and unauthorized access; maintain consent and security records; enforce our Terms; and meet legal obligations or establish, exercise, or defend legal claims. We use only information reasonably related to these purposes. We do not use event information to make decisions about credit, employment, housing, insurance, or similar eligibility.

4. Event links and information other people can see

A private event link is an access link, not a promise of confidentiality. Someone who receives or is forwarded the link may be able to view the event information available through it, including event location and timing and displayed participant names, guest counts, and signup or attendance status. Some details and actions require a verified account or an organizer role. Treat links as private and share them only with intended participants.

Rostr does not display account phone numbers or billing information on event rosters. Organizers and participants can see the information needed for the event features available to their role. People who can view information may copy or share it outside Rostr, which we cannot control. Do not use an event name, description, or display name to disclose sensitive personal information. An organizer's separate collection or use of information outside Rostr is governed by that organizer's own practices.

5. When we disclose information

We disclose information only as appropriate for the following purposes:

• Operating the service: Service providers process information needed for hosting, databases, authentication, communications, customer support, security, and, if offered, payments. Our selected infrastructure includes Vercel for hosting and Supabase for account/database services; Telnyx and mobile carriers support SMS when enabled. Apple delivers app notifications and processes in-app purchases; RevenueCat verifies subscriptions and provides purchase analytics. Support email uses email-routing and mailbox providers. These providers receive information needed for their service and applicable legal responsibilities, not permission from us to market unrelated products to you.
• Your use and instructions: Event information is disclosed to other users as described above, or to a recipient you direct us to share it with.
• Legal and safety purposes: We may disclose information when reasonably necessary to comply with applicable law or valid legal process, protect rights and safety, investigate abuse or fraud, or establish, exercise, or defend legal claims.
• Business changes: Relevant information may be reviewed or transferred in a merger, acquisition, financing, reorganization, or sale of business assets, subject to appropriate confidentiality protections and this policy's restrictions. A successor must respect the applicable privacy and messaging-consent commitments or obtain any legally required new consent.

We do not sell personal information, share it for cross-context behavioral advertising, or provide it to third parties or affiliates for their own direct marketing. We do not sell, rent, or disclose mobile numbers or other mobile information for another party's promotional or marketing use.

SMS opt-in information and consent records are excluded from any general permission to share information. We disclose them only to providers that need them to operate the messaging program, or when legally required. They are not provided to third parties or affiliates for unrelated purposes, advertising, or marketing. A business transfer does not grant permission to repurpose SMS consent for a different sender or program.

6. Text messages and your choices

Requesting a sign-in code authorizes that verification message; it does not enroll you in event updates or recurring invitations. Optional text notifications require explicit consent in your account. You can choose notification categories and event preferences separately. Providing a number, accepting the Terms, joining an event or following future events does not by itself grant optional SMS consent. We keep records of the choices you make.

For an active SMS program, reply STOP to the sending number to stop messages from that number. A final message may confirm the opt-out. Reply HELP or email support@joinrostr.com for assistance. Sender-level opt-out may also prevent verification texts from that number. Resubscribing does not automatically opt you into all event programs or restore preferences you withdrew. Opting out of SMS does not by itself cancel your event signup or delete your account. See Terms of Service for message types, frequency, charges, and additional messaging terms.

When you allow iPhone notifications, Rostr registers this device to your signed-in account. App notifications can become your preferred delivery method, with previously enabled texts retained as backup. Change these choices in Account → Notification preferences or turn off notifications in iPhone Settings. We do not treat an unopened notification as permission to send an extra text.

7. Cookies, local storage, and tracking

We use cookies or similar browser storage for authentication, security and requested functionality. We prepare private business reports from records needed to operate Rostr, such as published dates, signups, verified payments and refunds that our providers report. We may count public page requests by shared campaign and page categories without cookies, device identifiers, raw URLs, referrers or recipient tracking. These counts are not unique visitors. We do not use advertising pixels, recordings, fingerprinting or automatic input capture, or track browsing across unrelated services.

Measurement privacy lets you stop account-linked measurement and request deletion of linked measurement data. Prior declines and privacy requests remain effective; they are not converted into permission. New account-linked campaign measurement is omitted when its processing context cannot be established. GPC and Do Not Track suppress new optional measurement on that request. Records needed to provide and secure the service and necessary business totals remain separate.

New derived account-linked measurement is limited to 90 days, campaign attribution to 30 days, and non-identifying daily campaign totals to 13 months. We do not send new optional interaction histories to PostHog. Previously collected PostHog data remains subject to its US-region processing, three-calendar-month cleanup and verified deletion requests, which can take additional time. Device queues are removed; existing expiring deletion proof and pending withdrawal requests may be retained only to finish privacy requests. Completing an account-bound request can require a connection and the original signed-in account. Contact support@joinrostr.com for privacy requests, including when you cannot sign in.

8. Retention and deletion

We keep personal information for the time reasonably needed for its purpose, considering whether your account or events remain active, ongoing support needs, the sensitivity of the information, security and abuse risks, consent and opt-out obligations, dispute resolution, and applicable legal retention requirements. We do not promise one retention period for all categories of information.

You can start account deletion in Account → Delete account in the iPhone app. If a safeguard delays completion, the app explains the status. Deleting your account does not cancel an Apple subscription; manage that subscription through Apple. You can also request deletion by emailing support@joinrostr.com. Subject to identity verification and applicable exceptions, we delete or de-identify information that is no longer needed. Limited records may be retained for security, legal obligations, disputes, financial records if applicable, and to honor messaging suppression. Backups may retain copies until their normal replacement cycle, with use restricted to recovery and permitted retention purposes. Deleting an account cannot erase copies another participant independently made or cancel an external venue booking. We will explain material limitations when handling your request.

9. Access, correction, and other privacy requests

Contact support@joinrostr.com to ask about access, correction, deletion, or a copy of your information, or to raise a privacy concern. Include enough context to locate your account, but do not send a password, sign-in code, or identity document unless we specifically arrange an appropriate verification method. We may verify your identity and an authorized agent's authority before disclosing or changing information.

Depending on your location and the law applicable to our business, you may have additional rights, including data portability, information about our processing, restriction of certain uses, an appeal of a request decision, or a complaint to a privacy regulator. We will handle requests within applicable legal timeframes and explain a denial and any available appeal process. To request an appeal, reply to our decision or email support with “Privacy appeal” in the subject. We do not penalize you for exercising legally protected privacy rights. A deletion request may make a feature that requires the information unavailable.

These provisions do not claim that every state privacy statute applies to Rostr. Nothing in this policy limits rights you have under applicable law.

10. Security and processing locations

We use access restrictions and other reasonable administrative, technical, and organizational safeguards intended to protect personal information. No online service or transmission method is perfectly secure. Protect your phone, account sessions, and event links, and contact support if you suspect unauthorized use.

Rostr is operated in the United States and intended for US use. Our providers may process information in the United States and other locations where they operate. Other countries may have different privacy protections. Where law requires safeguards for an international transfer, we will use the safeguards applicable to that transfer; visiting the site is not a waiver of your privacy rights.

11. Children

Rostr is not directed to children under 13, and we do not knowingly collect their personal information. Account users must be adults able to enter a binding agreement under our Terms. Do not submit a child's name, contact details, or other personal information in event fields. If you believe a child has provided personal information, contact support so we can investigate and take appropriate steps, including deletion where required.

12. Other services and changes to this policy

Links to venues or other third-party services lead to services with their own privacy practices. This policy does not control those independent services.

We may update this policy as our service or legal obligations change. We will update the date above and provide additional notice of material changes as required by law, such as a prominent website notice or a direct notice where appropriate. We will obtain consent when legally required before using information for a materially different purpose. Contact support@joinrostr.com for questions or a copy of a prior policy.