The twelve real ones\

Is it really free, and what is the catch?

It is free, and there is no catch on the free tier: no trial, no card, no feature held back behind a signup, no advertising, and nothing bundled with the installer. Everything the app finds today, it finds for everyone.

There is an intended paid tier, Roost Plus, and it is about time rather than depth: watching several networks, telling you when something new joins or a setting changes, and keeping longer history. It is not shipping, it has no price, and whatever it becomes, what the free app already finds stays free.

Do I need an account?

No. There is no account to make, no email address to give, and no way to sign in, because there is no server to sign in to. If Roost is ever licensed for the paid tier it will be a key you hold locally, not an identity you register.

What does it send anywhere?

Nothing about your household. By default the one thing Roost fetches is the public registry of hardware makers, a file that lets it tell you a device is a Reolink camera rather than an address. That file says nothing about you, and requesting it says nothing about your network.

Looking up where an address on the traffic map lands is the only request that would tell someone else something about your home, so it is off until you turn it on. The air-gapped setting refuses everything, including the phone link. There is no telemetry, no crash reporting and no analytics at any setting.

Will it change anything on my router or my devices?

No, and not as a policy: the code that talks to a router has no method that writes. It connects, reads settings, reads the forwarding table, and that is the whole interface. The client that speaks a router's own protocol will only send commands whose name begins with Get.

When something needs fixing, Roost walks you through your own router's interface, step by step, and then re-runs the real check. It does not log in and change the setting for you, and it cannot block, quarantine or cut off a device.

Can it see what my television or my doorbell is sending?

No, and neither can anything else you could run on that computer. On Wi-Fi your router sends each device's traffic only to that device, so a program on your laptop simply never receives the television's packets, at any privilege level. Measured on a real household network while building this: 338 of 400 packets were that computer's own.

So the traffic map is honest about its scope and says it is showing where this computer sends data. Seeing every device would mean the router reporting it, which is the same work as reading more routers. Three strings in an early build promised the whole house; they were wrong and they are gone.

Is it legal to scan my own network, and could it upset my devices?

Your own network is yours to look at, and Roost asks you to affirm that it is yours before it starts. It is a consumer tool for the network you are responsible for, not a tool for someone else's.

What it actually does is deliberately gentle: a rate limited nudge so your own computer resolves who is there, a read of the neighbour table, two multicast questions that devices answer by design, and a short list of TCP connects. Reads from the router are paced with a retry, because a real router's own web server dropped the first of three page requests made back to back, and going easy on older hardware is the same courtesy applied to the router itself.

Why does it need Local Network permission on macOS?

Because a scanner that cannot see the local network cannot scan it. macOS asks before an app may talk to other devices in your home, which is the right question for the system to ask.

If the permission is refused, Roost does not shrug and report an empty result: it says the permission is missing, explains what it is for, and shows the numbered steps to grant it. A scan that could not run is never allowed to look like a scan that found nothing.

It says my camera can be reached from the internet. How does it know?

It read your router's own port forwarding table and found a rule sending outside traffic on a port straight to that camera, and the finding shows you that line, with the port, the destination, when it was seen, and that the camera asked for the rule itself over UPnP.

Note what it does not claim. Roost cannot stand outside your house and knock, so it does not say it proved the port answers from the internet. It says what it read and where it read it. Every finding works this way: a real observation, a timestamp, and its source.

Why does it never tell me my network is fine?

Because that would be a promise no scanner can keep. Roost checked a specific list of things on a specific day, and it will tell you exactly what it checked and what it found, including the count: "Roost checked 41 things on this device". What it will not do is convert that into a word that means nothing bad exists.

The same rule cuts the other way. It says "could be reached" and "susceptible" rather than the words that would imply something has already happened to you, because that would be equally untrue and considerably more frightening.

My router is not on the supported list. Is Roost useless to me?

No. Most of what Roost tells you needs no router password at all: 31 of the 41 checks per device, every device on your network, whether they can reach each other, your Wi-Fi encryption read from this computer's own connection, and the doors your router is holding open, which it publishes to anything on the network.

What a reader adds is the settings only an administrator can see: WPS, remote administration, the guest network's isolation, the firewall. Without one, those tiles say Roost could not read them, which is not the same as saying they are fine.

Where does what it finds live, and how do I delete it?

In one encrypted database in your operating system's application data directory, with the key in your keychain. A router password, if you gave one, is in the keychain only. Nothing is anywhere else, because there is nowhere else.

Delete everything, in Settings, removes the database, its side files, and the key that could read them, and then checks that the files are gone. Uninstalling the app after that leaves nothing behind.

Who makes this, and how will it make money?

Raven Forge, a company whose actual business is appliances sold to organisations: Raven Eyrie and Overwatch, two node systems that do this work at a scale a household does not need. Roost is the free consumer tier of that line.

The intended revenue is Roost Plus, described above, and the appliances. Not your data, which never leaves your machine and which Roost has no way to collect, and not advertising, which would require knowing something about you.