Privacy
What leaves your computer
Nothing about your household. No account, no signup, no telemetry, no crash reporting, no analytics, no phone home.
This is not a policy page. There is no data controller here, no processor, no partner and nothing to share, so a page of template clauses would only be a lie with legal formatting. What follows is mechanism: what the app may reach, how that is enforced, what is stored and where, and the command that proves each one.
One setting, one function
Everything Roost may reach is decided by a single stored answer, the network posture, and every request passes through a single function. That function checks the purpose and the host, allows https only, follows no redirects, and caps the size of what comes back.
A host in the allowlist that no code actually uses is treated as a defect, and a test fails on it. Two of them existed once, allowing nothing to happen for no reason, and a promise widened for nothing is still widened.
The guard fails closed. If the posture cannot be established, the answer is no.
The three postures, and what each allows
That third one is not decoration. When a household chose air-gapped and the phone link still opened a listener, that was a defect with two settings behind it, and it was fixed by deleting one of them so the two can never disagree again.
Verify it
pnpm --dir web test offline
cargo test posture
The first proves the interface contains no remote origin and no network call of any kind. The second proves the posture holds in the core.
Check packs are never downloaded
A pack is a file you choose. Its signature is verified with a key pinned in the app before anything parses the bytes, and a failed verification leaves the pack you already had in use. There is no host for one in the allowlist, so there is nothing to intercept.
Read only, in the type system
The interface a router reader implements has three methods and no fourth, so there is no write path to misuse. The client that talks to a router over SOAP will only send actions whose name begins with Get.
Your public address is read and never shown
Roost reads it from the router to make sense of the perimeter, and deliberately does not pass it to the interface. A report is easy to share, and a home's public address identifies the household.
What is stored, and where
One database, in the operating system's own application data directory, encrypted at rest with a key that lives in the operating system's keychain. Devices, findings, scans, the pack in use, and a ledger of what was fixed and what came back.
A router password, if you give Roost one, goes to the keychain and nowhere else: never into app storage, never into the database, never into a log. Disconnect and it is deleted.
Delete everything, in Settings, removes the database, its side files and the key that could read them, then checks that the files are gone.
Proven rather than claimed
A test reads the database file back off the disk and asserts that it does not begin with the bytes that mark a plain database file, and that it holds neither a device name nor a hardware address in the clear. Another proves a second key cannot open it.
cargo test store::tests::the_database_on_disk_is_not_readable_as_a_database
Nothing identifying reaches a log
No hardware address, no router credential, no network name. There is one redaction path, it is unit tested, and it covers diagnostic output too, which is where it is easiest to forget: a real router named its own controls after each mesh node's hardware address, and the diagnostic printed three of them before the rule was applied there as well.
The report you export
One self-contained document. No stylesheet to fetch, no font to download, nothing that reaches out when someone opens it.
Hardware addresses are off by default and the document says why. Turning them on adds a line about thinking who you are sending it to. The same document built twice from the same data is byte for byte identical, which is a small thing that makes it easy to check what changed.
The phone link
Off until you turn it on. No listener before that, none after you stop, and closing the app closes it. Bound to the network you are on, with a VPN refused outright.
Read only, three known paths, no verb that changes anything. Sealed rather than merely local: responses are encrypted, every request carries a proof over its method, its path and a fresh number, and those numbers are remembered so a recorded request cannot be replayed. A stranger on your network gets a refusal and a body of "no", while the paired phone gets a sealed answer with the device name nowhere on the wire.
This website
No cookies. No local storage. No analytics, no tag manager, no pixel, no session recording, no chat widget, no embedded video, no map tile, no social button.
No third party request at all: the fonts are served from this domain, the icons are drawn in the page, and the whole site is one HTML file, one stylesheet and one small script per page. A build check fails if a reference to any host other than this one appears in an asset position, which is why that claim is worth making.
The site is published as static files by GitLab Pages, which serves them and keeps its own operational logs of requests, as any web host does. Roost is not told you came here, and there is nothing here to tell it with.
There is no form on this site, and no email address is collected for any reason, including to tell you when a release lands. The release page is public and needs nothing from you.
If any of that ever changes
It will be written on this page, in this size type, before it ships. A privacy claim that quietly loosens is worse than one that was never made.
Who to ask
Raven Forge LLC. The source of both the app and this site is public, so the fastest answer to any question here is usually the code: gitlab.com/raven-forge/roost.