Roost
Roost is a study and planning service independently operated by a solo developer. This policy explains how Roost handles information when you visit roostai.app, use your Roost account, connect school platforms, use Roost's study and AI features, or authorize an assistant such as Claude or ChatGPT to access your Roost account.
For privacy questions, data requests, or security concerns, contact [email protected]. Please describe the issue without sending passwords, sign-in links, session cookies, access tokens, or unnecessary student records.
1. Information Roost collects and processes
Account and sign-in information
Roost uses Supabase to manage accounts and authentication. You can create an account or sign in with Google; existing accounts can also request an email sign-in link. Account information includes your email address, account identifier, display name, account timestamps, authentication information, and profile or timezone settings. Google may provide basic profile information associated with your sign-in, according to the permissions shown in its sign-in flow. Roost does not receive your Google password through that flow.
The account connection does not itself authorize access to your Gmail messages, Google Drive documents, or Google Calendar. School-platform connections and assistant connections are separate actions.
School connections and coursework
When you connect a supported school platform, Roost processes information available through the account and pages you authorize it to access. Depending on the platform and what can be read, this can include course names and codes, assignment names and instructions, deadlines, availability dates, completion status, possible points, announcements, calendar events, source links, and import status or error information.
School sign-in may take place in a hosted browser, including a school's identity-provider or multifactor-authentication pages. Roost stores encrypted session cookies and supported browser sign-in state to reuse the connection. When you connect Course Site, Roost also requests school API access after verifying your sign-in and stores the resulting token encrypted for your Roost account. Roost uses a restricted set of read operations to retrieve course lists, deadlines, instructions and instructor files; the school-issued token may itself permit broader operations. These saved credentials are sensitive because they allow access without repeating the full sign-in flow. They are stored separately from ordinary coursework records and are not returned to connected AI assistants.
Roost's current course roster comes from Course Site. Other-platform assignments may be associated with those classes. Course Site imports retain a bounded index of coursework and source links; selected documents are read when needed. Live document reading through Roost's external-assistant integration currently supports Course Site. Other platforms provide available saved imported instructions and notes through that integration. Coverage can be incomplete, and previously imported records can remain after the original school material changes or disappears.
Content and activity you save in Roost
Roost stores the information you add or keep in your workspace, including notes, assignment drafts, manual tasks, extracted document text, study sets, source excerpts, questions and answers, practice attempts, self-reviews, topic corrections, completion choices, study history, plans, availability, and personalization preferences. Preferences can include study hours, session length, priority courses, appearance, and self-reported energy or progress.
Content can include personal information about you or other people if that information appears in the material you provide or connect. Choose material you are entitled to use and share, and consider your instructor's rules before using AI for coursework.
Uploaded documents, photos, and scans
Supported typed documents are read on your device to extract text. Extracted text and relevant file or source labels can then be added to your saved notes or study material. Roost's notes uploader does not retain the original typed document as an account file.
If you choose Transcribe notes for a photo or scan, Roost sends rendered page images to its AI service for transcription. Originals and page previews remain temporary in the upload workflow. You can review and edit the transcript before saving it to your notes. A generated transcript can still be held in the temporary AI-response cache even if you close the review without saving; the cache and its clearing control are explained below.
AI requests and results
When you use Roost's AI features, Roost processes your question or instruction, a bounded recent conversation history where relevant, and the source excerpts or workspace context selected by you or Roost for that request. This context may include coursework, notes, schedules, preferences, or progress needed for the requested help. It also processes the answer, generated study content or transcript, model information, token counts, cost information when available, and request-status information.
Connection requests and technical information
When an external assistant uses Roost, Roost receives the requested tool, search terms, selected course or assignment identifiers, filters and pagination parameters, and authorization information. Search terms or other parameters may contain information derived from your conversation. Roost's tools do not request the assistant's full conversation history, memory, or unrelated files.
Roost and the services operating its website, authentication, database, hosted browsers, and AI infrastructure also process technical information needed to deliver requests and protect the service. This can include network and browser information, timestamps, request identifiers, connection stages, error categories, session status, and usage or spending records. The current application records connector-operation diagnostics and usage controls; its AI and external-assistant paths do not intentionally write raw document text, full prompts, passwords, or bearer tokens to application console logs. This is not a claim that infrastructure providers collect no technical data.
If you email support, the message, reply address, and any information you choose to include are processed to handle that communication.
2. How Roost uses information
Roost uses this information to:
- Create and authenticate accounts, associate information with the correct account, and synchronize your saved workspace across devices.
- Import and organize coursework, retrieve selected school material, and preserve sources, dates, connection status, and reading limitations.
- Provide requested explanations, summaries, practice material, feedback, transcription, and study or planning suggestions.
- Personalize suggestions using saved coursework, preferences, and learning activity.
- Operate assistant connections you authorize and return the information requested through their tools.
- Enforce request, concurrency, and spending limits; reuse recent results; prevent duplicate processing; investigate failures; and protect the service against misuse.
- Respond to support, privacy, and security inquiries and address applicable legal obligations.
Study recommendations and practice scores are learning aids. They are not official grades, school determinations, or guarantees of readiness. The external-assistant tools are read-only: they do not submit schoolwork, start assessment attempts, change grades, or edit your saved study workspace.
3. Roost's AI generation and transcription
Roost's built-in AI service uses OpenRouter to route requests to providers running the Mistral Small 3.2 model. The current configured integration allows DeepInfra and Parasail routes. The model name identifies the model used; it does not mean that every request is sent to Mistral as a hosting provider.
For a text request, the AI route receives the question, relevant recent chat, and selected source or workspace context. For transcription, it receives the rendered page image and transcription instructions. Personal information within that content can be processed by the AI provider.
Roost's requests require OpenRouter routes designated for zero data retention and deny data-collection use through the provider-routing settings. These controls concern the inference route. They do not eliminate Roost's own saved notes, conversations, generated content, temporary response cache, or usage records. They also do not establish the policies of a separate Claude or ChatGPT account. OpenRouter explains that its zero-retention routing can still permit temporary in-memory prompt caching, and that its own prompt logging is a separate account setting. See OpenRouter's data controls.
The provider policies linked below explain their processing. Roost does not make a blanket promise that every service involved retains no data or that information can never be accessed for security or legal purposes.
You can turn off AI assistance in Roost's study preferences. That setting controls Roost's optional AI assistance, including transcription. It does not revoke an external assistant's separate authorization. Requests already sent may still be processed even if you cancel a screen or turn the setting off.
4. Connecting Claude, ChatGPT, or another supported assistant
Connecting an assistant requires signing in to Roost and approving the displayed read-access request. The grant covers your coursework and available assignment material, saved notes or drafts, uploaded extracted text, and school connection status. It is not a separate permission switch for each class or document. The assistant selects particular searches or records through the available tools.
Tool results can include course and assignment metadata, deadlines, source links, selected school text, saved instructions, notes, drafts, uploaded extracted text, connection names and status, retrieval times, and coverage warnings. The connection does not give the assistant your school passwords, saved school-session cookies, school API tokens, or Roost's server credentials.
Returned information is shared with the connected assistant service. With hosted Claude, that recipient is Anthropic; with ChatGPT, it is OpenAI. The returned information can become part of your conversation and generated answers. The assistant provider's handling of it depends on its product, your plan, settings, and applicable terms. Roost does not control that provider's retention, training, or conversation-deletion settings.
The Roost retrieval connection does not call Roost's separate AI-generation or transcription provider. The connected assistant performs its own analysis of the retrieved material.
A grant expires after at most 90 days unless you authorize a new connection. You can revoke it in Roost → Connect AI by choosing Disconnect. Subsequent requests using that grant are rejected; a request already authorized and in progress may finish. If you have more than one grant, disconnect each one you wish to revoke.
Disconnecting an assistant does not delete your Roost account, coursework, notes, school sessions, cached excerpts, or information already returned to that assistant. Removing a plugin alone should not be treated as confirmation that the Roost grant has been revoked. Use the Roost connection controls and the assistant's own settings.
5. Services and recipients involved
On a small screen, scroll the table sideways to read every column.
| Recipient | Role and information involved |
|---|---|
| Supabase | Account authentication, account/profile information, and saved coursework and study-workspace data. |
| Cloudflare | Website and connection hosting, hosted school sign-in browsers, encrypted session and selected-text storage, authorization records, and operational usage controls. |
| Google sign-in and the basic identity information shared through that flow. Google also handles messages sent to Roost's Gmail support address. | |
| OpenRouter and the selected inference provider | Roost AI requests, relevant text context or transcription page images, generated results, and related technical/usage information. Current routes use DeepInfra or Parasail. |
| An assistant you authorize | The tool requests and returned Roost information described in section 4. This includes Anthropic for hosted Claude and OpenAI for ChatGPT. |
| Your school platforms and their sign-in providers | Sign-in, authentication, coursework-source requests, and related technical information needed to provide those connections. |
Applicable provider information is available from Supabase, Cloudflare, Google, OpenRouter, DeepInfra, Parasail, Anthropic, and OpenAI. Their policies may distinguish business, consumer, API, and other services.
Roost may also disclose information when required by applicable law or a valid legal process, or as necessary to address fraud, security incidents, or threats to people's rights or safety. This policy does not authorize unrestricted disclosure of your coursework for unrelated purposes.
Links and sign-in pages belonging to other services are governed by those services' practices. A school or assistant connection does not make those services part of Roost or mean that they endorse Roost.
6. Browser storage and local copies
Roost uses browser storage to maintain your authentication session, remember preferences, preserve unsaved work, and maintain an account-scoped local copy of your study workspace for synchronization and recovery. A pending assistant-link request may also be held temporarily in the browser so sign-in can return to the connection flow.
Successful sign-out from the hosted workspace clears its saved local workspace copy after pending changes have been saved. Browser or network failures can interrupt this process. Clearing site data can remove local information and sign-in state, but it does not itself delete the corresponding cloud account or data already shared elsewhere.
The application does not implement a separate response to browser Do Not Track signals. Authentication providers and external pages may use their own cookies and storage. The current Roost application does not contain third-party advertising or behavioral-advertising features; this statement does not mean that hosting, authentication, or external services process no technical data.
Downloaded backups and exports are files under your control. Anyone you share them with may be able to read their contents. The workspace export excludes Roost's authentication-storage entries and server credentials, but it can include sensitive information you placed in notes or other saved content.
7. How long information is kept
Different records serve different purposes. Removing one type of data does not necessarily remove its copies in another feature or service.
On a small screen, scroll the table sideways to read every column.
| Information | Current retention and controls |
|---|---|
| Account, imported coursework and connection records | Saved in the account without an automatic expiry in the current service. Source records can remain after upstream changes. Workspace reset and assistant disconnection do not delete these records. |
| Notes, drafts, saved sources, study sets, conversations, plans and learning history | Kept in your account and local working copy until changed or removed through the relevant controls. Saved source excerpts can remain inside study sets or conversation history even after another copy is removed. |
| Uploaded originals and rendered page images | Used temporarily in the upload or reading workflow. The notes uploader saves extracted or reviewed text instead of the original file. Transcription sends page images to the AI route; provider processing is described above. |
| Temporary AI results, including transcripts | Eligible for private reuse for up to 24 hours, subject to earlier capacity eviction or your clearing request. Expired results are removed through periodic cleanup and service operations, rather than guaranteed physical deletion at the precise expiry second. |
| Selected school-text excerpts | Up to approximately 12 KB per selected source is retained encrypted with a configured 24-hour expiry after extraction. Complete recent excerpts may be reused for five minutes. Older excerpts are used only as labelled fallback after a transient reading failure. |
| Full text held temporarily for selected document reading | Kept in the running process and reusable while fresh for five minutes. Expired entries are removed on later reads or when the process ends; capacity eviction may remove them earlier. |
| Saved school-session state and Course Site API tokens | Stored separately from coursework and encrypted for your account, with a local retention limit of 30 days from each successful save. The school may invalidate access sooner, requiring you to reconnect. Removing Roost's local copy does not revoke a token at the school; it may be shared with the school's official mobile app. Assistant disconnection does not clear school access. |
| Assistant authorization records | Pending requests expire after ten minutes; single-use codes after one minute; access tokens after one hour; grants and rotating refresh tokens after at most 90 days. Client registration metadata expires after 365 days. Revoked grants remain marked unusable until expiry and later cleanup; they are not immediately erased. |
| Usage and reliability records | AI request and spending records currently have no automatic deletion schedule. Inactive hosted-browser accounting records are eligible for cleanup after approximately 62 days. Short-term rate and reading-reservation records are cleaned up during later operations. These records are separate from source text. |
| Support correspondence and infrastructure records | Retention depends on the inquiry, operational need, applicable obligations, and the relevant service settings. The service does not currently promise a single fixed deletion period covering support messages, provider logs, and backups. |
| Information already sent to another assistant or included in your exports | Governed by that recipient's practices or your handling of the downloaded copy. Roost's deletion controls do not recall those copies. |
The time limits above describe application validity, reuse and cleanup settings. They are not a guarantee that all provider backups or infrastructure copies are erased at the same time.
8. Your choices and existing controls
Open the account/workspace menu in Roost to access the following controls:
- Manage study data → AI assistance: allow or disable Roost's optional AI help. This does not disconnect Claude or ChatGPT.
- Clear temporary AI responses: remove the account's temporary AI-result cache. This leaves saved notes, study sets, conversation content, and usage accounting in place.
- Export learning history / Delete learning history: export the learning data covered by that control, or remove recorded practice/history categories. Deletion leaves notes and study sets in place.
- Backup & restore: download and restore a copy of the saved study workspace. This is not a complete export of authentication, school-session, or infrastructure records.
- Reset workspace: clear the study workspace's notes, progress, plans and other resettable entries. Course color associations are preserved. This does not delete the account, imported coursework, school sessions, assistant grants, or server usage records.
- Connect AI → Disconnect: revoke a selected assistant grant as described above.
Account changes synchronize when the connection is available. Check the save status before closing the page; a failed or conflicting save may leave changes only on the current device. Deleting or resetting one feature does not delete separately saved copies, exports, or third-party conversations.
Roost does not currently provide a complete self-service account deletion and connected-data purge workflow. For requests beyond the available controls, email [email protected] with the account email and what you want reviewed. Additional information may be needed to verify that a request concerns your account. Do not send passwords or verification codes. The available controls and this contact route do not imply that all records can be erased immediately or from third-party services controlled by someone else.
9. Privacy rights and requests
Depending on where you live and which laws apply, you may have rights to request access to, correction of, deletion of, or a portable copy of your personal information; restrict or object to certain processing; withdraw consent where processing relies on consent; or complain to the relevant privacy authority. Some rights are subject to identity verification, legal exceptions, or other conditions.
Use the contact above for a Roost request. Requests about a school record held by a school, or about information already held by Claude, ChatGPT, Google, or another separate service, may also need to be directed to that service. Nothing in this policy limits rights or obligations that applicable law does not permit to be waived.
10. Security
Roost uses authentication, account access checks, encrypted storage for saved school sessions and selected school excerpts, bounded requests, and separation of user records to help protect information. Assistant access uses revocable authorization, and server credentials are not included in the distributed plugin.
These safeguards reduce risk; they do not make any internet service completely secure. Protect your own accounts and devices, review assistant consent screens, and use care when sharing screenshots, notes, exports, or sign-in links. Report suspected unauthorized access or a security issue using the contact above without including live credentials.
11. Age, schools, and international use
Roost is a student study service. Its current sign-in flow does not collect a date of birth or provide a verified parental-consent workflow.
A student's ability to sign in to a school service does not establish that a school has appointed Roost as its service provider. This policy does not claim school approval or certification under student-privacy laws. Schools, instructors, and students may have separate requirements governing use and disclosure of course materials.
Roost uses internet-hosted service providers. Processing can take place outside the place where you live, depending on the service and deployment. Roost does not promise that all information remains within a particular country. The services involved and links to their privacy information are listed in section 5.
12. Changes and contact
When this policy is updated, the revised version will be posted with a new effective date. Material changes will be described on the policy page, with additional notice or consent where applicable law requires it. An update does not by itself authorize a new use of previously collected information where additional permission is required.
For questions about this policy or your information, contact Roost at [email protected].