Privacy Policy
The short version. Roost has no server and no account. Your family's health records are created on your phone, encrypted on your phone, and stay on your phone. We cannot see them, we do not receive them, and we have nothing to sell. There is no analytics, no advertising and no tracking of any kind.
Who we are
Roost is published by AppsInventor. If you have a question about this policy, write to roost@appsinventor.com.
What data Roost handles
You can record whatever you choose to record. That typically includes:
- Profiles of the people you look after: name, relationship, date of birth, sex, blood group.
- Medicines, doses, schedules and what has been taken.
- Vitals such as blood pressure, blood sugar, weight and oxygen saturation.
- Allergies, symptoms, medical history, vaccinations and dental records.
- Doctors, appointments, insurance policies and hospital identifiers.
- Photographs and PDFs you add: prescriptions, lab reports, scans.
- Menstrual cycle entries, if you use that feature (your own profile only).
This is health information, and it is sensitive. That is exactly why the app is built the way it is.
Where that data goes
Nowhere. Roost does not have permission to use the internet. The Android app is shipped without the INTERNET permission, so it is not technically capable of transmitting your records anywhere, to us or to anyone else. There is no account to create and no server to sync with.
How it is protected on your phone
- The database is encrypted with AES-256 (SQLCipher). Photographs and PDFs are encrypted individually in a separate vault.
- The encryption key is generated on your device and held in the Android Keystore. It is never derived from your PIN, so forgetting your PIN can never destroy your records.
- You can turn on an app lock (PIN, with an optional fingerprint) and a screenshot block.
- Android's automatic cloud backup is switched off for Roost
(
allowBackup="false"), so your records are not copied into Google's backup service behind your back.
Backups you make yourself
Roost can export a single backup file (.fhtb) containing your
data. It is encrypted with a passphrase that you choose, and it is written
wherever you tell your phone to put it: your Downloads folder, a cloud drive,
a memory card. Once you place that file somewhere, it is governed by whatever
service you placed it in, not by us. We never receive it, and we cannot
recover it or its passphrase for you. Keep the passphrase safe: without it,
the backup cannot be opened by anyone, including us.
Health Connect
If you choose to connect Roost to Android's Health Connect, Roost requests read-only access to four kinds of reading: blood pressure, blood glucose, weight and oxygen saturation. Those readings are copied into Roost's encrypted database on your phone so they appear alongside the ones you entered by hand. Roost never asks for permission to write to Health Connect, and data read from Health Connect is never transmitted, never shared, never used for advertising, and never used for any purpose other than showing it to you in the app. You can disconnect at any time, in Roost's settings or in Health Connect itself.
Camera and files
The camera is used only when you choose to photograph a document. Those images are encrypted and stored in Roost. They are not written to your photo gallery and are not uploaded anywhere.
Children
Roost is designed for an adult keeping records for a household, which may include records about children. Those records are kept on the adult's device under the adult's control, on the same terms as everything else in the app.
Your rights over your data
Because your data never leaves your device, you already hold it all directly:
- Access and portability: export an encrypted backup at any time, or share a person's medical card as a PDF.
- Deletion: delete any record or profile inside the app. Uninstalling Roost removes the encrypted database and vault from your phone. Any backup file you made yourself is yours to delete wherever you put it.
There is no "request my data" form to fill in, because there is no copy of your data anywhere for us to hold.
Third parties
Roost contains no analytics, no advertising, no crash reporting and no third-party trackers. No data is sold or shared, because none is collected.
Changes to this policy
If this policy changes, the new version will appear on this page with a new date. If a future version of the app ever collects anything, that change will be stated here plainly and in the app before it happens.