Legal

Privacy Policy

Effective November 3, 2026

Roster is a roster of designers looking for work. This policy explains what we collect, how we use it, and the choices you have. We try to keep it plain and short. If anything is unclear, email hello@roster.design.

The short version

• We collect what you give us (your name, email, portfolio link, and the profile and posts you create) plus a small amount of technical data to keep the site working and free of spam.
• Your sign-in email is never shown publicly. Your public page shows only what you choose to put on your profile.
• We do not sell your personal information, and we do not run ads or third-party advertising trackers.
• You can edit or hide your profile at any time, and you can delete your account and data yourself from your profile screen.

What we collect

Information you give us.

• Waitlist and invites: your name, email address, portfolio link (designers), or work email and company (people hiring), and the invite code you use.
• Your profile: username, name, headline, bio, skills, years of experience, city and country, whether you are open to remote work and which types of work, a portfolio or website link, an optional contact email, and a profile photo.
• Your posts: titles, descriptions, links, skills, and images you upload.
• Your activity: who you follow, who you recommend (a "rec"), which posts you like, which projects you cheer and the phrases you pick, any posts you report, and, if you tell us, that you got hired and where (shown on your profile).
• Messages to us: anything you send to hello@roster.design.

Information collected automatically.

• A sign-in cookie that keeps you signed in for up to 30 days (see Cookies below).
• A scrambled (hashed) version of your IP address, used only to limit abuse, such as too many signups or sign-in attempts. We do not store your raw IP address for this purpose, and the hash is not linked to your profile.
• View counts for your posts, which are totals per day and not tied to individual visitors.
• Hiring views: when someone with a hiring account opens your profile or a project, we count it, at most once per person per day. You see how many hiring managers and recruiters viewed your profile, but never which ones.
• Job activity: we count views of a job and clicks on its Apply button, as totals for the person who posted it, not tied to individual visitors.
• Site analytics: we use Google Analytics to see, in aggregate, how Roster is used: which pages are visited, roughly where visitors come from, and what device and browser they use. It sets cookies, records a shortened IP address, and does not use advertising features. We remove sign-in codes, tokens, and email addresses from the page addresses we send. If you are in Europe, it only runs after you accept the banner.
• RepCapture: we also use RepCapture, a tool made by our founder, to see which pages visitors view, how long they stay, and where they come from. It stores a random visitor ID in your browser, does not read what you type into forms, and runs only when analytics is on for you, the same as Google Analytics.
• Sponsored cards: we may show clearly labeled sponsored cards on the homepage and in The Roster. To report to sponsors, we keep daily totals of how many times each sponsored card was seen and clicked. We do not store who saw or clicked it, and we do not share any information about you with sponsors. Clicking a sponsored card takes you to the sponsor's website.
• Job ratings: if you give a job a thumbs up or down, we keep that against your account so you can change it. Other people only see the totals, never who rated.
• Job suggestions: if you suggest a job from the job board, we keep the link and note you send, and your member account if you are signed in, so we can follow up. We use it only to decide what to add to the board.
• Advertising inquiries: if you contact us through the Advertise page, we keep your name, email, company, and message so we can reply, and we do not use them for anything else.
• Newsletter links: links in our newsletters pass through our own address so we can count clicks. We keep daily totals for each link in each newsletter, not who clicked. We do not track whether you open a newsletter.
• Blog views: we count how many times each blog post is viewed, as daily totals, along with the kind of place the visit came from (such as search, social, or our newsletter). We do not keep who viewed it.
• Email delivery: we use Resend, an email delivery service, to send our emails. They receive the recipient's email address and the message so they can deliver it, and they tell us whether it was delivered, bounced, or marked as spam.
• Standard server logs kept by our hosting provider, which can include IP addresses, browser type, and pages requested.

How we use it

• To run Roster: confirm your email, send invites, sign you in, and show your profile and posts the way you set them up.
• To keep Roster real: review signups, detect spam and fake or AI-generated profiles, and enforce our Terms.
• To email you about your account: confirmations, invites, sign-in codes, new-follower notices (which you can turn off in your profile settings), and important service notices. We also send occasional news and updates about Roster, such as product announcements, to everyone who gave us their email, whether on the waitlist or as a member. This includes a weekly roundup of new jobs for members. We also send a short email when your profile or one of your projects is featured on Roster. Every one has an unsubscribe link, and you can turn them off any time in your profile settings. If you unsubscribe, we will still send account emails like sign-in codes. We do not send marketing email from other companies.
• To understand how Roster is used, in aggregate, so we can improve it.

What is public and what is not

• Recs: a rec is public. A designer's profile shows how many recs they have and who gave them. Hiring accounts that give a rec show their name and company, without a link to a profile.
• Public: if your profile page is public, anyone can see your name, photo, headline, skills, years of experience, location, what you are open to, bio, portfolio link, and your posts. Your follower and following counts are shown too, and anyone can open the lists of who follows you and who you follow. The posts you like are not listed publicly, only the totals. Cheers are different: anyone can open a project's cheers and see who left them and which phrases they picked. You control this on your profile screen: you can make your page private, remove yourself from the homepage, or delete posts.
• Not public: your sign-in email, your contact email, and your invite details. We do not display them on your page.
• The Roster: only signed-in members (and, later, hiring accounts) can browse a directory of members with public profiles and search it by name, skill, location, and keyword. If you make your profile private, you are left out of it. We may mark some profiles as "Featured" and show them first.
• Connection requests: people with a hiring account can send you a short note through Roster. They never see your email address unless you accept. If you accept, you and the hiring manager see each other’s email. Declining tells them nothing more, and you can block them.
• Jobs: job listings on Roster, including the company name and the description, are public and can be found by search engines. If you connect with the person who posted a job, we share your note and a link to your public profile with them. They see your email only if they accept. Closed jobs stay visible but are hidden from search engines.

Who we share it with

We do not sell your personal information. We share it only with:

• Service providers that help us run Roster, such as our web hosting and email delivery. They may process data only to provide their service to us.
• Analytics: Google (Google Analytics) receives usage data about visits to our pages, as described above.
• Fonts: our pages load fonts from Google Fonts, so Google receives your IP address and browser details when a page loads.
• Spam protection: we may use a bot-check service such as Cloudflare Turnstile on signup forms. If it is turned on, it processes technical data about your browser to tell people from bots.
• Legal and safety: when we believe in good faith that the law requires it, or to protect people and Roster from fraud, abuse, or harm.
• A future owner: if Roster is ever sold or merged, your information could transfer to the new owner, which would need to honor this policy.

Cookies

Roster uses one essential cookie, roster_session, to keep you signed in. It is only set when you sign in, and it expires after 30 days or when you sign out. We also use Google Analytics cookies (such as _ga) to count visits in aggregate. We do not use advertising cookies. If you are in Europe we ask first, and anywhere you can turn analytics off at any time: stop analytics on this device.

How long we keep it

We keep your account information and content while your account is open. If you delete your account, we delete your profile, photo, posts and images, sign-in sessions, and waitlist entry. Short-lived technical records, such as hashed IP rate-limit entries, expire on their own. Backups may hold deleted data for a short time before they are overwritten. We may keep limited information if we need it to meet legal duties or to prevent someone who was removed for abuse from rejoining.

Your choices and rights

• Edit or hide: change your profile and posts, make your page private, or leave the homepage at any time.
• Delete your account: sign in, go to your profile screen, and choose Delete my account at the bottom. It takes effect immediately and cannot be undone.
• Ask us: email hello@roster.design to get a copy of your information, correct it, or have it deleted, including if you only joined the waitlist and never made a profile. We aim to reply within 30 days.
• Your rights: depending on where you live (for example California or the European Economic Area), you may have additional rights over your personal information, including access, correction, deletion, and objecting to certain uses. We honor these requests for everyone. We will not treat you differently for using them.

Security

We sign you in with one-time email links instead of passwords, store only scrambled versions of sign-in tokens, and serve Roster over HTTPS. No system is perfectly secure, so please use an email account you protect and tell us right away if you think your account was accessed without your permission.

Children

Roster is for people 16 and older. We do not knowingly collect information from anyone younger. If you believe a child has joined, email us and we will remove the account.

Where your data lives

Roster is run from the United States, and your information is stored and processed there. If you use Roster from another country, you understand your information will be transferred to the United States.

Changes to this policy

If we make meaningful changes, we will update the date above and, for significant changes, tell members by email or on the site before they take effect.

Contact

Questions or requests: hello@roster.design.