Privacy Policy

1. Who we are, and whose data it is

Roster is provided by Charky Labs Pvt Ltd (CIN U58200TZ2024PTC033012, GSTIN 33AAMCC2561R1Z6), 4 Thendral Nagar, Vilankurichi P.O., Coimbatore 641035, Tamil Nadu, India.

Two roles, and the difference matters. For the workday data people record in Roster, the organisation they work for decides what is recorded and why; it is the data fiduciary (the controller) and we process that data on its behalf. For account, billing and website data, we are the data fiduciary ourselves.

If you use Roster because your employer does, your employer is the first place to ask about your workday data. You can also write to us and we will help, or pass your request to them.

2. What we collect

• Account: your name, work email, organisation, team, position and who you report to.
• Your workday: check-in and check-out times, breaks and their stated reason, meetings, offsite time, leave requests and their reasons, away time and your explanation of it.
• Your work: tasks, plans, which task you pinned and for how long, progress, standups, end-of-day reports and the scores and badges Roster works out from them.
• Team chat, where your plan includes it: messages, mentions and when they were read.
• Which Roster app you use (web, desktop or Android), its operating system and when it was last active, so colleagues can see where you are signed in.
• Your Roster character (the illustrated figure on your profile), if you customise it.
• Billing, for admins who pay: billing name and address, GSTIN, the plan and number of people. Card, UPI and bank details go to Razorpay and never reach us.
• Tasks an admin imports from a spreadsheet. The file itself is read in the admin’s browser and is not uploaded; only the tasks it creates reach us.

3. What the apps read from your device

The desktop app reads one number from your computer: how many seconds have passed since the keyboard or mouse was last used, which is how Roster notices away time. It never reads which keys were pressed, what is on the screen, which windows are open or where the pointer goes.

The Android app uses notifications for reminders you turn on. It does not read your location, contacts, photos or other apps.

4. Who can see what

• You see your own day, tasks and history.
• Your managers (the people you report to, up the line, and your department head) see your day, your task history and your reports. Your teammates see whether you are working, on a break or away, and your character, but not your detailed day.
• Your organisation’s admins can see and manage everything in the organisation.
• Chat messages are seen by the people in that team’s room.
• Standups and reports your organisation chooses to post to Discord are sent to the Discord channel your organisation configured.
• We access an organisation’s data only to provide support you ask for, to keep the service secure, or where the law requires.

5. Why we hold it, and for how long

We hold this data to provide Roster under the organisation’s agreement with us, to secure the service and to meet legal duties such as tax records.

Data stays while the organisation’s account is open. Chat follows the retention period the organisation sets. When an account is closed, its data is deleted within 30 days. Invoices and payment records are kept as long as Indian tax and company law require.

6. What we never do

• We do not sell data or share it for advertising.
• This website runs no analytics, advertising cookies or tracking pixels. It uses one cookie to keep you signed in, and your browser’s local storage for preferences.
• We do not send your data to AI models.
• We do not use one organisation’s data for another.

7. Who processes it for us

• Amazon Web Services, in Mumbai, India: the database, files and the app downloads.
• Vercel: serves the website and web app, from its Mumbai region.
• Razorpay: payments and invoices.
• Resend: sends sign-in and invitation emails.
• Discord: only if your organisation connects it, to receive the posts it chose.

8. Where it is stored, and how it is protected

Roster’s data is stored in India. It is encrypted in transit, access within the company is limited to the people who run the service, and each organisation’s data is kept separate in the database.

9. Your rights

Under India’s Digital Personal Data Protection Act and similar laws, you can ask to see your data, correct it, have it erased where the law allows, and nominate someone to act for you. For workday data, the request goes to, or through, your organisation (§1).

Write to privacy@character.xyz. We reply within 15 days.

10. How to complain

Our Grievance Officer is Zeno Saviour, at privacy@character.xyz, +91 72005 80713, or by post at 4 Thendral Nagar, Vilankurichi P.O., Coimbatore 641035, Tamil Nadu, India. We acknowledge within 24 hours and resolve within 15 days. You may also complain to the Data Protection Board of India.

11. Children

Roster is a workplace tool for adults and is not meant for anyone under 18.

12. Changes

When this policy changes materially, the date above changes and account admins are told by email before it applies.