What this site sends

The short version: your class list stays on your device unless you switch on sync, which is off until you ask for it. Here is the complete, checkable list of network activity on rosterowl.com.

What the site loads

• Its own pages, code, icons and six font files (three for the screen, three for building your PDFs) — all served from rosterowl.com. No CDNs, and no third-party code beyond the two measurement tools described below.
• Cloudflare Web Analytics (a script called beacon.min.js), which counts page loads and page-speed measurements. It sets no cookies, does not follow you between sites, and cannot see anything you type. It needs no permission because it collects nothing that identifies you.

What the site sends — with sync off

This is the default, and it is what happens until you sign in. Nothing changes it by accident.

• Nothing containing your data. After the page loads, the tools work entirely inside your browser. Student names, rules, absences, job rotations, word lists and charts are processed on your device and stored in your browser's local storage.
• A page-view ping to Cloudflare containing the address of the page, the referring page, and general details of your browser and country. No names, no roster, no identifiers that follow you around.

Sync, if you switch it on

Sync exists for one situation: you started a chart at school and want to finish it at home. It is off unless you sign in, and signing in is something you have to go and do — there is no prompt, no wall, and no reminder. Everything on this site works without it.

Once it is on, here is exactly what changes, stated plainly:

• Your class list is uploaded. The same document your browser stores — class and room names, your students' names, seating, keep-apart rules, absences, jobs and word lists — is sent to rosterowl.com and stored in a Cloudflare database so your other computer can fetch it. It is stored as ordinary text, which means we are technically able to read it. We do not, and nothing in the site is built to, but you should choose knowing that rather than trusting a promise.
• We ask Google who you are, and nothing else. Signing in uses your Google account with the narrowest possible permissions: your account identifier and your email address. No Drive, no contacts, no calendar, no profile. RosterOwl never sees your Google password.
• A sign-in cookie appears. One cookie that JavaScript cannot read, used only to recognise your browser on the next visit. It is not an advertising cookie and is not shared with anyone.
• You can undo it. "Delete cloud copy" in the sync menu erases the stored document. "Sign out of sync" stops the uploading. Either way the classes on the device in front of you are untouched — sync is a copy, never the original.

Google Analytics — only if you say yes

Cloudflare's counter tells us how many people opened a page. It cannot tell us whether they got what they came for — whether someone who opened the seating chart actually finished a chart and printed it. That is the question that decides what gets built next, so this site also offers Google Analytics. It is the one thing here that sets tracking cookies, so it is the one thing here that asks first.

• Nothing loads until you accept. Not the script, not a cookie, not a single request to Google. This is stricter than the usual "consent mode" arrangement, which loads Google's tag immediately and merely tells it you said no. If you decline, or ignore the bar, your browser never contacts Google at all — you can confirm that in the Network tab.
• What it collects if you accept. Pages viewed, how you arrived, rough location by country, device and browser type, and which tools get used. Two cookies (_ga and _ga_…) let it recognise a repeat visit.
• What it never collects. Your class list. Student names, rosters, rules, absences and charts live in the part of the site that never talks to Google, and no event this site sends carries any of them. Ad personalisation and Google Signals are both switched off in the configuration.
• Changing your mind. Either answer is remembered on this device, and you can switch at any time: ask me again.

What we do with your Google account data

This section is the disclosure Google requires of any app that offers Google Sign-In, and it applies only if you choose to sign in.

• What we request. Two things, and nothing else: the openid scope, which gives us a stable identifier for your account, and the email scope, which gives us your email address. We do not request access to Drive, Gmail, Calendar, Contacts, Classroom, your profile photo, or anything else — and because we never request them, we could not read them even if we wanted to.
• How we use it. Solely to recognise that the person signing in on your home computer is the same person who signed in at school, so we can hand you back your own class list. Your email address is used to show you which account you are signed in as. It is not used for marketing, and RosterOwl sends no email.
• How we store it. The account identifier and email address are stored in our database alongside your synced document. The sign-in session itself is stored only as a one-way hash, so even a copy of our database would not let anyone sign in as you.
• Who we share it with. Nobody. Google account data is never sold, never shared with third parties, never used for advertising, and never transferred except as required to operate the sync feature you asked for. RosterOwl has no advertisers, no data partners and no analytics tied to your identity.
• How to delete it. "Delete cloud copy" in the sync menu removes your stored class list immediately. To remove your account record and email address as well, ask us and we will delete it. You can also revoke RosterOwl's access entirely from your Google account permissions page, which severs the connection from Google's side.
• How long we keep it. For as long as you keep using sync. Sign-in sessions expire on their own, and a deleted cloud copy is gone at once rather than retained in a backup that outlives your request.

RosterOwl's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The browser enforces the boundary, not just us

Every page is served with a Content-Security-Policy header that limits where this site is allowed to send anything at all — to rosterowl.com and the analytics endpoint, and nowhere else. If our own code ever tried to post a class list to a third party, your browser would block the request. That was true before sync existed and is still true now: what sync changed is that rosterowl.com itself receives your document when you have signed in, and only then. You can read the policy yourself in the Network tab, under the response headers for any page.

How to verify this yourself

1. Open your browser's developer tools (F12) and switch to the Network tab.
2. Load the seating chart tool, paste a class list, shuffle, download a PDF.
3. Watch the requests: signed out, apart from the page itself and the Cloudflare page-view ping, nothing leaves — and nothing that leaves carries your data. Then try it with your Wi-Fi off; the tools keep working.
4. Signed in, you will additionally see requests to /api/doc on rosterowl.com. That is your class list going to and from your own account, and it is the only thing sync sends.
5. If you accepted analytics you will also see googletagmanager.com and google-analytics.com. Decline instead, and those two never appear.

If this ever changes

Nothing else gets added without appearing here first, in the same deploy that adds it. This page is the contract. If you find it out of date, that's a bug worth reporting.

Backups

"Save backup file" downloads your data to your own computer as a plain JSON file you control. Restoring reads that file locally. It is never transmitted anywhere, whether or not sync is on — and it remains the way to keep a copy that depends on nobody.

Schools and districts

If you're evaluating RosterOwl for a school, the distinction that usually matters is this: used as it comes, RosterOwl stores no student data outside the teacher's own device. Sync is the one feature that changes that, it is opt-in per teacher, and it can be switched off and its stored copy deleted at any time. The FERPA and COPPA summary is on the about page, and we're happy to complete a vendor questionnaire — just ask.