Legal

Privacy Policy

How Roster handles your data: no account or telemetry, nothing sent on Free or in the trial, a licence check with a Pro key, and a website with no cookies or analytics.

Last updated 14 October 2026

1. Who we are

Roster ("Roster", "the app", "we", "us") is a macOS application developed and published by STH Labs, the trading name of Stavros Thalassinos, a sole proprietor established in Greece (VAT/ΑΦΜ EL160320426), registered address Thesi Alonaki, Prodromos, 84400 Paros, Greece.

For the purposes of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek Law 4624/2019, Stavros Thalassinos is the data controller for the limited personal data described in this policy.

Contact for privacy matters: stavros.thalassinos@sthlabs.net. We have not appointed a Data Protection Officer: the GDPR requires one only where core activities involve large scale regular and systematic monitoring, or large scale processing of special categories of data (Art. 37), and ours do not.

2. The one sentence version

The Roster app has no account and no telemetry, sends nothing to us on Free or during the trial and only a licence check once you enter a Pro key, the coding agents you run from it talk to their own providers exactly as they do in your terminal, and this website sets no cookies and runs no visit statistics today.

3. What the app does with data

Nothing is sent to us on Free or during the trial. Roster has no account, no sign in, no analytics and no crash reporting, and it does not look for updates. Its only request of its own is the licence check below, and only once you enter a Pro key. It runs programs on your Mac on your behalf: the coding agents you configure, shells, git, lazygit and NeoVim. Some of those programs use the network themselves (section 4), and git reaches your remotes when you ask it to fetch, pull or push.

What it stores locally. Your agents and their settings, run history with each run's output, schedules, open tabs and their colours and names, the window layout, the memory budget, and a record of which lines in your projects were changed by an agent and which by you. These are files in the app data folder on your Mac, ~/Library/Application Support/com.stavrosthalassinos.roster. Environment variables you enter for an agent (which can include API keys) are stored in the macOS Keychain, one item per variable, under the Roster service name. Only the names of those variables are kept in the app data folder.

What it reads. To list your existing agents, skills and recent sessions, and to show usage, Roster reads the Claude Code configuration folders in your home folder (for example ~/.claude) and runs claude commands on your Mac. The Code tab and the git panel read the project folders you open. None of this leaves your Mac through Roster.

Licence checks, with a Pro key only. The licence panel in the app says, word for word:

  • Your key is checked on this Mac with a signature. No network needed.
  • This Mac contacts roster.sthlabs.net when you press Activate, when you remove a Mac or press Check now, and about once every 30 days. Pro keeps working offline for 30 days after the last check.
  • It sends your key, a hash of this Mac's hardware ID (never the ID itself) and this Mac's name. Nothing else is sent, and Roster sends nothing at all on Free or during the trial.

The activation server answers with a signed token that the app checks offline. For each licence, the server keeps the hashed hardware ID, the name and the activation date of every Mac using it, so it can hold the limit of 3 Macs and list them in the licence panel. A Mac's entry is removed when you deactivate it there. We use this data only to provide the licence you bought (GDPR Art. 6(1)(b)).

The trial and the licence on your Mac. The trial start date is stored in the macOS Keychain on your Mac, so reinstalling does not restart the trial. Once you enter a key, the key and the activation token are kept in the Keychain too. None of this is sent anywhere on Free or during the trial.

To remove everything Roster stored, quit the app, delete it, and delete the folder named above. Items in the macOS Keychain stay until you delete them in Keychain Access.

4. The agents you run

Roster starts coding agents such as Claude Code with your own installation and your own login. Those agents send your prompts, and the code and files they read, to their providers (for Claude Code, Anthropic) under that provider's terms and privacy policy. That traffic goes directly from the agent on your Mac to the provider. Roster adds no server in between, and we never see it. Each provider is an independent controller of the data you send it.

5. Downloading the app

The download button serves the notarized app from this website, hosted by Vercel, together with a small public file (/download/latest.json) that names the current version. As with any download, Vercel receives your IP address and request details (see "Hosting logs" in section 6). We do not receive your name or email address when you download Roster, and it needs no account.

6. What this website measures

This website (roster.sthlabs.net) is a static site hosted by Vercel. It sets no cookies and leaves nothing stored in your browser.

Visit statistics (PostHog, EU cloud). Visit statistics are not enabled on this website today. If we enable them, each page will run PostHog's JavaScript library, which sends events to roster.sthlabs.net, from where they are forwarded to PostHog's servers in Frankfurt, Germany. Your browser never contacts PostHog directly. The events are: one when you open a page, one when you click a download button, one when you open a question in the FAQ, one when you play a video, one when you leave the page, and one with page speed measurements when the page is hidden. Each event contains only: which of those it was, the page path, the website that linked you here (host name only, never the full address), the utm_source, utm_medium and utm_campaign tags of the link if it had any, whether the visit was marked as our own testing, whether you were on a Mac or another platform, which button, question or video it was, for the page leave event how many seconds you spent on the page, and for the speed event up to four numbers your browser measured (time to first and largest content, input delay if you interacted, and layout shift). Every event also carries the time it happened, the name and version of the PostHog library, the site's public PostHog project key, and a random ID for the event itself. Events from one visit share a random ID created in memory and carried in the links between pages of this site; it is never stored and a new visit gets a new one. Your IP address reaches PostHog with each forwarded request, as with any web request; PostHog is set to discard it before the event is stored and not to look up your location from it. No browser fingerprint, no name and no email. PostHog builds no profile of you. We will update the "Last updated" date when we turn this on.

Why, and on what basis. We would use these statistics to see which links bring visitors and whether the page leads them to download the app. The legal basis is our legitimate interest in understanding, in aggregate, how the site is used (GDPR Art. 6(1)(f)). You can object at any time (section 10).

Hosting logs (Vercel). Like any web host, Vercel receives your IP address and the page you requested in order to serve it, and may keep short lived request logs for security and operations (legitimate interest in running a secure website, GDPR Art. 6(1)(f)).

Fonts. The fonts are served from this website. No request goes to Google or any other font service.

Email. If you write to us, we keep the correspondence to answer you (legitimate interest, GDPR Art. 6(1)(f)).

7. Third parties

The split below follows the GDPR's own definitions. A processor acts only on our instructions (Art. 4(8)); an independent controller decides its own purposes (Art. 4(7)).

Our processors:

  • Vercel (Vercel Inc.): hosting this website and the app download, and forwarding visit statistics to PostHog if they are enabled. Privacy policy: vercel.com/legal/privacy-policy
  • PostHog (PostHog Inc.): visit statistics as described in section 6, only if enabled, stored in its EU cloud. Privacy policy: posthog.com/privacy

Independent controllers:

We do not sell personal data and do not share it for advertising.

8. International transfers

Vercel Inc. and PostHog Inc. are companies based in the United States. Both state that they are certified under the EU-US Data Privacy Framework, and both may also rely on the European Commission's Standard Contractual Clauses. PostHog would store the site statistics in its EU cloud in Germany. You can ask us which mechanism applies to a given provider.

9. How long we keep data

  • Visit statistics (PostHog), if enabled: individual events no longer than 12 months; totals derived from them may be kept.
  • Licence activations, with a Pro key only: while the licence exists; a Mac's entry is removed when you deactivate that Mac.
  • Support correspondence: up to 24 months after the issue is resolved.
  • App data on your Mac: controlled entirely by you; removed when you delete the app data folder (section 3).

10. Your rights under the GDPR

You have the right to access your data, rectify inaccurate data, request erasure, restrict or object to processing, and request data portability. In practice we hold almost nothing about you: the app sends us nothing on Free or during the trial, a Pro licence check sends only what section 3 lists, and site statistics, if enabled, carry no identifier that could be matched to a person.

Right to object. Where we rely on legitimate interest (site statistics, hosting logs and support email), you may object at any time on grounds relating to your particular situation (GDPR Art. 21).

To exercise any right, email stavros.thalassinos@sthlabs.net. We respond within one month. You may also complain to the Hellenic Data Protection Authority ( dpa.gr) or your local EU supervisory authority.

11. Children

Roster is a tool for software developers. It is not directed at children under 16 and we do not knowingly collect personal data from them.

12. Security

The website is served over TLS. The app is signed with an Apple Developer ID so macOS can confirm who built it. Your code, prompts and agent output stay on your Mac and with the agent providers you choose; they never pass through us.

13. Changes to this policy

We will update this policy if the app or the website starts handling data differently, with a new "Last updated" date. Related documents: the Terms of Use and the Refund Policy.

14. Contact

STH Labs, Stavros Thalassinos
Thesi Alonaki, Prodromos, 84400 Paros, Greece
VAT ID EL160320426
Email: stavros.thalassinos@sthlabs.net