Your roster stays yours.

Last updated 14 July 2026

Roster Dashboard turns a pilot's own schedule into a calm display for their family. A schedule reveals when a home is empty, so we treat it as sensitive and collect as little as we can get away with.

What we keep

• Your account. Email, the name your family calls you, your airline role, fleet and base, your timezone, and your pickup timing preferences.
• An encrypted link to your calendar. Your roster lives in your own calendar feed. We store the link encrypted, with the key kept separate from the database — the same goes for any optional flight-tracking tokens.
• Hashed keys, never the keys. Sign-in tokens, device keys and family-screen links are stored as one-way hashes — a database breach exposes no usable secrets.
• Billing references, not card details. Payments run entirely through Stripe. We store your plan and Stripe's IDs; your card number never touches our servers.
• Referrals. If you share Roster Dashboard, we keep a daily count of visits to your share page and — if a family joins — a private note that your account introduced theirs, used solely to thank you with extra time. Your share page itself is anonymous: no name, no email, no roster.
• Your screens. For each display: its hardware address, battery level, and when it last checked in.

What we don't keep

• Your schedule is not stored in our database. We fetch your calendar feed to draw your display and hold it in memory just long enough to render.
• No trackers. One cookie, and it only keeps you signed in. No analytics scripts, no advertising pixels, on any page.
• Nothing is sold or shared. Ever — except the services below that make the product work.

Where your data travels

• Hetzner (Germany, EU) hosts our server.
• Stripe processes payments.
• Resend delivers our emails — sign-in links, receipts, service notices.
• Flightradar24 / AirLabs answer our flight lookups. They receive a flight number or aircraft registration — public flight information, never your name or email.
• Your calendar host (e.g. Apple iCloud) is where we fetch your roster from, over HTTPS, using the link only you provided.

Keeping the service honest

We monitor our own reliability, and we'd rather tell you exactly what that means:

• Short-lived display images. While you have a flight in progress, the server periodically keeps a copy of the image your family's display shows, so we can catch rendering mistakes. These images naturally contain your flights. They're deleted automatically after 14 days, and only we can see them.
• Flight-event telemetry. Small technical records of flight events (a flight number, a date, landing timing) that tune live tracking.
• Logs that can't see your flights. Every log line passes through a filter that strips calendar links and tokens; our logs never record your destinations, times, or flight numbers — and we check that against the live server, not just the code.
• Sign-in links are single-use and expire in 15 minutes; they're stored hash-only and their records are swept within 30 days.

Backups

The database is backed up nightly, encrypted to a key whose private half never touches the server, and backups rotate out after three weeks. Deleted data can therefore linger inside an encrypted backup for up to three weeks before it ages out — that's the full extent of it.

Encrypted to the screen — and read-only

Your display fetches over HTTPS with the certificate authority pinned into the device firmware, so our server can't be impersonated even on an untrusted network. Family access is read-only: the household display and any shared link can only view — never change — your roster.

We don't track you — we track your aircraft

No phone location, no GPS, no location history of you. Live "heading home" timing works from public aircraft broadcast data for the flight you're operating, and its short-lived position cache is discarded as it refreshes.

Delete means delete

Close your account (Settings → Delete) and everything above is erased immediately — account, calendar link, devices, referral records, and your sign-in history. Monitoring images age out within 14 days, encrypted backups within three weeks. Stripe retains the transaction records tax law requires.

The honest limit

To draw your dashboard, our server reads your roster in memory each time it refreshes — so this is strong data-minimisation, not a mathematical "we can't see it." True zero-knowledge would require rendering on your own device or inside a secure enclave. If that matters to you, we're happy to talk it through.

Your rights

• See it: email us and we'll send you a copy of everything we hold about you, within 30 days — it's a short list; the "What we keep" section above is all of it.
• Fix it: name, timezone, preferences and calendar link are editable in Settings; anything else, email us.
• Delete it: self-serve, Settings → Delete, effective immediately.
• Take it elsewhere: your roster was always yours — it lives in your own calendar feed, so there's nothing to export back. Account data comes with the copy above.

Who we are

Roster Dashboard is operated by AERONOSTOS FOR COMPUTER SYSTEMS & COMMUNICATION EQUIPMENT SOFTWARE DESIGN ("Aeronostos"), registered in Dubai, United Arab Emirates — the data controller for everything described here.

Changes and questions

If this policy changes in a way that matters, we'll email you before it takes effect. Questions or any request above: go-around@rosterdashboard.com.