Privacy policy

Last updated October 14, 2026

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is the operator of RosterFrame named in our legal notice. During the free beta, the operator's name and contact details are being added there.

2. Photos and rosters stay on your computer

When you import photos or a roster into RosterFrame, everything is processed inside your web browser and saved in your browser's storage on your device (IndexedDB). Composites and memory mates are rendered on your device as well. We never receive, see or store your photos, the names of the people in them, or your designs. You can delete a job, with all its photos, from the app at any time; clearing your browser's site data for rosterframe.com also removes everything.

Because team photos often show children, this matters: RosterFrame does not collect any information from or about the people in your photos.

3. Visiting the website (hosting)

Our website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, acting as our processor. To deliver pages and protect them from attacks, Cloudflare processes technical data such as your IP address, browser type and the time of the request. We do not use these logs to identify you or for marketing.

Legal basis: our legitimate interest in a secure, working website (Art. 6 (1) (f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework, which covers the transfer to the US.

4. Anonymous visit counter

To see whether the beta is useful, we count events: a page was viewed, the app was opened, a job was created, the sample team was tried, how many photos were imported and how many files were exported. When you arrive from another website, we also count the name of that website (for example "reddit.com"), not the full address.

For each event we store only its name, the date and a running total. We do not store IP addresses, cookies, device identifiers, your photos or anything else that could identify you or link visits together, and the counter does not read or save anything on your device. Legal basis: our legitimate interest in knowing whether RosterFrame is useful (Art. 6 (1) (f) GDPR). The counter runs on our Cloudflare hosting described above.

4a. Activating Pro (after the beta)

When you click "Activate", the app sends your licence key and the fixed label "RosterFrame" to our server, which asks Lemon Squeezy whether the key is valid and registers this computer as one of your two allowed activations. We do not keep a copy of this request. Your browser then stores the key locally so Pro stays unlocked.

Legal basis: performing our contract with you (Art. 6 (1) (b) GDPR). Without the check, Pro can't be unlocked.

5. Buying Pro

Purchases are handled by Lemon Squeezy (Lemon Squeezy LLC, a Stripe company), which acts as reseller and merchant of record. Lemon Squeezy collects your name, email address, billing country and payment details to process the payment, send the receipt and licence key, and meet tax rules. It does this as an independent controller under its own privacy policy. We receive your name, email address and order details from Lemon Squeezy so we can support you and handle refunds. We keep these for as long as tax and commercial law requires (in Germany up to 10 years for accounting records).

6. Emailing us

Once contact details are published and you email us, we use your email address and message only to answer you (Art. 6 (1) (b) or (f) GDPR) and delete the conversation when it is no longer needed, unless the law requires us to keep it.

7. Cookies and storage on your device

We set no cookies. The app stores your jobs and, if you have Pro, your licence key in your browser. This storage is strictly necessary for the service you asked for, so no consent is required (§ 25 (2) no. 2 TDDDG). Details are in our cookie and storage policy.

8. No tracking, no selling

Apart from the anonymous counter described above, we do not use analytics, advertising, social media plugins, embedded videos or any other third-party scripts. We do not sell or share personal information, and we do not build profiles. Because we don't track you, "Do Not Track" and Global Privacy Control signals have nothing to switch off, but we respect them.

9. Your rights

You have the right to access your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format (Art. 15–21 GDPR). Contact the operator through the details in our legal notice to use any of these rights. You can also complain to a data protection supervisory authority, for example the one where you live or the one responsible for us in Germany. If you live in California or another US state with a privacy law, you have similar rights to know, delete and correct your information, and we will honour them the same way.

10. Children

RosterFrame is a tool for photographers and is not directed at children. We do not knowingly collect personal information from children under 16.

11. Changes

If we change how RosterFrame handles data, we will update this page and the date at the top.