Privacy Policy
Last updated October 23, 2026
FreeRoster (“FreeRoster,” “we,” “us”) is free staff scheduling, operated by Brobata, LLC. Managers build the schedule at freeroster.com; staff read it in the FreeRoster app. This policy covers both, and explains what we collect, why, and the choices you have.
What we collect
Your account. Your email address, name and phone number. If you sign in with Google or Apple, we receive your name and email from them, nothing else. If you set a password, it is stored hashed by our authentication provider; we never see it.
Your phone number. We ask for it so the owners and managers of the teams you are on can reach you about the schedule. It is shown only to them, never to other staff, and it is never used to sign in, for marketing, or shared with anyone else. You can change it in the app under Settings, Account.
Schedule information.What your team puts into FreeRoster to run the schedule: shifts, roles and positions, the days you can't work, time-off requests and the notes on them, and your manager's approvals. Managers may also add staff details used for planning, such as a phone number, hire date and pay rate. Pay rates are visible only to the team's owners and managers, never to other staff.
Your device. If you allow notifications in the app, we store a push token for your device so we can tell you when the schedule is posted or a request is decided. We also keep sign-in tokens so you stay signed in. The web app uses privacy-friendly, cookie-free page-view counts (Vercel Web Analytics).
Time clock punches. If your team uses the time clock (part of LineCheck), we record each clock-in, clock-out and break: when it happened, who recorded it, and any fix a manager makes, with their reason. Punches are never edited or deleted in place; a fix is added as a new entry so the record stays trustworthy for you and your employer.
Location, only at the moment you punch.If your manager turns on the location check, the app asks your phone for its location when you tap clock in or out, compares it with where work is, and sends us only the answer (“at work,” “not at work,” or “couldn't tell”) and how accurate the reading was. Your coordinates never leave your phone, we never track you in the background, and a punch is never refused because of where you are. You can deny location access; the punch still goes through.
We do not collect contacts, photos or files, we do not track your location, and there are no ads or advertising trackers in FreeRoster.
How we use it
- To run the service: sign you in, show you your team's schedule, deliver requests to your manager and decisions back to you.
- To send the emails and notifications the service depends on: sign-in codes, invites, schedule updates.
- To keep it working: diagnosing errors and preventing abuse.
We never sell your personal information and we don't use it for advertising.
Who can see it
Only the people on your team, according to their role: staff see their own shifts, time off and punches; supervisors and team leads also see the team's schedule; owners and managers see what they need to run the team. This is enforced in the database itself (row-level security), not only in the app. Brobata staff access your data only to support you or when the law requires it.
Service providers
We use a small number of providers to run FreeRoster. They process data only on our instructions:
- Supabase: database and authentication (United States).
- Vercel: hosts freeroster.com.
- Resend: delivers sign-in codes and invite emails.
- Google: Firebase Cloud Messaging delivers push notifications to Android devices; Google Sign-In, if you choose it.
- Apple: Sign in with Apple and Apple Push Notification service, if you use an iPhone.
- Anthropic: Claude, an AI assistant our team uses when we fix a problem, answer a support request, or check that the service is working properly. While doing that work it can process the same data our staff can see.
Keeping and deleting your data
We keep your account for as long as you use it. You can delete it at any time, in the app under Settings → Delete account, on the web under Settings, or by email. See Delete your account for exactly what is removed and what stays with the team.
Starting November 8, 2026, we delete a workplace nobody uses: one with nothing in it after 30 days without a visit, one with no members left after 30 days, or any other after 6 months without a visit (signing in or using the website or the app counts). This also deletes the account of anyone it leaves with no other workplace. A workplace with a team, a schedule or a paid plan is never deleted this way.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it by writing to support@brobata.com. Residents of California (CCPA/CPRA), the EEA and the UK (GDPR) have these rights by law, and we extend them to everyone.
Security
Data is encrypted in transit (TLS) and at rest. Access is limited by role at the database layer. If we ever discover a breach affecting your data, we will tell you by email within 72 hours of confirming it.
Children
FreeRoster is a workplace tool for adults. We do not knowingly collect information from children under 13. If you believe a child has given us information, contact us and we will delete it.
Changes
If we change this policy in a way that matters, we will update this page and email account holders at least 14 days before the change takes effect.
Contact
Brobata, LLC, Austin, Texas. support@brobata.com