Last updated: 16 September 2026
What Roster knows about you, why it needs each piece, and what happens to it. It describes how the site works today.
Roster is operated from New Zealand. The contact address for anything on this page is rosterplatform@gmail.com.
You need to be 13 or older. You confirm this when you sign up. Roster does not verify anyone's age and has no parental consent process — the confirmation is your word, and that is all it is.
The date at the top is how changes are announced. If it has moved, something here has been reworded. There is no email notice.
Roster does not ask which part of the world you are in. When you sign up, it reads the rough location that comes attached to your internet connection and saves a single region against your account — something like “Oceania” or “Europe”. Your address itself is not saved.
It works this way because some regions can only be searched by people inside them. If you could simply pick a region from a menu, that protection would mean nothing.
The colour behind your initials is picked at random when your account is made. You are not asked for it and it says nothing about you.
Only you, and anyone whose request for that game you have accepted. Accepting a request for one game does not hand over your gamertag for any other game — each one is asked for and granted separately.
A gamertag is never included in search results or on a public profile. Someone who has not been granted it is not sent it at all, so there is nothing hidden in the page for them to uncover.
Roster stores the messages you send and receive in its database, so they are there when you come back. For each conversation it also keeps who started it, whether it was accepted or declined, and when each of you last read it. Your Allow message requests setting is stored with your profile.
Messages travel to Roster over an encrypted connection, but they are not end-to-end encrypted. They are kept in Roster's database in a form Roster can read, so don't send anything you would not want stored.
Only the two people in a conversation can see it through the site. The person who runs Roster does not browse conversations. The one exception is a report: if you or the other person report someone from a conversation, the person who runs Roster can read that conversation, up to the moment the report was sent, to decide what to do about it.
Messaging is separate from gamertags. Accepting a message request does not share your gamertag with anyone, and nothing about messaging reveals one.
Roster sets cookies for one reason: remembering that you are signed in so you are not asked for your password on every page. There are no advertising or tracking cookies, and no analytics or tracking code of any kind anywhere in the site.
Roster is built on two outside services. Neither is given your information to use for their own purposes — they are the filing cabinet and the shopfront.
Supabase and Vercel may process technical information and service logs needed to operate, secure, and troubleshoot Roster. Their handling of that information is governed by their own privacy policies. Message content is stored in Roster's own database, as described under Messages above.
Roster Pro is bought once, and only if you choose to. A free account never reaches Stripe at all.
The payment itself happens on Stripe's own checkout page, on Stripe's own address. Your card number, its expiry and the security code are typed there and go to Stripe. Roster never receives them, so there is nothing about your card for Roster to keep.
When you start a purchase, Roster tells Stripe:
When Stripe tells Roster the payment succeeded, Roster records:
Stripe is the payment processor and handles your card details under its own privacy policy and its own obligations as a payment company. Roster cannot see them, and holds no card details of any kind.
Roster does not currently automatically delete inactive or abandoned accounts. Your information remains stored while your account exists. You can delete your account at any time through Settings or by contacting rosterplatform@gmail.com.
You can delete your account whenever you like, from Account settings. There is a confirmation step, and no waiting period.
Deleting your account removes your login, profile, games, gamertags, social links, requests, messages, saved profiles, and blocks from Roster's current database. Requests you had sent to other people disappear from their Requests pages too, and every conversation you were in is deleted for the other person as well — both sides of it.
If you delete your account, your username may remain permanently reserved so it cannot be used by another account. It will no longer represent an active Roster profile.
One thing deletion does not undo: anything someone has already seen — a gamertag you gave them, or a message they read. They have seen it, the same as if you had told them in person.
We don't keep backups of the database. When you delete your profile or your account, that data is removed and no copy is kept in a backup of our own. If this changes, this page will be updated to say how long deleted data stays in a backup.
Email rosterplatform@gmail.com with any question about your information, including if you want a copy of it or want something corrected.
Roster is operated from New Zealand and is subject to the New Zealand Privacy Act 2020. Under that Act you can ask for a copy of the personal information we hold about you, and ask us to correct it if it's wrong — email us at rosterplatform@gmail.com and we'll respond within 20 working days.
Roster's website and database are hosted by service providers whose servers are located outside New Zealand, which means your information is stored overseas.
If a privacy breach occurs that could cause you serious harm, we will notify you and the Office of the Privacy Commissioner.