Roost Mobile Privacy Notice

Effective Date: 30 September 2026 Last Updated: 30 September 2026

This notice covers DiscoverWorthy Roost for Android and iPhone ("Roost Mobile"), the phone companion to the Roost desktop app. It sits alongside our Privacy Policy and adds to it. Everything in that policy still applies; where this notice is more specific about the phone app, this notice governs.

It exists because Roost Mobile carries things the rest of the platform doesn't: what your coding sessions are doing on your own computer, and the messages you send them from your phone.

1. What the phone app handles

Your sign-in. Roost Mobile signs in a DiscoverWorthy account you already have; it never creates one. It uses your email address to send you a six-digit sign-in code, and keeps the session token we give the phone once you've signed in. The token is kept in the phone's secure storage (the Android Keystore, or the iPhone Keychain) and is removed when you sign out.

This phone's registration. When you sign in, the app gives the phone a random identifier of its own (not your phone's hardware ID or advertising ID), and registers it with your account together with the kind of phone (Android or iPhone) and, if you allow notifications, a push token. That is how your desktop knows where to send a notification.

Your fleet. The Roost desktop app on your own computer uploads a short status report: the names of your projects, the labels of your coding sessions, whether each needs you, the last few lines of each conversation, screenshots you ask for, and counts from git (files changed, commits not yet pushed). The phone reads this report and shows it to you. It is not written by the phone, and the phone keeps no copy after the app closes.

Messages you send. When you type a message to a session, start a new one, or stop one, that instruction is stored against your account until your desktop picks it up and answers it. Your desktop then passes it to the coding session running on that computer, the same as if you had typed it there.

Project names are often your clients' names, and conversations can contain your clients' material. We treat all of it as yours: we store it for Roost to work, and we don't use it for anything else.

2. What it doesn't do

No advertising, and no tracking across other apps or websites.
No analytics or crash-reporting services.
No location, contacts, photos, camera or microphone. The app asks for none of them.
Nothing leaves the phone in the demo. "Try the demo" runs a pretend studio built into the app. It makes no network calls and never registers for notifications.

3. Notifications

Notifications are delivered by Google's Firebase Cloud Messaging on Android and Apple's Push Notification service on iPhone. Because they pass through Google or Apple, they are deliberately content-free: they say things like "A session is waiting on you — open Roost", never a project name, a client's name or anything from a conversation. The detail is fetched over an encrypted connection when you open the app.

You can turn notifications off at any time in your phone's settings. Everything else keeps working.

4. Who else is involved

Microsoft Azure (Australia) stores your account, this phone's registration, the fleet report and your messages, as it does for the rest of DiscoverWorthy.
Google (Firebase Cloud Messaging) and Apple (Push Notification service) deliver notifications, as above.
Google Play (Android) tells the app when a newer version is out. On iPhone the app asks the App Store for the latest version number of Roost itself; nothing about you is sent.
Your coding assistant. A message you send from the phone is passed by your desktop to the coding session on your computer (for example Claude Code, made by Anthropic), under your own account with that provider and its own terms. Roost doesn't send it anywhere else.

We don't sell your information, and we don't share it with anyone for their own purposes.

5. How long it's kept

The fleet report is replaced each time your desktop uploads a new one.
A phone's registration is kept until you delete your account. Signing out clears its push token straight away, so a signed-out phone gets no notifications.
Messages you send from the phone, and their replies, are kept with your account until you delete it or ask us to remove them.

All of it is sent over encrypted (HTTPS) connections.

6. Deleting your account

To delete your DiscoverWorthy account and everything Roost holds for it (this phone's registration, the fleet report and your messages), email support@discoverworthy.com from the address you sign in with and ask for your account to be deleted. We'll confirm when it's done, within 30 days. If you only want the phone's messages cleared, say so and we'll clear just those.

Uninstalling the app deletes everything it keeps on the phone.

7. Questions

Email support@discoverworthy.com. Roost Mobile is made by Discover Worthy Pty Ltd, and this notice is part of our Privacy Policy.