Privacy Policy

RoleFull helps organizations coordinate members, events, and role sign-ups. This policy explains what personal information we collect when you use RoleFull, why we collect it, how long we keep it, and the choices you have. We wrote it to be short and plain, not to hide behind legal language.

Information we collect

• Account info. When you sign up, we store your name, email address, and (if you create a password) a one-way hash of that password. If you sign in with Google, we also store your Google account ID and profile photo.
• Organization membership. The organizations you belong to, your role within each (owner, admin, member, etc.), and any badges an admin has assigned to you.
• Activity data. Events you sign up for, roles you fill, check-ins, and notifications you receive. Admins of your organization can see this activity for their org.
• Integration tokens.If an admin connects a Google Calendar integration, we store the OAuth refresh token needed to create and update calendar events on the org's behalf. These tokens are scoped to calendar access only.
• Discord connection.If you connect your Discord account, we store your Discord user ID and display name, plus an encrypted OAuth token. Organizations that use the Discord integration get a private channel per event, and we use that token to add you to the organization's Discord server and to that channel when you are an event lead or a confirmed participant. The token is scoped to identifying you and adding you to servers. It does not let us read your messages or see the other servers you belong to. Connecting is optional and you can disconnect at any time.
• Session cookies. We set a session cookie so you stay signed in. We do not use advertising or cross-site tracking cookies.

How we use it

We use the information above only to operate RoleFull: to authenticate you, show you the events and tasks relevant to your organization, send you notifications you've opted into, and keep the platform working. We do not sell personal information, and we do not use it to train machine-learning models.

Who we share it with

We share data only with vendors that help us run the service:

• Vercel: hosts the application and receives standard request logs.
• Neon: hosts our database.
• Google: provides sign-in and, for organizations that opt in, the Calendar integration.
• Discord: for organizations that opt in, hosts the per-event channels and receives the membership changes needed to keep them in sync.
• Email provider: delivers transactional emails (sign-up confirmations, password resets, notifications).

We share data with each vendor only to the extent needed for them to provide their service. We do not share data with advertisers.

How long we keep it

We keep your account data until you delete your account. When you delete your account, we remove your profile, sign-ups, and personal identifiers within 30 days. We may retain anonymous, aggregated statistics (for example, total event counts) indefinitely. Backup copies are overwritten on a rolling schedule.

Your choices and rights

You can, at any time:

• Access and update your profile from your settings page.
• Delete your account, which removes your personal data from our systems as described above.
• Turn off email notifications in your notification preferences.
• Disconnect Google sign-in by removing RoleFull from your Google account permissions.
• Disconnect Discord from your settings page, which deletes the stored token and stops us adding you to any further channels. You can also revoke access from your Discord authorized apps. Disconnecting also revokes your access to the event channels you were added to. You can leave those channels in Discord yourself at any time as well.

If you are in the EU, UK, or California, you also have the right to request a copy of the personal information we hold about you, to ask us to correct or delete it, and to object to certain uses. Contact us at privacy@rolefull.com and we will respond within 30 days.

Google API data

RoleFull's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to create and manage events on behalf of the organization that connected the integration, and we do not transfer this data to third parties except as necessary to provide that functionality.

Security

We protect your data with standard measures: TLS in transit, encryption at rest on managed infrastructure, hashed passwords, and access controls limiting who on our team can view production data. No system is perfectly secure, but we work to address vulnerabilities promptly.

Children

RoleFull is not directed to children under 13. If you believe a child under 13 has created an account, contact us at privacy@rolefull.com and we will delete it.

Changes to this policy

If we make material changes, we will update the effective date at the top of this page and, for significant changes, notify you by email. Continued use of RoleFull after the effective date means you accept the updated policy.

Contact

Questions about this policy or your data? privacy@rolefull.com