Last updated: October 2026
| Name | What it does | Duration |
|---|---|---|
| roost_session | Keeps an operator (or a client's opened magic link) signed in. It contains a random session identifier only — no personal data in the cookie itself. | 7 days (operators) / up to 90 days (client devices), or until logout or revocation |
This cookie is strictly necessary — the service cannot function without it, so it does not require consent banners under GDPR and similar frameworks. It is set with HttpOnly (invisible to scripts), Secure (HTTPS only), and SameSite=Lax.
When a homeowner, family member, or vendor opens a report or invoice link, they are not creating an account or password. The same session cookie keeps their device recognized until it expires or the operator revokes it. Revoking a client kills their device session instantly.
Our website currently loads web fonts from Google Fonts, which means a request goes to Google's servers when you first visit (your IP is visible to Google in that request). We are replacing this with self-hosted fonts so the site makes zero third-party requests. No other external service sees your visit.
Emails we send (verification, report links, invoices) include basic delivery/open information so operators can tell whether a client received their report. We do not embed advertising pixels in emails and do not sell engagement data.
Because the only cookie is strictly necessary, there is nothing to opt out of without breaking sign-in. You can clear it any time in your browser settings (this logs you out). Do Not Track and Global Privacy Control signals are respected in that we never track you across sites regardless.