Privacy
Updated 10 September 2026
SeatRoster is designed for organizations that coordinate shared workplace seating. An organization administrator invites members and determines the organization’s seating rules.
Information kept
A global account contains your name, verified email, language preference, selected emoji avatar and background color, and a password credential stored only as a memory-hard scrypt hash. Each organization separately controls your role, primary team, and policy-group memberships. Booking requests contain the organization, location, date, period, status, original request time, and assigned seat where applicable.
Information not kept
SeatRoster’s account and booking database does not store profile photos, phone numbers, titles, IP addresses, device profiles, behavioral profiles, personal calendar data, readable passwords, or free-text audit payloads. Cloudflare separately processes network and diagnostic information to operate and protect the service.
Notifications
You can choose email, the app inbox, or both for booking changes. Essential account emails are always sent. Inbox updates are kept for up to 90 days and are visible only while you have access to the organization. When you enable iPhone push alerts, SeatRoster stores an Apple delivery token tied to your account and session. Apple receives a generic alert without booking details. Signing out revokes that session’s push registration; expired registrations are removed. Tokens are used only for delivery, not tracking.
Service providers
Cloudflare hosts the service and database and processes network requests to operate and protect it. Cloudflare Email Sending delivers account and optional booking emails using the recipient address and message content; SeatRoster does not add email open or click tracking. Apple delivers iPhone push alerts. Cloudflare Email Routing forwards messages sent to our support address to the developer’s mailbox. Support correspondence is separate from booking records. When you set a password, a five-character hash prefix is checked against the Pwned Passwords service; your password and email address are not sent to that service. Cloudflare keeps operational request and error logs for up to seven days. Minimal account-linked audit events record booking and administrative actions for security and service operation. SeatRoster does not sell personal data or use it for advertising or cross-app tracking.
Delete your account
In the iPhone app, open Account, then Delete account. Enter your current password and confirm. This deletes your identity, memberships and bookings across all organizations and releases your seats. If you are the only owner, first appoint another owner in Administration → People. Contact support if you cannot access your account. Operational backups are handled separately by the hosting provider.
Visibility and waitlists
Your organization chooses whether allocated colleague names or availability only is shown. Waitlist names are never exposed. Administrators have an operational list, not an employee analytics dashboard.
Retention
Completed bookings are anonymized when the booking date is more than 90 days old; cancelled requests are anonymized 90 days after cancellation. Minimal audit events—actor, action, target type, and timestamp—are deleted after 90 days. Removing a member cancels future requests and revokes active sessions. A global account is deleted when no organization memberships remain.
Contact
Questions about an organization’s membership or seating policy should first go to that organization’s administrator. Product privacy questions may be sent to support@seatroster.com.