Support desk privacy notice
Last updated 10 November 2026
This notice covers the Rootiest support desk at support.rootiest.dev, including tickets opened from the Rootiest Status Android app. The status page and the Rootiest Status app have their own notices.
In short: we keep your name, email address and the tickets you write so we can answer them. Emails to you contain a link, never your message. Tickets are kept until you ask us to delete them.
There are no ads, no analytics and no tracking, and we never sell your data.
Who is responsible
Chris Laprade, who runs Rootiest, is responsible for the support desk and the personal data described here. To contact us about your data, see Contact.
What we collect and why
Your account
When you sign in with RootiestID, it sends us your RootiestID identifier, display name, email address and group memberships. We keep your identifier, name, email address and when you first and last signed in, so we can show you your tickets and email you about replies. We use your groups to decide which services you can open tickets about. We don't store them.
Your tickets
We keep everything you write in a ticket: its subject, category, the service it's about, its importance and every message, along with when each was written, the ticket's status and whether you want email about replies. Only you and Rootiest staff can open your tickets. Staff may add internal notes to a ticket to help answer it, and you won't see those.
Without a RootiestID
If you write to us with the email form instead, we ask for your email address, your name and your message. Nothing is opened as a ticket until you use the link we email you. Until then, the request waits on our server for up to 24 hours and is deleted after 48 hours if unused. We also keep your IP address with the request for those 48 hours, to limit how many requests can come from one place. Our log notes each request with your IP address and your email address's domain (for example example.com), not the whole address.
Once confirmed, your tickets work like anyone else's. If you later sign in with a RootiestID whose verified email address matches, your tickets move to that account.
Emails we send you
When staff reply to your ticket, and you've left email notifications on, we email you a link to the ticket. The email never contains your message or ours. Without a RootiestID, the links we email sign you in for up to 7 days. We send email through Resend, an email delivery service in the United States, which receives your email address and the email itself. We keep a record of each email and notification for 30 days after it's delivered, so failed ones can be retried.
Notifications to staff
When you open a ticket or reply, staff get a push notification through our own notification server. It contains the ticket's subject only, never your message.
The Android app
If you use the support desk from the Rootiest Status app, it registers a random push address with your account so we can tell the app about replies. The push says only which ticket changed. The address is deleted when you sign out in the app, or when the app hasn't renewed it for 30 days.
Cookies and logs
Signing in sets one cookie, which keeps you signed in for 8 hours. It is needed for the desk to work, and we use no other cookies. When you sign in, our server logs your RootiestID identifier. The log is limited in size, so older lines are deleted automatically. Our web server keeps no access log for the support desk.
Legal basis
For visitors in the EU, UK and similar jurisdictions: we process your account and ticket data to answer the requests you send us (GDPR Article 6(1)(b)). We keep IP addresses, logs and rate limits because of our legitimate interest in protecting the desk from abuse (Article 6(1)(f)).
Who else receives it
- Rootiest staff, who answer tickets.
- Resend, which delivers our emails. It receives your email address and the email, which contains only a link.
- Backblaze, which stores our backups. They are encrypted on our server first, so Backblaze cannot read them.
- Our hosting provider, which runs the hardware our servers use. We run the servers and the desk ourselves.
We don't share your data with anyone else, except where the law requires it.
Where the data is kept
The support desk runs on servers we rent in Buffalo, New York, with a standby copy in Ashburn, Virginia, in case the first fails. If you write to us from outside the United States, your data is transferred to and stored there. Backups go to Backblaze B2 in the eastern United States.
How long we keep it
- Your account details and tickets: until you ask us to delete them.
- Unconfirmed email requests and their IP addresses: 48 hours.
- Records of sent emails and notifications: 30 days after delivery.
- App push addresses: until you sign out in the app, or 30 days without renewal.
- Sign-in cookie: 8 hours.
- Logs: until the size-limited log overwrites them.
- Backups: up to 6 months, so deleted data disappears from backups within that time.
Your rights
Depending on where you live, you may have the right to:
- ask what personal data we hold about you and get a copy;
- have it corrected or deleted;
- object to or restrict how we use it;
- receive your tickets in a portable format;
- complain to your local data protection authority.
To use any of these, contact us.
Children
The support desk is not aimed at children, and we don't knowingly collect data from them.
Changes
If what the support desk collects changes, we'll update this notice and the date at the top.
Contact
Open a request on the support desk under Privacy & Data Request: support.rootiest.dev/new?category=privacy (sign in with RootiestID).
No RootiestID? Use the email form at support.rootiest.dev/guest, choose General Questions, and say it's a privacy request.