Privacy Policy

Last updated: September 2026

Roster does not store any of the data it reads from your monday.com account. The Administration view queries the monday API and builds the result in your browser. The Sidekick skill answers one question at a time on a small endpoint hosted by monday. Either way the data is used to produce the answer in front of you and is then gone. There is no database behind Roster.

1. Who this policy covers

This policy applies to Roster, a monday.com Administration view built and operated by Keel. Contact: contact@craft-palette.net.

2. What Roster reads, and why

Roster requests four read-only scopes from your monday.com account. It requests no write scopes — it cannot create, change, or delete anything on your account.

Scope	Why it's needed
boards:read	Board ownership, subscribers, kind, and permission settings — the core of the access picture.
users:read	Each person's user type and last activity, to flag dormant owners and guests.
teams:read	Team membership and team-based subscriptions, including the account-wide "everyone" team.
workspaces:read	The workspace name each board belongs to, for grouping in the board list.

3. What Roster does not do with this data

It does not write this data to a database. Roster has no storage of any kind — no database, no files, no cache.
It does not log the contents of what it reads. Any operational logging is limited to error conditions (for example, a failed API call) and does not include board or user contents.
It does not share, sell, or transmit this data to any third party.
It does not use this data for advertising, profiling, or any purpose beyond rendering the view you're looking at.

4. Where the data goes

In the Administration view, requests go directly from your browser to the monday API through the monday SDK, and CSV exports are generated in your browser and download directly to your device. Nothing passes through Roster's own code.

The Sidekick skill works differently, because monday's assistant calls it rather than your browser. monday sends the request to an endpoint that runs on monday code — monday's own hosting — which reads through the monday API and returns the answer. The data stays inside monday's infrastructure, is held only for the length of that one request, and is never written down. No third party is involved in either path.

5. Cookies and tracking

Roster does not set cookies and does not run third-party analytics or advertising scripts inside the app view.

6. Data retention

There is nothing to retain. Because Roster does not persist the data it reads, there is no retention period, no backup, and nothing to delete on request — closing the tab already clears it.

7. Changes to this policy

We may update this policy as Roster changes. The "last updated" date above reflects the most recent revision.

8. Contact

Questions about this policy or how Roster handles your account's data: contact@craft-palette.net.