This describes what Rollbird actually stores, checked against the code rather than written from a template. Where the honest answer is awkward, it says the awkward thing.
What Rollbird stores about you
Your account
Your email address, because it is how you sign in, and an optional display name so your colleagues see something other than an address. There is no password field, because there are no passwords — signing in sends a six-digit code to your email.
Your organization and projects
The organization name, its URL slug and its optional description. The project names and slugs you create, and the app identifiers (your iOS bundle id and Android package name) you link to them. Each project also has a signing key pair; the public half is stored as-is and the private half is encrypted before it is written down.
Your team
Who belongs to an organization, what role each person has, and when they joined. When you invite someone, Rollbird stores the email address you invited until the invite is accepted or you delete it. Invite the wrong address and you can remove the invite yourself.
Sign-in and anti-abuse records
Signing in writes two things. A sign-in code record holding your email address and a one-way hash of the code (never the code itself), which stops working after ten minutes or five wrong attempts. And a rate-limit record, so the same address and the same network cannot request an unlimited number of codes.
Those rate-limit records use your email address and your IP address as the key, stored as plain text. The same applies to the other public endpoints that are rate-limited: the update-event endpoint, the CLI's device-login flow, invite acceptance, and the beacon on this website. Section 8 says how long they are kept, and the answer is not comfortable.
Billing
If you subscribe, Rollbird stores the Stripe customer and subscription identifiers for your organization, plus which plan you are on and its status. Your email address is passed to Stripe so your receipts reach you. Card numbers never touch Rollbird — they go from your browser to Stripe directly, and Rollbird cannot see them.
What you did
An activity record for meaningful actions in an organization — a release published, a token revoked, a member removed — noting which user or which API token did it, and when.
Your bundles and release history
The JavaScript bundles and assets you publish are stored as opaque objects in Cloudflare R2 under environment, organization, project, release and platform-specific keys. Uploads first land at an unservable staging key, count against storage immediately, and are copied to the serving key only after their declared size, hash, bundle signature and targeting signature pass validation. Cloudflare encrypts stored R2 objects at rest and Rollbird transfers them over HTTPS. They are your content; Rollbird holds them to serve them to your app. The terms say what licence that needs and how narrow it is.
Around each release, Rollbird stores the metadata the CLI sends: the release message, the platform, the channel, the app version it targets, and which user or token published it.
If you publish from a git repository, that metadata includes the commit hash, the branch name and the commit author's name, read from your local git log. That last one is a person's name, so it is worth knowing it is there. It is shown in the dashboard so your team can tell releases apart. If you would rather it were not stored, publish from an environment where the git author is not a personal name.
Rollbird also records which CI provider a release came from, when it can tell.
Update analytics
When your app receives and downloads an update, Rollbird can increment a counter. Every counted beacon must carry a short-lived signed receipt issued with that update offer; the same receipt cannot count the same transition twice or count both success and failure. Rollbird's current React Native wrapper reports an authenticated download-complete event. It does not infer a successful install from download progress, and it drops restart-time failure reports when the original receipt is no longer available. The analytics record is four fields: which project, which release, which platform, and which event was reported.
That is the dataset behind the numbers on a release page. There is no row per device, no user agent and no raw receipt stored with it. A receipt proves that Rollbird issued the corresponding update offer; it is not device attestation, and it cannot prove that a physical device genuinely installed or ran the code. Rollbird therefore cannot treat these counters as audited device totals or monthly active users, and never bills you for them.
One honest detail: the update-event endpoint accepts an optional installation id, because the underlying open-source engine sends one. Rollbird's API validates the request and throws that value away. It is never stored, never counted and never written to a log.
A second honest detail: like every public endpoint, the event endpoint is rate-limited, and rate limiting records the calling IP address in the database as described in section 1. So while nothing per-device is stored as analytics, a device's IP can end up in a rate-limit row.
What Rollbird does not collect
- Anything about your app's end users. No user ids, no device ids, no advertising identifiers, no email addresses of your users, no location, no fingerprinting. Rollbird has no idea who they are.
- Monthly active users. Not measured, not estimated, not stored. It is not a number Rollbird can produce, which is the point.
- The contents of your bundles, as data. Rollbird stores your bundles as opaque files to hand back to your app. It does not parse, index, scan or analyse what is in them, and does not use them to train anything.
- Passwords. There are none to lose.
- Card numbers. Stripe handles those.
- Third-party trackers. No Google Analytics, no advertising pixels, no session recording, no A/B testing service, no chat widget. On this site and in the dashboard, fonts are served from Rollbird's own domain, so reading either one sends nothing to any other company.
This website
rollbird.dev counts page views and clicks on its main buttons using a first-party beacon written for this site. It sets no cookie, stores no identifier, and records three things: which page, which button, and the hostname of the site you arrived from — news.ycombinator.com, not the full link. Events raised inside the dashboard, such as starting a checkout, also carry the organization id.
If your browser sends Do Not Track or Global Privacy Control, the beacon does not run at all — no request is made, so not even a rate-limit row appears.
Cloudflare, which serves this site, keeps its own request logs as part of running the network. That is not something Rollbird controls.
Cookies and browser storage
Rollbird sets one cookie, and only after you sign in:
-
__Host-rollbird_session
Keeps you signed in. It holds a random session token and nothing else — no email address, no name, nothing readable.
Set as HttpOnly · Secure · SameSite=Lax · 30 days · host-only on the API
That is the whole list. There are no advertising cookies, no third-party cookies and no tracking cookies, which is why you have not been asked to dismiss a consent banner.
The dashboard and this site also use your browser's own local storage for small preferences that never leave your device: which colour theme you picked, which organization you had selected, and whether you have already seen the "first install" note on a project.
Who else handles it
Rollbird is run by one person and relies on three companies to operate. Each one gets only what its job needs.
-
Cloudflare
Hosting and storage: the API (Workers), the database (D1), your bundles (R2), this site and the dashboard (Pages), and the update counters (Analytics Engine).
Sees everything Rollbird stores, plus its own network request logs.
-
Stripe
Payments, subscriptions and the billing portal you cancel from.
Sees your email address, your payment details and your billing history. Rollbird never sees the card.
-
Resend
Transactional email: sign-in codes, team invitations, support reports and operator alerts.
Sees the recipient's email address and the contents of that email.
Rollbird does not sell your data, does not share it for advertising, and does not hand it to anyone else except where the law requires it. If that list of companies changes, this page changes with it.
How long it is kept
This section describes what the code does today, not what we would like it to do.
Your account, organizations, projects and production releases are kept for as long as your account exists. Preview history beyond your plan's published count is pruned: the release record remains, while its bundle object is deleted and its storage is returned. Unfinished uploads expire after 24 hours and are removed by scheduled cleanup. Downgrading or cancelling does not delete live production releases. To have the rest removed, see section 9.
Rate-limit records holding IP addresses or email addresses are deleted after their windows have been inactive for 24 hours. The scheduled cleanup may run later than the exact 24-hour boundary, so this is a deletion target rather than a real-time expiry guarantee.
Sign-in codes stop working after ten minutes or five wrong attempts, but the record — including the email address it was sent to — is marked used rather than deleted, and stays.
Signing out deletes that session immediately. A session you simply abandon expires after 30 days and stops working, but its row remains.
Revoking an API token disables it immediately; the record of the token, with its name and creation date, is kept so the activity history stays readable.
Update counters live in Cloudflare Analytics Engine, which applies its own retention window; they contain no personal data in the first place.
Stripe keeps your billing records under its own policy, and some invoice and tax records have to be kept for a number of years regardless of what you ask us to delete.
Getting your data out, or deleted
There is no self-serve deletion in Rollbird today. The dashboard has no button that deletes your account, an organization, a project or a release. That is a gap we are telling you about rather than a design decision, and it is being tracked as work to do.
What you can do yourself, right now: cancel an invitation, remove a member from an organization, and revoke an API token.
For anything else — deleting a project, deleting an organization, closing your account entirely, or getting a copy of what is stored about you — email [email protected] from the address on the account and say what you want removed. We will confirm it is you, tell you what will go, and do it. We aim to complete a deletion request within 30 days.
Two caveats, so the promise is a real one. Records we are legally required to keep — invoices and tax records in particular — stay, and Stripe keeps its own copy of your billing history. And deleted content can persist for a while in the backups our host keeps before those roll off.
Security
Everything travels over HTTPS. Session cookies use the host-only __Host- browser protection and are HttpOnly, Secure and SameSite=Lax. API tokens are hashed before they are stored and are shown to you exactly once. Sign-in codes use a keyed, one-way verifier and are atomically limited to five guesses. Project signing private keys are AES-GCM encrypted before storage. Bundle bytes are signed for device verification, and release targeting metadata is signed and verified again before Rollbird serves it. Every organization-scoped request is checked against your membership on the server; an organization id in a request body is never trusted.
What Rollbird does not claim: there is no security certification, no SOC 2 report, no ISO 27001, no independent audit and no penetration test. Saying otherwise would be easy and untrue.
If you find a vulnerability, email [email protected]. Reports made in good faith are welcome.
Your rights, and what we don't offer
Depending on where you live, data protection law may give you rights over the information here: to see a copy of it, to have it corrected, to have it deleted, to object to some uses of it, or to complain to a regulator. Rollbird will honour those requests — email [email protected] and we will not make you justify the ask.
What this page deliberately does not say is that Rollbird is "GDPR compliant" or "LGPD compliant". Compliance is not a badge you award yourself, and a one-person company with no legal review has no business claiming it. What is written above is a description of what the software does, so you can judge it against whatever rules apply to you.
Related: Rollbird does not currently offer a signed data processing agreement, standard contractual clauses, or a subprocessor change-notification commitment. If your company requires one of those before it can use a vendor, the honest answer today is that it does not exist yet. Email and say what you need, and you will get a straight answer rather than a form.
Children
Rollbird is a developer tool sold to people who ship software. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has created an account, email [email protected] and it will be removed.
Rollbird collects nothing from the people who use your app, whatever their age.
Changes to this policy
The date at the top of this page is the last time it changed. If Rollbird starts collecting something new, adds a company to the list in section 7, or changes how long anything is kept, this page is updated at the same time as the code — and for a change that matters, account holders get an email before it takes effect.