What these sites keep, and why.

The short version

• These sites load no analytics, advertising or tracking scripts. The only outside services involved are the ones listed under Who else is involved.
• Reading the site, the docs and the Apps catalog needs no account and stores nothing about you, apart from your theme choice in your own browser.
• An account is optional. RoachClaw on the web needs one, and saved apps use one to follow you from browser to browser.
• RoachNet, the Mac app, needs none of this. What the app sends, and when, is in Network and privacy.

Who runs these sites

RoachWares is an independent software company run by one person, Brennan. RoachWares LLC runs roachnet.org (including the docs and RoachClaw on the web), apps.roachnet.org, accounts.roachnet.org and stream.roachnet.org. This notice covers all four.

Questions about it go to contact@roachwares.org.

Hosting

All four sites are hosted on Netlify, and the server functions described below run there too. To deliver a page, Netlify handles each request your browser makes, including your IP address and your browser's user agent, as any web host does.

roachnet.org, the docs, Apps and Accounts serve their own fonts, scripts, styles and images. They load nothing from font services or shared CDNs.

The site, the docs and Apps

On the Mission page, Home and the Homebrew page, your browser asks GitHub's public API for the latest RoachNet release, so the download button and the version in the footer stay current. That request goes straight from your browser to GitHub, which sees it the way it sees any visit. The downloads themselves come from GitHub as well.

Docs search runs in your browser, on an index file from roachnet.org. What you type into it isn't sent anywhere.

Apps loads its catalog from apps.roachnet.org. It also opens a small hidden page from accounts.roachnet.org that only the store can talk to. If you're signed in there, that page reads and saves your saved apps in your account, and your sign-in itself never leaves accounts.roachnet.org. An app you save while signed out stays in your browser until you sign in.

An install button hands the pack to RoachNet on your Mac through a roachnet:// link. Nothing about the install is sent anywhere.

Accounts

A RoachNet account is an email address, a password and, if you like, a display name.

Signing up

Before the account exists, your browser runs a Cloudflare Turnstile check. roachnet.org's sign-up function then sends Cloudflare the check's result and your IP address to confirm it.

The same function limits attempts to five per IP address in 15 minutes and three per email address in an hour. It keeps each count under a keyed hash, not the address itself.

It also checks your password against Have I Been Pwned's Pwned Passwords list. Only the first five characters of the password's SHA-1 hash leave the function, and a password found on the list is turned down. Supabase then creates the account and sends the confirmation email.

What the account holds

Supabase stores your email address and a hash of your password, never the password itself. Its database holds your profile (email address, display name and picture link), your settings, the devices you've linked (name, platform and when each was last seen), your saved apps and your RoachClaw web conversations. Row Level Security means a signed-in account can read and change only its own rows.

The account page lists this browser among your devices as Accounts Web. It's named by a random ID kept in this browser, with the platform read from your browser (macOS, for example) and the time you last opened the page.

Each account has limits: 50 devices, 1,000 saved apps, 500 conversations and 10,000 messages.

Staying signed in, and leaving

Your session is kept in this browser's local storage on accounts.roachnet.org, and on roachnet.org if you sign in to RoachClaw there, until you sign out.

You can remove saved apps on the account page. To delete your conversations or the whole account, email support@roachwares.org from the address on the account. Deleting the account deletes everything stored with it.

RoachClaw on the web

RoachClaw on the web needs an account. When you send a message, your browser sends it, up to 12,000 characters, with your sign-in to roachnet.org's chat function.

The function checks your sign-in with Supabase and checks your limits: 20 messages in 10 minutes and 200 a day, counted against your account ID. It saves your message to your account and reads back the conversation's last 24 messages for context.

The reply comes from one of two places, and RoachClaw labels each reply with where it came from:

• Hosted model, by default: RoachBrain Cloud, which runs SmolLM2 135M, a small open model, inside the chat function on Netlify's servers. Your messages go to no outside AI company. The function downloads the model's files from Hugging Face, and nothing about you goes with that download.
• On your Mac, if you've paired one: the function sends your message, the conversation's last 20 messages and the pairing token to RoachClaw on that Mac, at an address on the site's allowed list.

Every reply is saved in your account with the name of what answered it. Conversations stay until you ask for them to be deleted, since RoachClaw on the web has no delete button yet.

RoachNet Stream

stream.roachnet.org is behind a password. When you enter it, the password check sets one cookie, roach_stream_access, which scripts can't read. It lasts 14 days, and signing out removes it. Netlify checks the password and allows eight sign-in attempts a minute from one IP address.

The video, the live status and the chat come from the stream's own Owncast server, run by RoachWares, through stream.roachnet.org. The chat is Owncast's: what you write there and the chat name you use are shown to everyone watching and kept on that server.

What's kept in your browser

Each site keeps its own entries, and none is shared between sites or used to follow you around the web. Clearing a site's data in your browser removes them.

• rw:themeEvery site · local storage

  The theme you chose. It stays until you clear the site's data. Where local storage is blocked, a cookie named rw_theme holds it for a year instead.

• rn:rollcall:support-castroachnet.org/home · session storage

  How many times the roll call at the bottom of Home has played in this tab, and which names it called last, so the next call picks others. It ends with the tab.

• sb-…-auth-tokenaccounts.roachnet.org and roachnet.org · local storage

  Your sign-in session, kept until you sign out.

• RoachNetAccountBrowserDeviceIDaccounts.roachnet.org · local storage

  The random ID that names this browser in your device list.

• roachnet.apps.saved.v1apps.roachnet.org · local storage

  Apps you saved while signed out, until they move to your account.

• roach_stream_accessstream.roachnet.org · cookie

  Shows the stream that you entered the password. 14 days, or until you sign out.

The stream's chat window comes from Owncast, which can keep its own chat details in your browser.

Who else is involved

• Netlify hosts all four sites, runs their server functions and stores the sign-up and chat limit counters.
• Supabase stores RoachNet accounts and what each account holds.
• Cloudflare runs the Turnstile check when you sign up on accounts.roachnet.org.
• GitHub answers the release check and serves the downloads.
• Have I Been Pwned sees the first five characters of a password hash during sign-up.
• Hugging Face hosts the model files the RoachClaw chat function downloads. Nothing about you goes there.

Questions and requests

Write to contact@roachwares.org about anything on this page, including a copy of what's stored about you or its deletion.

When this page changes, the date at the top changes with it.