Roots — Our People. Our Stories. Forever.

ROOTS · TRUST & YOUR INFORMATION

Your family. Your privacy.

What Roots collects, why we use it, and the choices you have over your information.

Effective and last updated: 18 October 2026

1. About this notice

This policy covers the Roots website at roots.craftcart.app and the Roots mobile application, including development or test access. Roots is provided by Craftcart ("we", "us", or "our"). Craftcart is responsible for deciding how personal information is processed for the Roots service. For privacy matters, legal notices, or requests concerning your information, contact admin@craftcart.app. This notice describes current functionality; roadmap features do not collect information until they are introduced.

2. Information we collect

  • Account and identity: your name, international-format phone number, phone verification status, account dates, and a hashed PIN. We process verification challenges and hashed OTPs; the delivery provider must receive the code to deliver it.
  • Optional profile information: date of birth, location, biography, profile photo, and formatting you choose to supply. Location is profile text, not continuous GPS tracking.
  • Family information: family names, totems, descriptions, memberships, roles, invitations, invited phone numbers, people records, relationships, and connection proposals or reviews. Relatives may supply information about you even if you do not have an account.
  • Technical information: IP addresses, request timestamps, browser or client details provided with requests, authentication tokens, session records, and operational or security errors. We use these to serve requests, investigate problems, and limit abuse.
  • Communications: messages and supporting details you send to our contact address, including deletion requests.

Please avoid adding identity documents, financial details, health information, or other highly sensitive information to profile or family fields. Provide information about other people only when you have an appropriate basis to share it.

3. How and why we use information

We use this information to create and secure accounts; verify phone ownership; display profiles; operate family memberships, invitations, and connections; enforce permissions; respond to support and rights requests; and maintain the reliability and security of Roots.

Where applicable law requires a legal basis, we rely on performing our agreement with you for essential service functions; legitimate interests in security, abuse prevention, and administering the service where those interests are not overridden by your rights; legal obligations where applicable; and consent when it is legally required. You may withdraw consent for consent-based processing without affecting earlier lawful processing.

4. Who can receive information

  • Authorized family members: profile and family information needed for the family functions you participate in, subject to membership and permissions. Treat contributions to a family space as information shared with its authorized members.
  • WhatsApp / Meta: when WhatsApp messaging is configured, your phone number, verification message, and relevant invitation message are processed for delivery. WhatsApp’s own terms and privacy notice also apply. Message delivery does not itself prove phone ownership.
  • Infrastructure providers: hosting, database, email, and other technical providers as needed to operate and support Roots. Access is limited according to the task and applicable arrangements.
  • Website asset providers: this website loads Bootstrap from jsDelivr and jQuery from code.jquery.com. Your browser connects to those providers and may disclose its IP address and request information to them.
  • Legal and safety recipients: when reasonably necessary to comply with a binding legal requirement, address fraud or abuse, or protect people’s rights and safety.

We do not sell personal information or use this website for targeted advertising. No advertising or analytics tracker has been added to this website. If we materially change these practices, we will update this notice and obtain consent where required.

5. Photos and security

Profile photos are stored on a private application disk and served through authenticated endpoints. Uploaded photos are processed into a standard JPEG with metadata removed. Optional background removal, if enabled, runs locally on the server rather than sending photos to an external image-processing service; it is currently disabled on this deployment.

We use HTTPS, hashed PINs and verification challenges, token-based authentication, access checks, and restricted runtime file permissions. No system can guarantee absolute security. Keep your PIN and verification codes private and report suspected unauthorized access promptly.

6. Retention

We retain account and family information while needed to provide the service, subject to deletion requests and legal requirements. Operational logs are retained according to their security and troubleshooting purpose and the server’s log management settings; there is no single published fixed retention period for all logs or backups.

OTP challenges expire within five minutes; expired challenge records are scheduled for daily cleanup after they have been inactive for a day. Verification grants expire after ten minutes. Access tokens expire after 30 days, with scheduled cleanup after expiry. Photo upload sessions expire after one hour and are scheduled for hourly cleanup. These are validity and scheduled cleanup rules, not a guarantee that all copies disappear at the instant a credential expires.

For deletion, we assess active records, shared family records, logs, and any backups separately. Limited information may need to be retained for a legal obligation, security investigation, dispute, or rights request; we will explain the reason and relevant retention criteria in our response. Any retained backup data must remain restricted and not be reused for ordinary service purposes.

7. International processing

Your relatives and service providers may be in other countries. A relative who can access your family space may view information from abroad, and messaging or infrastructure providers may process information internationally. Where applicable law requires transfer safeguards, we will apply the required safeguards. Ask us for information about the providers, hosting location, or safeguards relevant to your data.

8. Your choices and rights

You can edit supported profile fields in the app. Depending on applicable law, you may also request access, a copy, correction, deletion, restriction, portability, or object to processing. You can withdraw consent where processing is based on consent and complain to your relevant data protection authority.

To exercise a right, email admin@craftcart.app. We may proportionately verify your identity and authority before responding. We aim to respond within 30 days, and will follow shorter statutory periods or explain any legally permitted extension. See Data deletion & rights and Account deletion for practical steps.

9. Children and family records

Roots account holders must be adults, at least 18 years old or the age of majority where they live. A family record about a child is not a child’s account. A parent or authorized guardian should supervise any sharing about a child and request removal if appropriate. We do not knowingly invite children to register directly. Contact us if you believe a child has created an account or that a child’s information has been shared improperly.

10. Cookies, changes, and contact

See our Cookie Policy for essential cookies and mobile token storage. We update the date above when this policy changes, and will provide additional notice for material changes where required. Send questions or legal correspondence to admin@craftcart.app.