Last updated November 2, 2026.
Privacy notice
Montgomery Appworks LLC ("we") runs Renewroll. This notice explains what the service stores, why, and how to remove it.
What we store
- Account details: your email address, your organization name, your role (owner or member), and a salted, peppered hash of your password. We never store your password itself.
- Staff records you enter: staff names, job roles and notes.
- License records you enter: license or credential type, license and registration numbers (including DEA registration numbers and NPIs), issuing state or body, issue and expiry dates, and notes.
- Uploaded documents: copies of license, registration or certificate documents you choose to upload (PDF, JPEG, PNG or HEIC, up to 10 MB each), with each file's name, type, size and upload date. The document copies are stored in Cloudflare R2 object storage in a private bucket: they have no public link, and only people signed in to your organization can download them.
- Settings: your reminder email settings (on or off, which days before expiry, and any other addresses the owner adds) and your organization's invite code.
- Reminder records: which reminders were sent for which license and expiry date, so nobody gets the same one twice, and the addresses that turned reminders off.
- Sign-in sessions: a random session token in a secure, HttpOnly cookie. We store only a hash of it, and it expires after 14 days or when you sign out.
- Abuse protection: to limit repeated sign-in and sign-up attempts we keep short-lived counters keyed by a one-way hash of your IP address and of the email being tried. They are routinely deleted once they are more than 48 hours old.
Staff and license records belong to your organization. Everyone in your organization can see and edit them. People in other organizations cannot.
What we don't store
Do not enter patient information. The service is not designed for protected health information, and we do not sign business associate agreements. We don't use advertising, analytics or tracking scripts, and we don't sell or share your data.
Where it lives
The service, its database and uploaded document copies (in Cloudflare R2) are hosted by Cloudflare in the United States and elsewhere. Cloudflare processes requests (including IP addresses) to deliver and protect the service. Database backups kept by Cloudflare for point-in-time recovery expire within 30 days. We do not keep backup copies of uploaded documents.
If reminder emails are on (the default), once a day we email the owner, and any other addresses the owner adds, a list of licenses that have reached one of the organization's reminder days or have expired. The email shows staff names, license types and expiry dates. It does not include license numbers, notes or documents. Emails are sent through Cloudflare Email Service. Every reminder email has a link to turn reminders off for that address without signing in, and the owner can turn them off for the whole organization in Settings. We don't send marketing email.
Your choices
- Download your data at any time from Export (CSV and JSON, including the list of uploaded documents), and download each document from its license page.
- Edit or delete any person or license. Deleting an uploaded document, or the license or person it belongs to, deletes the stored document copy from Cloudflare R2 straight away.
- Delete your account in Settings. If you are the owner, this deletes your organization and all its staff, licenses, uploaded documents and member accounts straight away. A member who deletes their account removes only their own sign-in.
Contact
Montgomery Appworks LLC, 9905 S Pennsylvania Ave Ste A, Oklahoma City, OK 73159. support@montgomeryappworks.com.