Privacy Policy
Last updated: 19 October 2026 Version: 1.3
1. Who we are
The controller of your personal data is Roam Software ApS (CVR 46659996), a company registered in Denmark, owned by Trekroner Ventures ApS.
Sole director: Lars Martin Ott
Postal address: Puggaardsgade 5, 4th, 1573 Copenhagen, Denmark Email: privacy@joinroam.app
You can use either address to exercise your rights under the GDPR, including access, rectification, erasure, restriction, portability, and objection. We will respond within one month. If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority.
This policy explains what data Roam collects, why, on what legal basis, how long we keep it, and what rights you have. It applies to the Roam mobile app and any related services.
2. What Roam collects
Roam has no access to your device's location. It does not use GPS. It does not track where you are, and it never has. Roam is about plans, not positions. You tell Roam where you intend to be, in the future, in your own words ("Berlin, 12 to 15 July"). Roam does not verify it, detect it, or observe it.
Below is a complete and specific list, derived from Roam's actual database.
2.1 Account information
You sign in with your phone number and a code sent to you by SMS. Roam stores the phone number and the fact that it has been verified. There is no password.
| Data | Notes |
|---|---|
| Phone number | Used to sign you in, to secure your account, and to confirm that accounts belong to real people. Not visible to other Roam users. |
| Email address | Stored only if you choose to add one. You can also tick "travel letter": now and then an e-mail with recommendations, special places and selected offers that fit your planned trips. It is off unless you tick it, and you can switch it off in Settings at any time. We keep a record of each answer: the exact words you saw, yes or no, where and when. |
| Apple ID link (optional) | You can link an Apple ID as a backup way to sign in. Apple then gives Roam a stable identifier for you and, only if you allow it, your name and email address. |
| Display name | Chosen by you, visible to your friends. |
| Username | Chosen by you, used so friends can find you. |
| Profile picture | Either a photo you choose (resized and re-encoded before upload, which removes embedded metadata including GPS coordinates), or one of Roam's drawn geese, or your initials. |
| Profile emoji | Chosen by you. |
| Birthday (day and month only) | Optional. We do not ask for or store your birth year. You can hide it from friends. |
| Terms acceptance | The fact and version of the terms you accepted. |
To deliver verification messages we use Twilio. Twilio necessarily processes your telephone number and communications metadata in order to send the SMS.
Verifying your number does not make you findable by other people. That is a separate, optional choice, described below under Contacts.
2.2 Location plans, the core of the service
| Data | Notes |
|---|---|
| Base city | The city you consider your home base. You can hide it from all friends, or from specific friends. |
| Trips | A city, a start date and an end date, an optional note, a visibility setting, and whether the trip is confirmed or tentative. |
| Trip stops | Optional intermediate destinations within a trip (city and dates). |
| Chapters | Longer life changes involving a move: a category (work, education, personal), a title you write, the new city, a start date, and an optional end date. |
These are plans, not observations. They are dates and city names you typed in. They contain no coordinates.
Notes are free text and are stored as you wrote them. Notes are shown to friends who can see that trip.
2.3 Social graph
| Data | Notes |
|---|---|
| Friendships | Who you are connected to, and whether a request is pending or accepted. |
| Per-friend privacy settings | If you choose to hide your destinations from a specific friend, that choice is stored. |
| Blocks | If you block someone, we store that. |
| Invites | Invitation links you create. |
2.3a What you share with friends
| Data | Notes |
|---|---|
| Tips | A place you recommend in a city: its name, your note, and if you pick it from the map, its address and position. Visible to your friends. |
| Tags | When you put a friend down for a trip, they are told and can add it to their own plans. Nobody else sees who travels with whom. |
| Trips planned together | The destination, the dates each person can do, the answers, and what the host adds: an address for getting there, a price, a postcard photo (deleted 30 days after the last night). Visible to the people in that plan. |
2.4 Derived data, "crossings"
Roam calculates overlaps between your plans and your friends' plans. If you and a friend will both be in Berlin during the same week, Roam computes that and shows it to both of you.
We call this out explicitly because it is a genuine processing activity, not just storage: Roam generates new information about you and another person by combining two sets of plans. This calculation happens only between people who are already mutually accepted friends, and only using data each of you chose to share with the other.
2.5 Safety data
| Data | Notes |
|---|---|
| Reports | If you report another user, we store who reported whom, the reason category, and any details you write. These details are free text and may describe another person. |
| Blocks | As above. |
Every report is sent to us by e-mail at once and reviewed within 24 hours. Texts that other people can read (names, notes, tips, plan names) are checked against a list of offensive words before they are saved; a refused text is not stored.
2.6 Feedback
If you send feedback through the app, we store what you wrote and that it came from you.
2.7 What Roam touches on your phone
Contacts
If you tap "Find friends from your contacts", Roam checks which people in your phone's contacts already use Roam. This feature is optional. We ask for your permission before we use it, and you can decline or withdraw at any time.
Your device reads the phone numbers in your contacts and converts them into cryptographic hashes on your device. The raw phone numbers, and your contacts' names, never leave your phone. Only the hashes are sent to Roam. We compare them against hashes of the phone numbers of Roam users who have chosen to be findable in this way, and we return only the matches. The scrambled numbers are used for the comparison only and are not stored. Roam keeps no record of who is in your address book and cannot tell you later when a contact joins. What Roam does store is a log of when the comparison ran and how many numbers it covered, to limit abuse.
We do not receive or store your contacts' names, email addresses or any other information from your address book. We record the date on which you gave permission, so that we can evidence it and so that you can withdraw it.
Other Roam users can only find you this way if you have switched on "Let people who have your number find you". This is off unless you turn it on. Your phone number is never shown to them.
Calendar
If you choose to import from your calendar, the events are read on your device to suggest trips. Only the trips you approve are saved to Roam. Calendar data is not uploaded. For each trip you approve, only the following is saved: the city, the start and end dates, and the event title (stored as the trip note, if it differs from the location). Nothing else from the event, no description, no attendees, no organiser, no times of day, is read or transmitted.
Because the event title becomes the trip note, approving an event called "Berlin, job interview at Acme Corp" will store that full title as a note visible to friends who can see that trip. Review the note after importing if it contains something you would rather not share.
Photos
If you save a card, Roam writes one image to your photo library and reads nothing. Choosing a profile picture opens the system picker, which hands Roam only the photo you pick.
2.8 Notifications
If you turn notifications on, Roam stores a device token so that Apple can deliver them. Notifications about crossings and about your friends' plans are sent from Roam's servers. You can turn notifications off at any time in your device settings.
2.9 Purchases
Roam Plus is a one-time purchase made through Apple. Apple handles the payment, and Roam never sees your card details. Roam stores whether your account has Plus and since when. Apple's privacy policy applies to the purchase itself.
2.10 Share links
If you share your Roam link, a public page at share.joinroam.app shows what you chose to put on it: your name, your profile picture, your home city and your next trip. Nothing else about you is public, and the page shows nothing to people you have not allowed.
2.12 Which of Roam's features you use
Roam also counts, as one word each, which tab and which kind of screen you open, which set-up step you reach or skip, which feature you use (for example a ping, a star or a group), which kind of notification you tap, which action failed, roughly how far ahead you look on the Timeline, and roughly how long each visit lasts (for example "under 30 seconds"). Never where you are going, never when, never who, and never anything you typed.
You can switch this off in Settings, Privacy, "Count how I use Roam". From then on your phone sends none of it.
3. What Roam does not collect
To be unambiguous, Roam does not collect:
- Your device location (GPS, coarse, background, or otherwise)
- Your birth year
- Advertising identifiers (IDFA)
- Third-party analytics or tracking. There is no analytics, advertising or crash-reporting software from another company in the app (no Google Analytics, Firebase, Sentry, Amplitude or anything comparable). Roam's own count of which features you use, described in 2.12, stays on Roam's server.
- Advertising data of any kind. Roam shows no ads and sells no data.
4. Information about people who do not use Roam
This section is for people who do not have a Roam account but whose phone number may appear in the contacts of somebody who does.
What we process, and why
When a Roam user chooses to look for friends in their contacts, their device sends us cryptographic hashes derived from the phone numbers in their address book. Some of those hashes will relate to people who do not use Roam.
We use those hashes only to determine whether they correspond to an existing Roam user who has chosen to be findable. Where there is no match, which is the case for everyone who does not use Roam, we do not store the hash, do not record it in our logs, and retain nothing about it. We never receive the underlying phone number, and we never receive names or other contact details.
Our legal basis is our legitimate interest in enabling people to find friends they already know (Article 6(1)(f) GDPR).
Why we cannot notify you individually
GDPR normally requires us to inform people when we obtain their data from someone else (Article 14). We are unable to do so here, and we consider the effort disproportionate, for a specific reason: our system is deliberately designed so that we never learn who you are. We hold no phone number, name or contact detail for you, and identifying you in order to send you a notice would require us to collect substantially more personal data about you than the service itself needs (Articles 11 and 14(5)(b) GDPR). We publish this section instead, and we have documented our reasoning internally.
Your right to object
You can object to your phone number being used for matching, and we will act on it. If you contact us at privacy@joinroam.app, we can add your number to a suppression list so that it can never produce a match, whether or not you ever use Roam. To prevent misuse we will ask you to demonstrate control of the number. We store only a hash of the number on that list, not the number itself.
You may also contact us at that address to exercise your other rights under the GDPR, including access, erasure and complaint.
5. How we use your data, and on what legal basis
Under Art. 6 GDPR, each processing activity needs a legal basis. Here is ours, per purpose:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account | Phone number and verification status, name, username, emoji | Art. 6(1)(b), performance of a contract (our terms) |
| Confirming accounts belong to real people, preventing duplicate accounts, impersonation and misuse | Phone number and verification status | Art. 6(1)(f), legitimate interests: a service where the people you connect with are real and accountable |
| Backup sign-in with Apple | Apple identifier, and name and email if you allow it | Art. 6(1)(b), performance of a contract |
| Showing your plans to the friends you chose | Base city, trips, stops, chapters, visibility settings | Art. 6(1)(b), this is the service you signed up for |
| Calculating and showing crossings | Your plans and your friends' plans | Art. 6(1)(b), the core feature of the app |
| Optional profile details (picture, birthday) | Profile picture, birthday day and month | Art. 6(1)(a), consent |
| Reading your address book for contact matching | Permission you grant on the device | Article 5(3) ePrivacy Directive, as implemented locally |
| Matching hashes relating to people who are not Roam users | Hashes only, discarded after comparison | Art. 6(1)(f), legitimate interests: letting you find people you already know. We have carried out an assessment weighing that interest against those people's interests and rights, and we can provide a summary on request |
| Making your own verified number matchable | Hash of your number | Art. 6(1)(a), consent, which you give by switching the setting on and can withdraw at any time |
| Sending notifications | Device token | Art. 6(1)(a), consent (you grant notification permission, and you can revoke it) |
| Recording your Roam Plus purchase | Purchase status and date | Art. 6(1)(b), performance of a contract |
| Your public share page | The details you chose to put on it | Art. 6(1)(a), consent |
| Handling blocks and reports | Report reason and details, block records | Art. 6(1)(f), legitimate interests: keeping users safe and enforcing our terms |
| Preventing abuse and securing the service | Account and access data | Art. 6(1)(f), legitimate interests: security |
| Responding to your feedback | Your feedback message | Art. 6(1)(f), legitimate interests: improving the app |
| Complying with legal obligations | Whatever the law requires | Art. 6(1)(c), legal obligation |
We do not rely on legitimate interests for any form of profiling, advertising, or data sale, because we do none of those things.
6. Who can see your data
This is where Roam differs from most social apps, and we want to be exact.
6.1 Nobody sees your plans by default except the friends you accepted
- A person can only see your plans if you and they are mutually accepted friends.
- A pending friend request grants no visibility whatsoever.
- If either of you has blocked the other, neither sees anything of the other.
This is enforced on the server, not just hidden in the app interface. Data you have not shared does not leave our database.
6.2 You control visibility per trip
Every trip has one of three settings:
- Full, friends see the city and dates.
- Vague, friends see that you are away, and when, but not where. The city name is removed on the server before it is ever sent to them.
- Private, friends see nothing at all. The trip exists only for you.
Tentative (unconfirmed) trips are not shown to friends until you confirm them.
6.3 You control visibility per person
You can hide your destinations from specific friends while remaining friends with them. If you do, that person sees you are away but not where, and this too is enforced server-side.
You can also hide your base city, from everyone or from specific people.
6.4 What friends see
| Data | Visible to accepted friends |
|---|---|
| Name, username, emoji, profile picture | Yes |
| Phone number | Never |
| Base city | Yes, unless you hide it (globally or from that person) |
| Trips | According to each trip's visibility setting, and any per-person hiding |
| Chapters | Same rules as trips |
| Birthday (day and month) | Only if you enable it |
| Crossings with you | Yes, if you can both see the relevant trips |
| Your notes on visible trips | Yes |
| Blocks, reports, private trips, per-person hiding | Never |
6.5 A crew link, and the page it opens
A crew is a group you bring into Roam by sending one link into the group chat you already have. Anybody holding that link opens a page on the web, and that page is public to whoever has the link: it shows the crew's name and emoji, the first name of the person who made it, how many people are in it, and up to five profile pictures of members. It does not show names, usernames, phone numbers, or anybody's plans. The link stops working after 24 hours, and once it has expired the page shows no pictures at all.
Joining a crew connects you to nobody. Being in one shows no one your plans: you still choose who to add, one person at a time, and only the people you added back see where you will be.
6.6 Your share page
If you create a share link, the page at share.joinroam.app shows only your name, profile picture, home city and next trip, and only to the extent you chose to put them there.
6.7 Reports and blocks are confidential
If you report someone, they are not told who reported them. If you block someone, they are not notified.
7. Where your data is stored, and who processes it
Roam's data is stored with Supabase in a European region. Our processors are:
| Processor | What it does | What it receives |
|---|---|---|
| Supabase | Database and sign-in, EU region | Your account, plans, friendships and profile picture |
| Twilio | Sends the SMS verification code | Your phone number, for that purpose only, and communications metadata |
| Apple | Sign in with Apple, purchases, notification delivery | Apple identifier, purchase details, notification token and content |
| Expo | Delivers app updates and forwards notifications to Apple | No personal data beyond a device token |
| Resend (resend.com) | Sends Roam's e-mails: sign-in codes to your address, and to us a copy of each report | Your e-mail address, and the content of reports |
| Vercel | Hosts the public share page | What you chose to put on that page |
Each acts as our data processor under Art. 28 GDPR and processes data only on our instructions.
Your data lives in the EU. Twilio and Apple may process your phone number or notification token outside the EU, and such transfers are covered by standard contractual clauses.
There is no analytics provider, no advertising network, and no third-party SDK receiving your data.
8. How long we keep your data
| Data | Retention |
|---|---|
| Account data, including your verified phone number | For as long as your account exists |
| Trips, stops, chapters | 24 months after the trip's end date, then deleted |
| Contact-matching hashes | Not retained. Used for the comparison only and not stored |
| Friendships | Until either party removes the friendship or deletes their account |
| Per-friend privacy settings | Until you change them or delete your account |
| Blocks | Until you unblock the person, or you delete your account |
| Reports | 12 months from submission, so we can spot repeat offenders, then deleted |
| Feedback | 12 months |
| Roam Plus purchase record | For as long as your account exists, and as long as tax law requires |
| Inactive accounts | After 24 months of inactivity we will contact you, and if you do not respond, the account and its data are deleted |
9. Deleting your account, and your rights
You can delete your account at any time, from inside the app: Settings, then Delete account.
This is a real deletion, not a deactivation. When you confirm it, we delete your profile, your verified phone number, all your trips, stops and chapters, your friendships and pending requests, your privacy settings, blocks, invites and feedback, your profile picture, your share page, your notification token, and your sign-in record.
Nothing is retained in a "deleted" state, and the deletion cascades through our database automatically.
One honest caveat: if you sent someone a report, that report may be retained for the retention period in section 8, because it exists to protect the person you reported about, but it will no longer be linked to an active account. Likewise, if another user blocked you, their block record persists, because it belongs to them, not you. Backups may take up to 30 days to cycle out.
Your rights
Under the GDPR you have the right to:
- Access your data, and get a copy of what we hold about you (Art. 15)
- Rectify it, and correct anything wrong (Art. 16)
- Erase it, and delete your account and data (Art. 17). You can do this yourself in the app, instantly.
- Restrict processing (Art. 18)
- Data portability, and receive your data in a machine-readable format (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, where processing is based on consent (Art. 7(3))
How to exercise them: email privacy@joinroam.app. We will respond within one month, as required by Art. 12(3) GDPR.
Most of what you need, you can do yourself: edit or delete any trip, change any visibility setting, or delete your entire account, all directly in the app.
Right to complain: you can lodge a complaint with a supervisory authority.
Note on data export: Roam does not currently have a one-click "export my data" button in the app. Until it does, email privacy@joinroam.app and we will provide your data within one month.
10. Security and age limit
Security
- Sign-in is by a one-time code sent to your verified phone number. There are no passwords to leak.
- All data in transit is encrypted (HTTPS and TLS).
- Access to your data is enforced at the database level (row-level security), not merely in the app. Data you have not shared cannot be retrieved by another user even if they bypass the app interface.
- Profile photos are stripped of metadata by re-encoding before upload.
No system is perfectly secure, and we will not claim otherwise. If we ever become aware of a breach affecting your data, we will notify the relevant supervisory authority within 72 hours as required by Art. 33 GDPR, and notify you directly where the law requires it.
Age limit
You must be at least 16 years old to use Roam.
We chose 16 because that is the threshold under Art. 8 GDPR as implemented in Germany, one of our primary markets, and because an app that shares where you will be is not appropriate for children.
We do not knowingly collect data from anyone under 16. If you believe a child under 16 is using Roam, contact privacy@joinroam.app and we will delete the account.
11. Future changes
We may update this policy. If we make material changes, we will notify you in the app and update the "Last updated" date. Continued use after a change means you accept the updated policy.
We will not quietly expand what we collect.
Privacy questions, data requests, complaints: privacy@joinroam.app
Roam is made by Roam Software ApS (CVR 46659996), owned by Trekroner Ventures ApS.