Privacy Policy

1. Introduction

Roamly is operated by Jason Eng (“Roamly,” “we,” “us,” or “our”). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our travel planning platform and related services.

2. Information We Collect

We collect information that you provide directly to us, including:

• Account information (name, email address, password, date of birth)
• Profile information (profile photo, travel preferences)
• Trip data (destinations, itineraries, travel dates, notes)
• Companion conversations, photos and links you choose to share, and saved places
• Device location when you allow location access for relevant features
• Communications you send to us (support requests, feedback)

We also automatically collect certain information, including:

• Device information (browser type, operating system)
• Usage data (pages viewed, features used, interactions)
• Log data (IP address, access times, referring URLs)

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Create and manage your account
• Generate personalized travel recommendations
• Send you service-related communications
• Respond to your requests and provide customer support
• Analyze usage patterns to improve user experience
• Protect against fraud and unauthorized access

Legal Bases for Processing (EU/UK)

Where the GDPR or UK GDPR applies, we process your personal data on the following legal bases:

• Performance of a contract — to provide the Service you signed up for, including your account, trips, and itineraries
• Legitimate interests — to secure, analyze, and improve the Service, where those interests are not overridden by your rights
• Consent — for optional features such as marketing emails and non-essential cookies; you may withdraw consent at any time
• Legal obligation — where processing is required to comply with applicable law

4. Sharing of Information

We do not sell your personal information. We may share your information in the following circumstances:

AI and Machine Learning Providers

Roamly uses Google (Gemini) for AI chat, photo and link analysis, and trip ideas, and Anthropic (Claude) for AI itinerary optimization. Depending on the feature, requests include your messages, selected photos or shared links, travel preferences and restrictions, saved places, and relevant trip and conversation details. Location may be included when you allow location access. We may include your age, calculated from your birthday, to personalize companion recommendations. We do not send your stored birthday as part of that age context.

In the mobile app, we ask for your permission before enabling AI data sharing, including personalized suggestions. You can decline and continue planning manually. You can turn sharing off in Settings → Privacy to stop new mobile AI requests. This leaves saved conversations in place and does not retract data already sent to a provider.

Travel and Location Services

To provide place details, maps, directions, flight search, and hotel availability, we share relevant query data with:

• Google Maps and Places API — for location search, place details, photos, reviews, and routing
• Amadeus — for flight and hotel search results
• AviationStack — for flight status and tracking
• Yelp — for restaurant and business recommendations

These services receive search queries and location data, not your account information or personal profile.

Content Discovery

Our Discover feature aggregates travel content from public platforms including YouTube, Instagram, TikTok, and Reddit. We query these platforms using destination and topic keywords, not your personal data.

Infrastructure and Hosting

Your data is stored and processed by the cloud infrastructure providers that host our application and databases, including Supabase (database, authentication, and storage) and Vercel (application hosting). These providers process data on our behalf under data processing agreements and do not use it for their own purposes.

Other Sharing

• Other users — when you choose to share trips, invite collaborators, or publish itineraries
• Email providers — we use Resend to deliver transactional emails such as trip invitations
• Authentication — if you sign in with Google or Apple, we use that provider's sign-in credentials to authenticate your account through Supabase. We receive the account identifier and any name and email the provider makes available. Apple may provide a private relay email address if you choose Hide My Email. We do not receive your Google or Apple password.
• Business transfers — if Roamly is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction; we will notify you of any change in ownership or use of your personal data
• Law enforcement — when required by law, court order, or to protect our rights and the safety of our users

5. Data Security

We implement technical and organizational measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (TLS) and at rest
• Database-level access controls, including row-level security that restricts each user’s data to that user and their invited collaborators
• Least-privilege access for our personnel and service providers
• Hashed credentials — we never store your password in plain text
• Monitoring and logging to detect unauthorized access

No method of transmission or storage is 100% secure. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. In general:

• Account and trip data — retained while you use your account. Account deletion removes your account, profile, owned trips, saved ideas, conversations, and account-owned uploads from the active service. Collaborators lose access to trips you owned; trips owned by other people remain.
• Server logs and usage data — retained for a limited period for security and debugging, then deleted or anonymized
• Backups — deleted data may persist in encrypted backups for a limited period before being purged on a rolling basis
• Aggregated or de-identified data — may remain after account deletion for service analysis and accounting

Provider cost records are retained after account deletion with account identifiers removed or replaced. Shared search caches and historical evaluation examples may contain search or conversation content that is not linked to an account; automatic account deletion does not reliably identify every such record. Contact us about specific content you want removed.

We may retain certain information where required by law, to resolve disputes, or to enforce our agreements.

7. International Data Transfers

Your information may be processed and stored in the United States and other countries where we or our service providers operate. Data protection laws in those countries may differ from those where you live. Contact us for information about the providers and transfer safeguards applicable to your data.

8. Your Privacy Choices

Depending on where you live, you may have specific rights under privacy laws such as the California Consumer Privacy Act (CCPA), the Colorado Privacy Act, the Virginia Consumer Data Protection Act, or the EU/UK General Data Protection Regulation (GDPR).

Your Rights

• Right to Know / Access: Request a copy of the personal data we have collected about you, including the categories of data, sources, purposes, and third parties with whom we share it
• Right to Correct: Request that we correct inaccurate personal data
• Right to Delete: Request that we delete your personal data, subject to certain legal exceptions
• Right to Portability: Receive your data in a structured, machine-readable format (e.g., JSON or CSV export of your trips and account data)
• Right to Opt Out of Sale/Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights

Additional Rights for EU/UK Residents

If the GDPR or UK GDPR applies to you, you also have the right to:

• Object to processing based on our legitimate interests
• Restrict processing while a dispute about your data is resolved
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
• Lodge a complaint with your local data protection supervisory authority

Global Privacy Control and Do Not Track

We honor Global Privacy Control (GPC) signals as a valid opt-out of any sale or sharing of personal information in jurisdictions where GPC is legally recognized. Because we do not sell personal information or engage in cross-context behavioral advertising, honoring this signal does not change how the Service works for you. Our Service does not currently respond to “Do Not Track” browser signals, for which no industry standard exists.

Categories of Personal Information

Under CCPA, the categories of personal information we collect include: identifiers (name, email), internet activity (usage data, browsing history within our Service), geolocation data (trip destinations you add), and inferences (travel preferences derived from your activity).

How to Submit a Request

To exercise any of these rights, email us at privacy@roamly.io with the subject line “Privacy Request.” Please include your account email address so we can verify your identity. You may also designate an authorized agent to submit a request on your behalf.

We will acknowledge your request within 10 business days and respond within 45 calendar days. If we need additional time, we will notify you of the extension and the reason. If we decline your request, you may appeal our decision by replying to our response with the subject line “Privacy Appeal,” and we will review the appeal within the timeframe required by your state’s law.

Managing Your Preferences

• Marketing emails: Unsubscribe using the link at the bottom of any marketing email, or update your preferences in your account settings
• AI sharing in the mobile app: Review your permission or turn off new AI requests in Settings → Privacy. Your saved conversations remain available when sharing is off.
• Account deletion: In the mobile app, open Settings → Personal Info → Delete Account and confirm. Apple-linked accounts require confirmation with Apple so Roamly can revoke the Apple authorization before completing deletion. Section 6 describes what deletion removes and the records that may remain.
• Cookie preferences: See Section 9 below for cookie management options

9. Cookies and Tracking Technologies

We use cookies and similar technologies to operate our Service, remember your preferences, and understand how you use Roamly. Below are the categories of cookies we use:

Managing Cookies

Most browsers allow you to block or delete cookies through their settings. Note that blocking essential cookies may prevent you from using the Service. You can typically find cookie controls under “Privacy” or “Security” in your browser’s settings menu.

We do not use cookies for cross-site tracking or targeted advertising.

10. Age Eligibility

Roamly currently requires users to be 18 or older. People under 18 are not eligible to create an account or use the Service, including its AI features. We may record your confirmation that you are at least 18, the policy version, and the time of confirmation. We ask for your birthday when you create an account, including after signing up with Apple or Google, to check age eligibility and personalize travel recommendations. Your birthday is stored privately with your account, is not shown to other travelers, and can be corrected in account settings. A self-reported birthday or confirmation is not identity or verified-age evidence.

If you believe an account belongs to someone under 18, contact support@roamly.io. We will review the report, restrict access when appropriate, and delete personal information subject to the retention requirements described in this policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the “Last updated” date.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at privacy@roamly.io.