Privacy Policy
Effective date: 11 October 2026
This policy explains what personal data we process through the Roamify mobile app and the theroamify.com website (together, the “Service”), why and how we process it, and your rights. If you live in Türkiye, our KVKK Aydınlatma Metni (Turkish) also applies.
1. Who we are
The controller of your personal data is [Full name / Company name], [Address] (“Roamify”, “we”). For any privacy question: iletisim@theroamify.com.
2. Data we process
Account information
- Email address, username and password (passwords are held only by our authentication provider in hashed form; we cannot see them).
- Optionally your first and last name, profile photo and a short bio.
- If you sign in with Google or Apple, the email address and name that provider shares with us. With Apple you can choose to hide your email.
Your content and interactions
- Routes: title, description, category, tags, getting-around notes, and each stop's name, description and coordinates.
- Photos. They are re-processed on your device before upload, and EXIF metadata such as the GPS position, device model and capture time is removed.
- Ratings, comments, comment likes, favorites, the users you follow and who follow you.
- Reports (the content you report and why) and support requests (subject, message, your email and our reply).
Location
We use your device location only when you allow it, and only for two features: sorting routes by distance from you (Nearby Routes) and alerting you as you reach a stop (Track My Progress; while it is on, the app also uses location in the background and shows a notification saying so). Both happen on your device; your location is never sent to or stored on our servers. You can withdraw the permission at any time in your device settings.
Device and technical data
- A device-specific push token (Firebase Cloud Messaging) so we can send notifications.
- Platform attestation signals that confirm the app is genuine (Firebase App Check; Play Integrity on Android, App Attest on iOS).
- IP address, timestamps and request details created when you reach our servers and image storage (server logs kept for security and abuse prevention).
- Your language, theme and app preferences, which are stored on your device.
Ads and purchases
- In the free version, ads are served by Google AdMob, which may process your device's advertising ID (Android Advertising ID / IDFA on iOS if you allow it), IP address and ad interactions to serve and measure ads. You can opt out of personalized ads or reset your advertising ID in your device settings.
- Your Premium subscription status is tracked through RevenueCat. Payments are processed by Apple or Google; we never receive your card details.
Other features
- Dictation: when you grant microphone access, speech is turned into text by your device's speech recognition service (Apple or Google). We do not receive audio recordings.
- Place search: when you search for a place while creating a route, the text you type and the approximate center of the map are sent to Photon (komoot GmbH) to get suggestions.
- Travel times: when you submit a route for review, its stop coordinates are sent from our server to Google Routes to calculate walking and driving times.
The contact form on this website does not store any data; it only opens a draft in your email app.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Creating your account and providing the Service | Account information, content, interactions | Performance of a contract |
| Publishing routes, showing ratings and comments | Content, username, profile photo | Performance of a contract |
| Moderation, handling reports, preventing abuse | Content, reports, technical data | Legitimate interests; legal obligation |
| Nearby routes and progress tracking | Device location (processed on device) | Consent (location permission) |
| Sending notifications | Push token | Consent (notification permission); contract |
| Showing ads | Advertising ID, IP, interactions | Consent for personalized ads; otherwise legitimate interests |
| Managing Premium | Subscription status | Performance of a contract |
| Answering support and data requests | Contact details, messages | Contract; legal obligation |
| Security and integrity of the Service | Technical data, App Check signals | Legitimate interests |
4. Public content
Published routes (with their photos, stops and coordinates), comments, ratings, your username, profile photo and bio are visible to other users, and a shared route link can also be opened on the web. Your email address and real name are not shown to other users. Please do not add information that could identify you or others, such as your home location, to your routes.
5. Service providers and international transfers
We do not sell your data. We share it only as far as needed to run the Service with these providers:
| Provider | Purpose |
|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, App Check) | Accounts, database, server logic, notifications, security |
| Cloudflare (R2, DNS) | Storing and serving photos, website infrastructure |
| Google Maps Platform (Maps, Routes) | Maps and travel time calculation |
| OpenStreetMap tile servers | Map tiles on devices without Google services |
| komoot GmbH (Photon) | Place search suggestions while creating routes |
| Google AdMob | Ads |
| RevenueCat; Apple App Store; Google Play | Subscriptions and payments |
| Apple, Google | “Sign in with Apple”, “Sign in with Google”, dictation |
Some of these providers process data outside Türkiye (including the EU and the USA). Such transfers rely on appropriate safeguards required by applicable law, such as standard contractual clauses. We may also disclose data to public authorities where the law requires it.
6. Retention
- Account information and content are kept for as long as your account exists.
- When you delete your account, your account, routes (with their photos), comments, ratings, favorites, follows, notifications, reports and support requests are deleted immediately.
- Server and security logs are kept for up to 90 days.
- Where a legal dispute or obligation requires it, the relevant data is kept only for that period.
7. Security
All connections are encrypted (HTTPS/TLS). Database access is restricted by rules that let each user change only their own data, and photo uploads use short-lived, single-use signed links. No system is perfect; if a breach occurs we will make the notifications the law requires.
8. Your rights
Depending on where you live (for example under KVKK in Türkiye or the GDPR in the EU), you have the right to access your data, have it corrected or erased, restrict or object to processing, receive it in a portable format, object to decisions based solely on automated processing, and withdraw consent at any time for processing based on consent.
You can exercise many of these rights directly in the app: edit your profile, delete your content and permanently delete your account. For anything else, email iletisim@theroamify.com from your registered address with the subject “Data request”. We respond free of charge within 30 days. You also have the right to complain to your data protection authority (in Türkiye, the Personal Data Protection Authority).
9. Children
The Service is not directed to children under 13, and we do not knowingly collect data from them. If you are under 18, use the Service with a parent's or guardian's permission. If you believe a child has given us data, contact us and we will delete it.
10. Cookies on our website
theroamify.com does not use cookies — no advertising, analytics or tracking cookies, pixels or third-party trackers, so we do not ask for cookie consent. Fonts and images are served from our own domain. The account deletion page uses Google Firebase so you can sign in and delete your account; your session is kept in memory only while the page is open and nothing is written to cookies or browser storage (if you choose “Continue with Google”, Google may set its own cookies). Our hosting and security providers (Google Firebase Hosting, Cloudflare) may process technical data such as your IP address in short-lived logs to deliver the site and stop attacks.
11. Changes and contact
We may update this policy from time to time. We will announce significant changes in the app or by email; the current version is always on this page. Questions: iletisim@theroamify.com.