Roam · Privacy Policy
Your plans.
Clear choices.
This policy describes Roam’s current local-first application, private backend and optional AI and Google location services. For privacy questions or requests, contact {{operator}} using {{contactLabel}}.
What stays on your device
Roam saves trips, itinerary edits, preferences, saved items and appearance settings in app or browser storage. Trips can include destinations, dates, accommodation, adults, children’s ages, interests and notes. A local pending-planning record may retain the original request and recovery identifiers until the operation is resolved. Roam does not automatically synchronise your trip library to a cloud account.
The backend address is saved locally. Native apps keep their connection token in operating-system secure storage. The web app keeps its token only in active-page memory: a full browser refresh requires reconnection. The owner test tool uses a process-memory device credential and a temporary local session cookie. It does not save provider previews to browser storage.
What the private backend receives
When you request AI planning, Roam sends the necessary trip preferences, availability and itinerary commitments to your configured private backend. It stores the planning request while processing, a resulting proposal for retrieval, job identifiers, device authorisation records, and operational usage and cost records in SQLite. Connecting also discloses normal network information to the backend and any configured private-network service, such as Tailscale.
OpenAI planning
Live planning sends trip-planning information, including relevant itinerary commitments and notes, to OpenAI. Destination research may use OpenAI’s web-search tool. Do not put secrets or unnecessary personal information in planning fields. Mock planning uses deterministic local fixtures instead.
Roam requests store: false for Responses API calls. This is not a promise of zero retention by OpenAI: provider processing and retention depend on the account, model, tools and applicable data controls. See OpenAI API data controls and OpenAI’s Privacy Policy.
Google Places and Routes
Only an explicit location lookup sends the lookup query, selected destination or place identifiers, and route endpoints through the backend to Google. The location service does not send your whole trip, family profile or notes to Google. Google-derived information is displayed separately from AI recommendations, with Google Maps and applicable third-party attribution. It is not sent to OpenAI.
Provider previews are response-only. They expire at the response’s stated validity time and are removed from the test display; Roam does not save names, addresses, coordinates or walking results into trip storage or the backend database. Operational records retain request identifiers, a request digest, status and estimated usage, rather than raw lookup text or provider results. Google has its own processing practices: the Google Privacy Policy is incorporated by reference for these features.
Retention and deletion
- Local trips remain until you delete them, clear app/browser data, or remove the app, subject to your device’s storage behaviour and any operating-system or browser backups.
- The backend clears the stored planning request when the job finishes, fails or is cancelled. Proposal payloads become eligible for clearing after 24 hours. Cleanup runs on backend startup and subsequent API requests, so this is not an exact deletion deadline.
- Jobs older than 31 days are eligible for deletion when no held reservation remains. General spending records older than 366 days are eligible for cleanup. Detailed OpenAI usage records, location-operation accounting and device authorisation records currently have no automatic deletion schedule.
- Backend diagnostic logs omit raw prompts, trip details, credentials and provider responses. Docker log files rotate by size, rather than a fixed number of days. Owner-created backups and hosting or private-network logs have owner- or provider-controlled retention.
Deleting a trip locally does not automatically erase backend operational records, previous provider processing or backups. Contact the operator to discuss backend records or backup deletion; do not send API keys or connection tokens. Roam does not promise immediate deletion from third-party systems.
Other connections and these public pages
The app can load destination photography from Unsplash’s image service, which receives ordinary network request information. These legal pages use no analytics, advertising, remote fonts or application code. A public hosting provider still receives network information needed to serve them and may keep access/security logs under its own practices. Visiting the contact website or a provider link is subject to that site’s practices.
Your choices
You can plan manually without sending a live AI request, use mock services, decline location lookups, disconnect the backend, edit or delete local trips, and clear local app data. The backend owner controls access, optional provider configuration, operational records and backups. Share only what planning requires. Contact {{operator}} through {{contactLabel}} for access, correction or deletion questions and to discuss any applicable privacy rights.