Roam Wyld's use of information received from Google APIs (including Gmail) adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Account
Your email address, used only to sign in and identify your data.
Trips & Bookings
Trip names, destinations, travel dates, and booking details (flight numbers, hotel names, confirmation codes, activities) that you enter manually or import.
Travel Profile
Your passport nationality and home currency, stored in your profile to personalize entry requirements, visa information, and currency conversion. You may update or remove this at any time in Profile settings.
Insurance Details (optional)
If you add travel insurance to a trip, we store the provider name, policy number, coverage dates, and emergency contact number you enter. This information is stored on your device and on our servers and is never shared with insurance providers or third parties.
Travel Companions (optional)
If you share a trip with another person, you choose a display name for them and we create a private invite link for you to send them yourself. We do not collect their email address or phone number. By inviting someone, you confirm you have their permission to use that name in Roam Wyld. The name is kept until you stop sharing the trip or delete the trip or your account.
Once someone accepts an invitation to a shared trip, they can see that trip's bookings marked "Visible to both of us" — including confirmation numbers and costs — and you can see theirs. Either person can mark a booking "Just me" to keep it visible only to themselves. This visibility is limited to people you've explicitly invited and who've accepted; it is never shared more broadly.
If you or your travel partner leave a shared trip, or are removed from one, access to the other person's data is revoked immediately, and any of their booking data already downloaded to your device is deleted from local storage — it isn't retained after access ends.
Gmail (optional)
If you use Gmail Import, Roam Wyld requests read-only access to your Gmail account. With your permission, it reads the full message bodies of emails matching travel-confirmation senders and keywords, dated from several months before your trip through shortly after it — and no other emails — and sends up to ~8,000 characters of text per email to our AI provider to extract booking details. Roam Wyld does not parse PDFs or other attachments in your email. We do not store your Gmail password or credentials. Access can be revoked at any time at myaccount.google.com/permissions.
PDF & Photo Import (optional)
If you import a booking by choosing a PDF or taking or selecting a photo of a travel document (up to 8 photos at a time), that file is sent over an encrypted connection to our secure backend and on to our AI provider to extract booking details. Roam Wyld does not store the file or its contents after processing; only the booking details you choose to save are kept. Camera and photo-library access are requested only when you use this feature.
Usage Analytics
Feature usage events collected via PostHog, linked to a random account ID rather than your name or email address. Events may include which features you use and general trip attributes (e.g., number of destinations). We do not collect your name or email address in analytics events. When an event is received, PostHog uses your IP address to estimate your approximate location (such as country, region and city), then discards the IP address. Events recorded on or before October 5, 2026 may also include the IP address.
Error Reports
Crash and error logs collected via Sentry to help us identify and fix bugs. Error reports are not linked to your name, email address, or account. Error reports, and a small sample of app sessions, may include a short screen recording of the app with all text and images masked.
We apply the safeguards below to all personal data, with particular care for sensitive data — including your passport nationality, travel insurance policy details, trip itineraries, travel companions' display names, and any Gmail content processed during import.
Encryption in transit
All data exchanged between the app, our backend, and every third-party service is encrypted in transit using HTTPS with TLS 1.2 or higher. This includes every request to our Supabase backend, to Google’s Gmail API, to Anthropic’s Claude API, and to the services that check flights, hotels, and exchange rates.
Encryption at rest
Data stored on our Supabase servers is encrypted at rest with AES-256. Data cached on your device is held in the operating system’s app-private storage, which is encrypted by the device. Our daily database backups are separately encrypted, with a key that only Roam Wyld holds, before they are stored.
Credential storage
Your Google OAuth access token is stored only on your device, in the platform secure keystore (Apple Keychain on iOS, Android Keystore on Android) — never on our servers. We never receive or store your Google password. The token is deleted from your device when you disconnect Gmail or delete your account, and you can revoke it at any time at myaccount.google.com/permissions.
Access controls
Every record in our database is protected by row-level security rules that let each account read and write only its own trips, bookings, profile, insurance details, and companion invitations. The backend function that processes Gmail content verifies your signed-in identity before handling any request. Administrative access to production systems is limited to the minimum necessary and protected by strong authentication.
Sensitive data minimization
Gmail message text is processed in memory only for the moments needed to extract booking details and is never written to our database or server logs. We read only the message bodies of emails matching travel-confirmation senders and keywords, dated from several months before a trip through shortly after it — not your full mailbox — and send up to ~8,000 characters of text per matching email for extraction. We do not parse PDFs or other attachments in your email. Passport data is limited to nationality; we never collect your passport number, name as shown on the document, or photo page.
Vendor safeguards
Our infrastructure and processing providers (Supabase, Anthropic, and the underlying cloud hosting) maintain SOC 2 Type II or equivalent independent security certifications and are bound by data processing agreements that limit use of your data to providing their service to us. Anthropic processes Gmail Import content under its Commercial Terms of Service, does not use it to train its models, and deletes it under its standard API retention period, except where it must keep it longer for legal or safety reasons.
Ongoing practices
We keep software dependencies patched, review the data each feature collects before every release, and monitor for errors and anomalies. No method of transmission or storage is completely secure; if we become aware of a breach affecting your personal data, we will notify affected users and the relevant authorities as required by law.
Supabase
Database and authentication provider. Your account, trip, booking, insurance, and profile data is stored on Supabase servers in the United States.
Anthropic (Claude)
AI processing for Gmail Import, PDF & Photo Import, Transit Directions, Discover, and Translate. For Gmail Import, up to ~8,000 characters of text per matching email is sent to Anthropic’s API to extract booking details; email attachments are not parsed. For PDF & Photo Import, the PDF or photos you choose are sent to extract booking details. Roam Wyld does not store this content; it is processed under Anthropic’s Commercial Terms of Service. Anthropic does not use this content to train its models and deletes it under its standard API retention period, except where it must keep it longer for legal or safety reasons. For Transit Directions, your trip name, destinations, and dates, plus booking summaries (flight numbers and airports, hotel and activity names and dates), are sent to generate routing. Confirmation numbers, booking notes, and passport nationality are not sent. For Discover, your trip name, destinations, dates, and the budget and interests you choose are sent to generate suggestions. For Translate, the phrase you enter and the target language are sent.
AviationStack (apilayer)
When you add or edit a flight, the flight number is sent to AviationStack to check that the flight exists. No account information is sent. Depending on your app version, the check goes through our backend, which does not pass on your IP address, or directly from your device, which shares your device’s IP address with AviationStack.
Google Places (Google Maps Platform)
When you add or edit a hotel, the hotel name you enter is sent to Google to check that the hotel exists. No account information is sent. Depending on your app version, the check goes through our backend, which does not pass on your IP address, or directly from your device, which shares your device’s IP address with Google. Google handles this request under the Google Privacy Policy (policies.google.com/privacy).
ExchangeRate-API
Currency conversion. To convert costs into your home currency, the app requests current exchange rates for a currency code directly from your device, which shares your device’s IP address with ExchangeRate-API. No account information is sent. Rates are saved on your device so the app can convert offline.
PostHog
Usage analytics. Events are linked to a random account ID (not your name or email address) and stored on PostHog servers in the United States.
Sentry
Crash and error monitoring. Logs are stored on Sentry servers and retained for 30 days.
Apple and Google Play
If in-app purchases are offered in a future version of Roam Wyld, all billing will be handled by Apple through the App Store or by Google through Google Play. Neither shares payment information with Roam Wyld.
ImprovMX
Email forwarding for support@roamwyld.app. Messages sent to this address pass through ImprovMX's servers before reaching our inbox; ImprovMX does not have access to any other Roam Wyld data and is not used for any other purpose.
GitHub (Microsoft)
Runs our nightly backup job and stores the resulting backup file. The backup is created and encrypted on a temporary GitHub server that is discarded when the job finishes. GitHub stores only the encrypted file, cannot read it, and deletes it after 7 days. GitHub has no other access to Roam Wyld data.
We do not sell, rent, or trade your personal data to any third party. Data is shared only with the service providers and services listed above, solely to operate the app.
If you use trip sharing, bookings marked "Visible to both of us" — including confirmation numbers and costs — are visible to trip members you've invited and who've accepted. This is user-to-user sharing within a trip you control, not sharing with a third party.
California residents: Roam Wyld does not sell your personal information as defined by the California Consumer Privacy Act (CCPA). We do not share your personal information with third parties for cross-context behavioral advertising.
| Data type | How long we keep it |
|---|---|
| Account email | Until you delete your account |
| Trips, bookings, insurance details | Until you delete your account |
| Travel profile (passport, currency) | Until you delete your account or update it |
| Travel companion display names | Until you stop sharing the trip or delete the trip or your account |
| Gmail email body text | Not retained by Roam Wyld — deleted immediately after extraction |
| Imported PDFs and photos | Not retained by Roam Wyld — discarded immediately after extraction |
| Analytics events (PostHog) | Up to 7 years (PostHog’s retention period for our plan) |
| Error logs (Sentry) | 30 days |
| Sign-in security log (email address, IP address) | 30 days |
| Usage counters that prevent abuse (account ID, feature name, and number of requests per hour or day) | 2 days, or until you delete your account |
| Encrypted database backups (copies of the data above) | Each backup is deleted automatically 7 days after it is made. Data you delete, or that we delete on schedule, may remain in a backup for up to 8 days. |
You may delete your account and all associated data at any time directly in the app (Profile → Delete Account). Deletion is permanent. Your account, trips, bookings, insurance details, and travel profile are removed from our live servers immediately. Copies may remain in our encrypted backups for up to 8 days until those backups are automatically deleted, as described below. After you delete your account, past usage analytics remain in PostHog under a random account ID, and error reports remain in Sentry under a random device ID, until their normal retention periods end; neither includes your name or email address. Our sign-in provider keeps a security log of sign-ins and account changes, including your email address and IP address, for up to 30 days. We also keep a deletion record with only the month, platform, and ranges for account age and number of trips, with no name, email address, or account ID.
Backups. Once a day we make an encrypted backup of the app’s database, including trips, bookings, travel profiles (passport nationality and home currency), insurance details, and travel companion display names, so we can recover from errors or data loss. Each backup is encrypted before it is stored, with a key that only Roam Wyld holds, and is deleted automatically 7 days after it is made. Because of this, anything you delete, or that we delete on schedule, may remain in a backup for up to 8 days. We use backups only to recover data lost through an error. We never use a backup to bring back a deleted account or anything you deleted.
If you no longer have the app installed, you can request deletion by email instead. See roamwyld.app/delete-account.html for instructions.
Roam Wyld is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.
We may update this Privacy Policy. If changes are material, we will notify you within the app or by email to the address associated with your account. Continued use after notification constitutes acceptance.