Privacy Notice

1. Who we are and how to contact us

MyRoam is operated by Germano Spina, with a professional/legal address at Via Emanuele Cutore 64, 95030 Gravina di Catania (CT), Italy.

For privacy questions or requests, contact privacy@myroam.app.

2. What this Notice covers

This Notice explains what personal data MyRoam may process when you create an account, organize trips, upload content, search for places, share a trip, or exercise your privacy rights.

MyRoam is launching initially with free features. Paid features are not publicly available at this stage. If future features introduce additional processing, this Notice will be updated before those features are offered where required.

3. Personal data we process

Depending on how you use the service, we may process account data such as your name, username, email address, phone number, avatar, and account identifiers; authentication and verification data, including the sign-in method and provider identifiers; preferences such as language, currency, date format, and distance units; travel content such as titles, destinations, countries, dates, stops, notes, transport, accommodation, experiences, costs, and budgets; places and coordinates that you enter or select; travel photos and avatars that you upload; destination images derived from place data, which may be requested from Google Places and are not photos uploaded by you; sharing data; saved or imported trip data; technical and security data; and information you choose to send when requesting support or contacting us about privacy.

MyRoam does not intentionally request special categories of personal data. Notes, photos, and other content may nevertheless contain personal information that you freely enter; please avoid including sensitive data that is not necessary.

4. Why we process data and legal bases

We process data to create and maintain your account, provide requested features, authenticate access, verify contact details, protect the service, store and display your trips, search for places, store your content, manage sharing links and imported copies, prevent abuse, send operational communications, and handle requests for access, correction, deletion, or export.

Depending on the purpose and context, the legal basis may be providing the requested service, complying with a legal obligation, or our legitimate interests in security, abuse prevention, and service administration. Where consent is required, it is requested separately for the relevant purpose and can be withdrawn. Viewing this Notice is not general consent to data processing.

5. Account and authentication

Available sign-in methods may include email and password, phone verification, and Google. Firebase Authentication provides authentication; MyRoam stores the identifiers and status needed to connect it to your account. MyRoam does not store passwords or raw access tokens in its database. Contact verification and some operational messages may involve the authentication provider and an email service.

6. Trips and place information

Trips belong to the account that creates them and may contain destinations, dates, stops, places or coordinates, transport, accommodation, experiences, notes, costs, and budgets. Optional fields are processed only when you enter or use them.

When you search for or select a destination, MyRoam may send the information needed to a place-search service. For some destinations, a derived image may be obtained and stored. This image is not your photo and is not treated as a photo uploaded by you.

7. Photos, avatars, and destination images

Photos and avatars you upload are stored so they can be shown in your trips and profile, and may be processed through the storage services used by MyRoam. Destination images generated by the service are derived content linked to the selected place. They are not photos uploaded by you and are not counted in the space used by photos you upload.

8. Public sharing and imported trips

Sharing is always initiated by you. Anyone who obtains a valid link may view the selected public projection of the trip until the link expires or is revoked. It may contain only data allowed by the sharing settings, such as title, destination, dates and, if selected, photos, notes, costs, transport, accommodation, or experiences.

A shared link should not be treated as private to a specific person. You can revoke it, but revocation cannot erase copies, screenshots, downloads, or imported trips that others have already created or kept. Saving or importing creates a copy linked to the recipient account, which may follow a different lifecycle.

9. Service providers and recipients

Necessary data may be made available to Firebase Authentication and Google, hosting and database services, Cloudflare R2 or other storage services used for the service, Google Places and other place-search services, operational email services, and technical providers supporting security, maintenance, and availability.

Data is shared with these providers only to the extent needed to provide, protect, and maintain the service features you request.

10. International transfers

Some providers may process data in countries different from where you are located or outside the European Economic Area. Where an international transfer takes place, it is handled under the safeguards required by applicable law. The location of processing depends on the providers supporting the service features.

11. How long we keep data

Accounts, profiles, preferences, and trips are kept while they remain active, subject to legal requirements. Photos and avatars are kept while needed; shared links until expiry, revocation, or deletion; and verification data only as long as needed. Technical logs, requests, copies, caches, and backups follow the periods needed for their purpose and the technical cycles of the relevant services.

When you request deletion, removal from active systems may involve background processing. Copies made by other users or held by providers may follow different cycles.

12. Security

MyRoam uses technical and organizational measures designed to protect accounts, content, and communications, including authentication, account-level authorization, sharing-link protection, and data minimization in logs. No measure removes every risk: protect your credentials and treat sharing links as accessible to anyone who has them.

13. Your rights

Where provided by applicable law, you may request access, correction, deletion, restriction, or portability of your data and object to certain processing. If processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Send a request to privacy@myroam.app. We may ask for reasonable information to verify your identity. You may also complain to the competent supervisory authority.

14. Data export

The app provides an authenticated way to request a copy of data associated with your account, including your profile, preferences, trips, and related content. For security reasons, the export does not include passwords, access tokens, or internal credentials. You are responsible for how you share the exported file.

15. Account deletion

You can request account deletion using the available in-app functions. The request starts removal of account data and content through the service’s deletion flows. Some technical copies, logs, backups, or data that must be kept by law may remain for the necessary period. Deletion does not remove independent copies of a trip that others have imported or kept.

16. Age eligibility

MyRoam is intended for people aged 16 or older. If you are under 16, do not create an account. Additional requirements under applicable law also apply.

17. Changes to this Notice

We may update this Notice when the service, processing activities, providers, or legal requirements change. The version and effective date are shown in the app. If a change requires an action, it will be presented using the method required by law.

18. Version

This is version 1.0.0 of the MyRoam Privacy Notice.