Privacy notice

The controller under the GDPR is the private individual who runs Roamony:

For any question about your data, or to use one of your rights, write to the email address above. The operator is not required to appoint a data protection officer and has not appointed one.

In Roamony, three to ten people plan one trip together: they collect places in a shared pool, describe their tastes, propose places on a day plan and vote on them. An AI planner can suggest places and draft days, but only the group's votes decide.

Everything you add to a trip is visible to the other members of that trip and to nobody else. The app shows no advertising, does not sell data and does not track you across other websites.

The app stores the following data in Google Firebase (Cloud Firestore and Authentication). The operator chooses the storage location; an EU location is used where available.

• Account: your name, email address and profile photo as your sign-in provider (Google or the email link) gives them, the time you first signed in and the version of the Terms in force at that time.
• Trips: the trips you create or join, your role in them (organiser or member) and when you joined.
• Places: places you add to a trip's pool, including those imported from a Google Takeout file you upload; the file itself is read once and not kept.
• Proposals and votes: the places you propose for a day and time, and your yes or no votes.
• Comments: what you write on places and proposals, and whom you mention.
• Taste profiles: the interests, pace, budget and food needs you enter for a trip. Food needs can reveal health or religious information; enter only what you are comfortable sharing with your group.
• Personal plans: the items of your own plan in a trip ("My plan").
• Notifications: the in-app notifications for you and, if enabled, the email digest sent to your address.
• AI usage logs: for each AI request in a trip, the kind of job, the model, the number of tokens, the run time and the cost. These logs belong to the trip, not to a person, and contain no prompts.
• Technical data: when you use the app, the hosting provider processes your IP address, browser details and the time of the request in short-lived server logs, to deliver the pages and to keep the service secure.

When you sign in with Google, Roamony uses Google Sign-In through Firebase Authentication and asks only for the basic profile scopes (openid, email, profile). It does not ask for access to Gmail, Google Drive, Contacts, Calendar or any other Google service.

• What is accessed: your Google account ID, your name, your email address and your profile photo.
• How it is used: to create and secure your account, to show your name and photo to the members of the trips you join, to let an admin approve your access, and to send you the app's own emails (for example the daily digest). Nothing else.
• Sharing: your name and photo are shown only to members of trips you belong to. Your Google data is not sold, not used for advertising, not shared with data brokers and not used to train AI models. The service providers listed below process it only to run the app.
• Storage and protection: stored in Google Firebase, encrypted in transit and at rest; only the app's server can write it, and access is limited to what each feature needs.
• Deletion: you can delete your account and all data tied to it at any time under Account settings, and download a copy first. You can also remove Roamony's access in your Google Account under Security → Third-party apps.

Roamony's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google API Services User Data Policy

Providing the app (Art. 6(1)(b) GDPR, contract): your account, your trips and everything you add are processed to provide the group-planning service you signed up for, including the AI suggestions and the map and route information.

Security and cost control (Art. 6(1)(f) GDPR, legitimate interest): rate limits, spending limits on the AI and map services, error reports and server logs protect the service and its users against abuse and outages. The operator's interest is running the app safely and within a private budget.

Data you choose to share in a taste profile, such as food needs, is processed on the basis of your explicit consent, given by entering it for your group (Art. 9(2)(a) GDPR). You can withdraw it at any time by changing or deleting the entry.

When a member asks the AI planner for suggestions, a day draft or an answer, or when a place is enriched, the relevant trip data (the trip's dates and cities, the places in the pool, the open proposals, the members' taste profiles and the question) is sent to Anthropic (Claude) or Google (Gemini). Email addresses are never sent; display names are sent only where a job has to tell members apart, and text you write in a question or comment is sent as written.

The AI only proposes. It cannot vote, approve plans or change your profile. Its output can be wrong, so check important details yourself (see the Terms).

The operator uses the providers' paid API services. Under their terms for those services, the content sent is not used to train their models. Details are in the providers' own notices linked below.

The operator uses these providers to run the app. They process data on the operator's behalf under data processing terms (Art. 28 GDPR):

• Google Firebase and Google Cloud (Google Ireland Ltd.): sign-in, database, file storage.
• Google Maps Platform (Google Ireland Ltd.): place search, place details, routes and the map.
• Google Gemini API (Google Ireland Ltd. / Google LLC): place enrichment, the local guide and other AI jobs.
• Anthropic Claude API (Anthropic, PBC / Anthropic Ireland Ltd.): the AI planner.
• Resend (Resend, Inc.): the email digest of notifications.
• Hosting: Vercel (Vercel Inc.), or a server run by the operator and reached through Cloudflare (Cloudflare, Inc.).
• Sentry (Functional Software, Inc.), only if error reporting is switched on: technical error reports, which can contain your user id and your IP address.

• Privacy and security in Firebase
• Google Privacy Policy
• Gemini API Additional Terms of Service
• Anthropic Privacy Policy
• Resend Privacy Policy
• Vercel Privacy Policy
• Cloudflare Privacy Policy
• Sentry Privacy Policy

Some of these providers, or their sub-processors, are based in the United States or process data there. Such transfers rest on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the providers' data processing terms and, where the provider is certified, on the EU-US Data Privacy Framework (Art. 45 GDPR).

You can ask the operator for a copy of the safeguards in place.

Trip data is kept until the trip is deleted by its organiser. Your account data is kept until you delete your account.

When you leave a trip or delete your account, your membership, your taste profile, your personal plans and your notifications for that trip are deleted at once. Your comments and the places you added stay in the trip for the other members and are shown as from a former member; your votes on decided proposals stay so that results do not change.

The AI usage logs of a trip are kept for 13 months for cost control and then deleted, or earlier with the trip.

Server logs and error reports are kept for the short period the hosting and monitoring providers use, typically no more than 30 days. Backups of the database are overwritten in their normal rotation.

Under the GDPR you have the right to:

• access the data stored about you (Art. 15);
• rectification of incorrect data (Art. 16);
• erasure of your data (Art. 17);
• restriction of processing (Art. 18);
• data portability: your data in a machine-readable format (Art. 20);
• object to processing based on legitimate interest (Art. 21).

You can use most of these rights yourself in the app: under Account settings you can download all your data as a JSON file and delete your account. For anything else, write to the operator's email address.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

• EU data protection authorities

The app uses only what is strictly necessary to provide the service you ask for:

• __session: keeps you signed in. It is set when you sign in, cannot be read by scripts and expires after 5 days or when you sign out.
• NEXT_LOCALE: remembers the language you chose, for one year.
• Browser storage: the Firebase sign-in state, an offline copy of trips you open (so the app works without a connection) and your theme choice. You can clear them in your browser at any time; signing out clears the offline copies.

There are no analytics, advertising or tracking cookies. Because only strictly necessary storage is used, no consent is required (§ 25(2) no. 2 TDDDG, Art. 5(3) ePrivacy Directive), so the app shows no cookie banner.

The app shows maps, place information and routes from Google Maps Platform, always with the "Google Maps" attribution. When a map is shown, your browser loads it directly from Google, which receives your IP address and the map area you view.

The use of Google Maps features is subject to Google's terms and privacy policy:

• Google Maps/Google Earth Additional Terms of Service
• Google Terms of Service
• Google Privacy Policy

The operator updates this notice when the app or the law changes. The date at the top shows the current version.