Privacy Policy

1. Who this notice covers

This notice explains how Roami (漫寻) handles personal information in its iPhone app, website and account services. The operator and contact details displayed with this notice identify the person or entity responsible for the service. Use the Support page for privacy questions and requests.

Roami is a personal photo-based travel journal. This notice describes the current implementation, including development and testing features, rather than promising that every feature or place is publicly available. Apple and hosting providers also have their own notices for services they supply directly.

2. Photo access is your choice

You may choose individual photos with the system photo picker or grant limited or full photo-library access. The app reads accessible images and relevant capture-location and capture-date metadata to create footprints and identify supported visits. It does not request continuous device-location tracking for this purpose.

With existing library permission, the app may scan when it opens, returns to the foreground or receives a photo-library change. iOS limits background work. You can stop an import and change permission in iOS Settings. Declining permission does not prevent reading the website or its policies, but limits photo-derived features.

3. What stays on your device

Original photo files are not uploaded to Roami’s visit API. The app may read the selected image locally to inspect metadata, create an avatar or display a matching photo memory. Photo memories depend on the original remaining accessible on that device.

GPS-bearing photos can create a local footprint even when no stamp place matches. The current map index groups matching GPS coordinates at approximately six decimal places and keeps the photo count, earliest available capture date and local photo-library asset identifiers needed to show thumbnails. Display clusters depend on map zoom and do not change the stored location evidence. These coordinates can reveal precise locations and are not anonymous. This cache is separated by account using a hashed filename, protected by iOS file protection and excluded from app backup. Original images and local photo identifiers are not sent to Roami’s visit API. Thumbnails depend on continuing photo access; unavailable local images use a placeholder rather than automatically downloading every iCloud original.

4. What reaches the visit service

To validate a supported visit, the app sends your account’s authenticated request containing a place identifier, photo capture time and latitude/longitude. Precise location and a travel history may be sensitive. These details are used to check the place boundary, determine its local visit day and avoid duplicate awards.

The current business database stores the matched place, visit date, historical-visit status, stamp award and collection time, saved places, and a batch identifier, fingerprint and result for retry handling. It does not store the submitted raw latitude/longitude as visit columns. The batch fingerprint remains linked to your account and is not treated as anonymous data. A location outside the stamp catalog is not submitted as a supported visit, but its coordinates may be submitted separately for administrative-area resolution.

5. City and administrative-area resolution

For new and historical unresolved photo locations, the app uses Roami’s batch-resolution service and sends GPS coordinates, temporary request correlation identifiers and, when photo associations are enabled, opaque random photo references to Roami’s authenticated API hosted on Railway. No original images, raw photo-library asset identifiers, filenames or capture dates are included. The service compares coordinates with administrative boundaries. Raw submitted coordinates are processed for the request and are not stored in the photo-region association table or audit records; application logs do not record request bodies. Infrastructure providers process network traffic to provide the service.

The current production configuration uses Roami’s bulk-resolution API for both new and historical unresolved locations. Resolution results and progress are cached on your device. Older builds or an explicitly enabled Apple geocoding configuration may instead send queried coordinates and the requested language to Apple. Administrative resolution is separate from visit verification and does not itself award a stamp. The retained photo-region association described below is distinct from transient coordinate processing.

Administrative boundaries are derived from geoBoundaries CGAZ, provided by William & Mary geoLab and contributors (https://www.geoboundaries.org/), with attribution under CC BY 4.0 and the retained original source notices. The country-code crosswalk uses GeoNames countryInfo (https://www.geonames.org/), CC BY 4.0. Roami normalizes the hierarchy, rounds source coordinates to six decimal places and curates selected city names and identifiers. Source versions, original license metadata and modifications are published at /geography-data-sources.json. Coverage, administrative levels and represented years vary by place; historical or simplified boundaries may not match present-day legal boundaries. A returned administrative area is not automatically a city, and uncertain detail is not invented.

6. Photo references and retained region results

For enabled account photo associations, the app creates random photo-reference identifiers and keeps the mapping to the actual photo-library identifier on your device, separated by account. Roami stores the random reference linked to your account, the resolved or unresolved status, available country/city/area identifiers and names, the boundary-data version, the last request identifier and the update time. These account-linked region results can reveal sensitive location history and are not anonymous, even though the original image and raw GPS coordinate are not stored in this table.

These associations support account-based result records and retry handling. They remain for the account’s lifetime unless removed through an available deletion mechanism; deleting a local photo or withdrawing photo permission does not by itself send a server-association deletion request. Account deletion removes the associated records from the active database. Device-generated references do not provide cross-device photo deduplication, remote access to your original images or a cloud photo-backup service.

Resolution request audits retain a request identifier, account association, aggregate coordinate/photo-reference counts, outcome counts, status, boundary version, duration and creation time. They contain no raw GPS coordinates, original photos, raw photo-library identifiers, filenames or capture dates. The active audit table is cleaned at startup and at least hourly to remove records older than 30 days; account deletion also removes linked audits. This audit policy does not promise immediate erasure of infrastructure logs or provider backups.

7. Sign in with Apple and sessions

Apple supplies an app-specific account identifier and authorization proof. The app sends an identity token, authorization code and nonce to the Roami server so it can verify the sign-in. A token may include Apple-provided email claims. We do not receive your Apple Account password or two-factor verification code.

The backend records an internal account ID, Apple identifier and account creation time. It encrypts an Apple refresh credential needed to manage the authorization, including revocation on account deletion. Roami session secrets are stored as hashes on the server; the device keeps its session credential in Keychain. Current sessions expire after 30 days and may end earlier after logout, revocation or account deletion.

8. Name, email and avatar

When Apple provides a name or email, the app can save it locally for your profile. A consented name or email may be kept pending on the device if sign-in has not finished, because Apple may supply it only once. You can edit the display name and choose or remove an avatar. A selected avatar is resized and compressed locally.

These profile fields and the avatar are currently stored in device-only Keychain storage and are not separately synchronized to the Roami profile database. Authorization tokens sent to the server may nevertheless contain an email claim as described above. Logging out hides the profile and clears the active session; it does not by itself delete all saved profile details. Successful account deletion also attempts to remove the local profile, pending details and footprint cache on that device.

9. Why we use this information

We process account and visit information to authenticate you, maintain your collection and saved places, check visit eligibility, complete an award once, handle retries and protect the service against misuse. Enabled photo-region associations retain account-based region results and request linkage for consistent records and retry handling; they do not upload or back up original photos. Local photo access and optional profile editing support the features you choose.

Where applicable, processing relies on providing the service you request, your permission or consent for optional and sensitive-data features, and permitted security, operational or legal needs. A photo-library permission is not a blanket authorization for unrelated uses. If applicable law requires separate consent or another specific safeguard, those requirements must be met before the relevant processing; this notice is not a substitute for them.

10. Service providers and maps

Apple handles Sign in with Apple, system photo selection and Apple Maps services. When a map loads, Apple may receive network information and map requests associated with the area being viewed. Viewing a map does not upload the original photo to Roami.

In the Apple configuration, the app sends distinct GPS coordinates to Apple’s reverse-geocoding service with English and Chinese locale preferences. It does not send photos or photo-library identifiers for that lookup. Results, pending work and retry state are cached locally. Country and city visit badges are local milestones derived from successfully resolved accessible photo locations; removing photos or reducing access may reduce these local badges. They are separate from server-issued collectible stamps and are not certified proof of physical presence. Railway supplies the current website/API hosting and managed PostgreSQL infrastructure. Its systems receive network and operational information needed to serve and secure requests. Authorized infrastructure providers process information to deliver their services; provider terms may also apply. We do not provide them with your Apple password. Support correspondence is handled through the contact channel published on the Support page.

11. Processing locations and regional routing

The current authoritative account and collection database is deployed with Railway in the US West region. Regional entry points, when available, connect to the same authoritative service rather than creating independent accounts or a separate collection.

Accessing the service from another country, including mainland China, can therefore involve an international transfer of account, matched-visit and enabled photo-region association information. A regional website address does not by itself mean local-only storage. Availability, required transfer notices, consent and other safeguards depend on applicable law and the deployed service. Contact Support before submitting sensitive information if you need clarification about the applicable location or transfer arrangements.

12. Website requests, storage and cookies

The website uses Cloudflare for traffic delivery and protection. On the unlocalized home entry, Cloudflare derives a country code from the visitor IP to choose Simplified Chinese for mainland China or English elsewhere. If unavailable, browser language is used. You can select a language directly; this feature does not request GPS access or set a language-tracking cookie. The public website can be read without a Roami account. Serving a page or API request exposes technical information such as your IP address, request time, requested path and browser or network metadata to the hosting infrastructure. Operational logs may be used for diagnosis, reliability and security.

The current site does not use advertising cookies or an audience-analytics SDK, and the current app does not include an advertising or cross-app tracking SDK. Any local appearance preference only supports your interface choice. Essential platform storage or security controls may operate where needed. This statement does not describe unrelated third-party websites you choose to visit.

13. Sharing and uses we do not offer

Your private photos and account itinerary are not published as a social feed by the current service. A place or stamp design may display an aggregate count of distinct collectors; this is not a public list of their identities or travel records.

We do not sell personal information, use your photo library to train an AI model, or offer personalized advertising in the current implementation. Information may be disclosed where necessary to infrastructure providers, to comply with a valid legal obligation, or to address unlawful activity or a security incident, subject to applicable safeguards. A future public-sharing or materially different data use would require an updated explanation and any required choice before it begins.

14. How long information remains

Account, visit, stamp, saved-place and retry records, together with enabled account-linked photo-region associations, remain in the active database for as long as needed to provide the account and collection, subject to deletion requests and lawful retention requirements. Photo-region associations are retained for the account’s lifetime unless an explicit removal mechanism is used. Resolution audit records are removed after 30 days by startup/hourly cleanup, and associated records are removed with account deletion. A session’s 30-day validity limits authentication use; it does not mean every other associated row is physically deleted on day 30.

Local profile details may remain until changed or cleared, and the footprint cache may remain until refreshed, cleared by account deletion or removed with app data. Do not assume that uninstalling alone erases Keychain items. Provider log and backup retention depends on the deployed configuration and any lawful retention obligations; no fixed log or backup deletion period is promised here. The Support page is the route for a retention-specific request.

15. Deleting your account and permissions

In the app, open Settings, choose Delete account and confirm. The service first attempts to revoke the stored Apple authorization and then deletes the account and its linked sessions, visits, awards, saved places, retry records, photo-region associations and resolution request audits from the active database. If Apple revocation or the request fails, the app reports an error; do not treat an unconfirmed deletion as completed.

After successful server deletion, the app clears its session and attempts to remove local profile, pending sign-in details and footprint cache on that device. If local cleanup fails, it can report an error even after the server account was removed. Original photos in your Apple photo library are not deleted. Other devices, provider backups and legally retained records are not a promise of immediate erasure everywhere. Revoke photo permission separately in iOS Settings; stopping Apple sign-in or logging out does not itself delete the Roami server account.

16. Your privacy choices and rights

Depending on your location, you may have rights to access or obtain a copy of personal information, correct it, request deletion, restrict or object to certain processing, withdraw consent, or receive portable information where applicable. You may also raise a concern with the competent privacy authority. Mandatory rights are not limited by this notice.

You can edit the local display name/avatar and manage photo access in iOS Settings. Roami does not currently provide an in-app bulk data-export screen. For other requests, use the Support contact published with this notice. We may ask for proportionate information to verify that you control the relevant account, but never for your Apple password or two-factor code. We handle a request under the applicable legal process and time limit, and explain any lawful inability to fulfill it.

17. Security and its limits

Roami uses HTTPS for public service connections, server-side session hashing, encryption for the stored Apple refresh credential, iOS Keychain for device credentials and local profile information, and file protection for the footprint cache. Access to account records is checked through the authenticated API.

No network or storage system can be guaranteed completely secure. Keep your device and Apple Account secure, update the app and operating system, and contact Support if you suspect unauthorized access. When asking for help, do not send passwords, verification codes or a complete private photo library.

18. Children and young users

Roami is not specifically directed to children and does not offer a child-account or parental-consent workflow in the current implementation. A person who cannot lawfully provide the required permission should not submit personal information without the authorization required by local law.

If you believe a child’s information was provided without the required authorization, contact Support so the account and appropriate corrective steps can be assessed. This notice does not replace local age or parental-consent requirements.

19. Changes and questions

The version and effective date displayed on this page identify this notice. Material changes to purposes, data categories, recipients or your choices will be explained through an appropriate notice, and any required consent will be obtained before the relevant new processing.

Please read the Terms of Service alongside this notice. Use Support for questions about data handling, deletion, regional processing or this policy. We will not treat silence or merely reading this page as consent to an unrelated sensitive-data use.