Privacy policy

This policy explains what personal data we process in the RoamRise app and website, why we do it, who we may share it with and what rights you have. We only collect what the service needs.

1. Data controller

The controller of your personal data is the operator of RoamRise:

2. What data we process

In the app

• Account data: email address, secured (hashed) password, display name and an optional profile photo.
• Location data: GPS coordinates, the recorded route, speed, distance, duration and G-force values. It is created only when you start recording a ride yourself, and is used to save, analyse and share the ride.
• Content you create: saved rides, points of interest, notes and photos.
• Security audit: we record catalogue read actions with your account identifier, time, operation, result count and quota cost. Road-detail events also record the road identifier. These events help us investigate automated extraction. We do not put search text, locations, IP addresses or access tokens in these events. Account deletion removes the account link from the retained event.
• Technical and diagnostic data: device type and model, OS version, language, identifiers needed for operation, and crash and error reports.

On the roamrise.eu website

• Waitlist: if you join the list, we store your email, chosen language, the time you gave consent and the version of the consent text you agreed to.
• Content notices: if you report content, we process the form data (email, optionally your name, the link, the reason and your explanation).
• Account-deletion requests: the account email and language, so we can verify and handle the request.
• Technical data: for every request to the website or form submission, the hosting provider and our server function process your IP address and browser details for security and abuse prevention (for example, rate limiting).

We do not process payment data. Any payments would be handled solely by the App Store or Google Play.

3. Purposes and legal bases

• Performance of a contract: running the app, managing your account, saving and sharing rides, showing community content.
• Consent: access to your device location, notifications, and waitlist news emails. You can withdraw consent at any time.
• Legal obligations: handling notices of illegal content under the Digital Services Act (DSA) and handling GDPR requests, including erasure.
• Legitimate interests: securing the service, preventing spam and abuse, fixing bugs and improving the app.

4. Who we share data with

We do not sell your data or share it with third parties for their marketing. To run the service we use these processors, who handle data only on our instructions:

Rides, points of interest and a profile you share publicly can be seen by other RoamRise users. You decide what you publish.

5. Transfers outside the EU/EEA

The RoamRise database runs in the EU. Some processors are US companies and may access data from outside the European Economic Area. Such transfers are protected by appropriate GDPR safeguards, in particular the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

6. How long we keep data

• Account data and your content for as long as the account exists. After the account is deleted we erase the data within 30 days at the latest, except where the law requires us to keep it.
• Waitlist emails until you withdraw consent, and at most 24 months after the app's public release.
• Content notices and records of how they were handled for as long as needed to handle them and defend legal claims, at most 3 years.
• Account-deletion requests and the record of their handling for 3 years, as proof that we complied.

7. Your rights

Under the GDPR you have the following rights regarding your data:

• the right of access and to a copy of your data,
• the right to rectification of inaccurate data,
• the right to erasure (“right to be forgotten”),
• the right to restriction of processing,
• the right to data portability,
• the right to object to processing,
• the right to withdraw consent at any time.

To delete your account and all its data, use Profile → Settings → Delete account in the app, or the Delete your account page. For any other request, email [email protected]. You also have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, Czech Republic).

8. Security

We protect your data with technical and organisational measures: encrypted transfer (HTTPS/TLS), row-level security (RLS) for database access, and hashed password storage. No transfer of data over the internet is entirely without risk, however.

9. Automated decision-making

We do not make decisions about you based solely on automated processing that have legal effects on you. How we use automated tools in content moderation is described in the terms of use.

The trip planner processes only what you enter when planning: the start and optional end point, the departure time, the time budget, the style and any roads you pick. These serve only to compose the answer; we do not store them unless you save the trip to your account. The planner also reads the lines of your own roads (sections of your rides kept on your account). The AI model that profiles catalogue roads receives nothing about you, about where you start or about your own roads. Your consent to offering your roads to the catalogue is stored with the terms version and the time it was given or withdrawn.

10. Children

RoamRise is intended for users aged 18 and over. We do not knowingly process data of children under 18. If we find we have collected such data, we will delete it.

11. Cookies and measurement on the website

With your consent, we use Microsoft Clarity on marketing pages to measure visits and record interactions, such as clicks and scrolling. Microsoft processes browser and device information, IP addresses and cookie identifiers. We keep advertising storage disabled and mask page text. We exclude forms, shared-trip pages and pages opened with query strings or fragments. We do not send account identifiers or recorded ride coordinates to Clarity.

You can decline or withdraw consent through Analytics settings in the footer. We store your choice on your device for 180 days. Without consent, we do not load Clarity. Microsoft normally retains recordings for 30 days and favourite and sampled recordings for up to 9 months. See Clarity's privacy and retention information and Microsoft's privacy statement for processing and international transfers.

Fonts and images come from our own site. If Cloudflare Turnstile protection is enabled on a form, Cloudflare processes technical browser data and your IP address to distinguish people from bots.

12. Changes to this policy

We may update this policy. We will tell you about material changes in the app or on the website and state the new date.

13. Contact

For any privacy question, email [email protected].