Privacy Policy

Last updated: October 24, 2026

See previous versions

1. Who we are

This policy covers the RoamDrop app for iPhone and iPad, its Apple Watch companion, and the website roamdrop.app. The controller of the personal data described here is Mariia Tararova (OIB 17233930874), Primorska 8, 51000 Rijeka, Croatia (“RoamDrop”, “we”, “us”). For anything about privacy, write to privacy@roamdrop.app.

The app is used without an account. We do not ask for your name, your email address or your phone number, and nothing in the app signs you in to us.

2. How RoamDrop is built

• Your trips, cards, notes, the files you attach and the text read from them are stored by the app on your device.
• Reading a screenshot, photo, PDF or pasted text happens on the device, with Apple’s on-device frameworks and, on devices that support it, Apple’s on-device language model. A document is never sent anywhere to be read.
• We have no server that receives trips or documents. Where something is stored outside your device, it is stored at Apple: in your own iCloud, or in the database Apple runs for the app (sections 4.1 to 4.3).
• If recognition ever stops being done on the device, this policy will change before that feature ships, and nothing of yours will be sent to be read without an explicit action from you.

3. What stays on your device

• Trip content: trips, days, cards, notes, links, the budget and expenses, packing lists, and the screenshots, photos, PDFs and other files you add.
• Text read from your documents: dates, times, places, prices and the rest of the recognized text, kept with the card so that you can check it.
• Purchases: RoamDrop Plus and trip passes are bought through the App Store. Apple handles the payment, and we never receive your name, your card or your Apple Account. To know what you have bought, the app reads from Apple, on your device, which RoamDrop purchases your Apple Account holds, when each was made, when it ends and whether it was refunded.
• Allowance counters: how many free recognized cards and plan imports this installation has used, and which one-off rewards it has received. These are kept in the device’s keychain and, unlike everything else, survive deleting and reinstalling the app, so that reinstalling does not reset the allowance. They hold counts, not the content of your trips.
• Places on the map: for a place that Apple Maps knows, a card keeps the identifier Apple Maps gives that place, and nothing else Apple Maps says about it. The place’s address, phone number, website, point on the map and time zone are asked of Apple Maps by that identifier when the card is shown, and are held only while the app is open: they are not stored on the device, copied to iCloud, put into a PDF or published, and without an internet connection they are not shown. The same goes for the points a trip’s map finds and for journey times. Earlier versions of the app wrote some of this into the card: an address, phone number or website filled in that way stays as part of the card, and the time zone, the country and Apple’s point, which were never shown, are removed when the app starts.
• Diagnostics: the app keeps technical records of crashes and hangs on the device, using Apple’s diagnostic frameworks. They leave the device only if you send them to us yourself, or through Apple if you have agreed in your device settings to share analytics with app developers.
• The parts of RoamDrop on your devices: the share sheet extension, the widgets and the Apple Watch app are parts of RoamDrop. Something you share into RoamDrop waits in storage that the extension and the app have in common, and the widgets and the watch receive a short summary of the current trip from the app.
• Permissions: the camera and your photos are used only when you add a picture, and your calendar only when you add a trip to it. Reminders are created on the device and only if you turn them on. RoamDrop does not ask for your location.
• Pictures of people: you can put a photo or an avatar on yourself and on the people on a trip. Your own picture is stored with each trip you share in iCloud, and the people on that trip see it; a guest who can only view a trip cannot send theirs. A picture you put on someone else stays on this device. Pictures are not part of the PDF, the copy of your data or a published page. “Erase my data” removes them from this device.

4. What leaves your device, and when

4.1 iCloud: sharing a trip and keeping a copy

Sharing a trip. When you share a trip, or join one shared with you, that trip is stored in Apple’s iCloud (CloudKit) and kept in step between the people on it: its days and cards, notes, links, the budget, shared lists, the files attached to its cards together with the text read from them, and the list of people on the trip. For each person the trip stores the name and the email address or phone number that iCloud gives for them and, if they chose one, their own photo or avatar, and the others on the trip can see these. People you add by name who do not use RoamDrop, a child for example, are kept on the trip with the name you give them and, if you set it, who pays for them; the others on the trip see them too. Anyone who opens the invitation link with an Apple Account can join the trip and edit it, so send the link only to people you want in it. The owner can remove a person or stop sharing at any time. When a pass or a subscription opens a shared trip, the date that access ends is written on the trip, so that everyone’s app knows the trip is open; nothing else about the purchase travels with it.

A copy in your iCloud. A trip you have not shared stays on your device and nowhere else, unless you turn on “A copy in your iCloud” (Settings, “Your data”). Then your unshared trips, with their attached files and the text read from them, are stored in the private part of your own iCloud, so that they come back on a new device. The switch is off until you turn it on. Turning it off later does not delete the copy that is already in your iCloud; deleting the trip, or “Erase my data”, does.

A shared trip lives in the iCloud of the person who shared it. When sharing stops, the others lose access to it, and the owner’s copy stays in the owner’s iCloud until the trip is deleted. A file you chose to keep “only on this phone” (section 5) is left out of iCloud entirely.

This storage is provided to you by Apple, under your own agreement with Apple and Apple’s privacy policy. We are not a party to it and cannot open it: we have no access to a trip in anyone’s iCloud. So that the app learns when a shared trip has changed, it registers with Apple’s push notification service and iCloud sends it silent notifications. None of this passes through us.

4.2 A trip published as a web page

When you publish a trip as a web page, the app encrypts a shortened version of the trip on your device and stores the encrypted copy in the public database of RoamDrop’s CloudKit container at Apple. The key that opens it is not stored with it: it travels only in the part of the link after the “#”, which browsers do not send to any server. Apple therefore holds a file it cannot read. Neither can we, unless someone gives us the link. Anyone who has the link can read the published page, on any device, with no account and no app.

What a published page contains: the trip’s name, where it starts and where it goes, its days, every card with its type, title, the line under the title, its day and time and a fixed set of practical details, and the shared packing lists without who brings what. A card’s title and the line under it are your own words and are published exactly as you typed them. What is never published: attached files, the text read from them, booking and ticket numbers, seat numbers, amounts and deposits, links, personal packing lists, and the names and contact details of the people on the trip.

While the link is on, the page follows the trip: changes you make in the app reach it within seconds, without asking you again. To take a page down, turn the link off on the trip’s Share screen. That deletes the encrypted copy, and publishing again later gives a new link. A page that is not updated stops opening 365 days after its last update.

When a page comes down. Deleting the trip, or using “Erase my data”, takes its page down as well; if the device has no connection at that moment, the page comes down as soon as the app is open with one. Deleting the app does not take a page down, so turn the link off before you delete the app. In version 1.1 of the app, deleting a trip or using “Erase my data” does not take a page down either: there, turn the link off before you delete the trip. The encrypted copy of a page that has expired is not removed until its link is turned off. We keep no list of anyone’s pages, so a page can be turned off only from a device signed in to the iCloud account that published it. If you can no longer do that, send the link to privacy@roamdrop.app and we will take the page down if we are able to; in any case it stops opening 365 days after its last update.

4.3 Recognition quality reports (only if you agree)

After you have used recognition a few times, the app asks once whether it may send quality reports. Nothing is sent until you say yes, and you can change your answer at any time in Settings, “Improve recognition”. Withdrawing is as easy as agreeing.

A report says: which reader produced the card and in which version, which type of card was guessed and which one you saved, whether you changed the type, the names of the fields you corrected (not what was in them), your thumbs up or down, the app build and the time. A report holds no document, no text read from a document, no image, no name and no field value. When you agree, the corrections and votes already stored on your device are sent together with later ones.

Document text, a separate switch. “Send document text too” is off until you turn it on. With it on, a report on a card you corrected also carries the text that was read from that document, so that we can reproduce the mistake. That text can contain whatever the document contained: names, booking codes, addresses. Turn it on only if you are comfortable with that. Text in which the app detects a passport, identity document, visa or payment card number is not sent, and the files themselves (images and PDFs) are never sent under any setting.

Reports are stored in the public database of RoamDrop’s CloudKit container at Apple, set up so that app users can add records and nobody but us can read them. Apple’s database notes which iCloud account created a record, as a code that is specific to RoamDrop. We see that code but cannot turn it into a name, an email address or an Apple Account, and we do not connect it to anything else.

Reports are kept for 24 months. The app deletes its own reports as they reach that age, when it is opened, and we clear out what is left by devices where the app is no longer installed. You can delete your reports at any time with “Delete my recognition data” (Settings, “Your data”). The list of what this device has sent is kept on the device, so use the button before you delete the app. Reports deleted this way are not sent again; corrections you make afterwards are reported as before while “Improve recognition” is on. In version 1.1 of the app, the deleted reports are sent again if “Improve recognition” is still on, so there switch it off first.

4.4 Usage statistics (on by default, can be switched off)

The app reports how it is used to PostHog (PostHog Inc., EU cloud, Frankfurt, Germany), which works for us as a processor under a signed data processing agreement. We use this to see where people get stuck, what nobody finds and on which phone or iOS version something breaks. The setting is called “Anonymous usage statistics”; it is on by default and you can switch it off at any time in Settings.

What is sent with each event: the name of the event (such as “trip created”, “card placed on a day” or “PDF exported”) and the screen it happened on; counts, mostly in ranges such as “3 to 5 cards”; labels from fixed lists, such as the type of a card or the option you picked when the app asked a short question; the app version and build and whether it came from the App Store or TestFlight; the iOS version; the device model (such as “iPhone17,3”) and whether it is a phone or a tablet; the language the app is shown in; the region set on the device, as a country code; and the time.

What is never sent: the contents of your cards, titles, notes, document text, links, file names, your name, your Apple Account, your email address or your location. Your IP address reaches PostHog with the request, as it does with any internet connection; the project is set to discard it and not to work out a location from it.

The identifier. Each event carries a random number that the app made up on your device. It is not derived from the device, the Apple Account or anything else, and it is not shared with any other app or service. It does let us tell one installation’s events from another’s over time, which is how we count whether people come back. In data protection terms that makes these statistics pseudonymous rather than anonymous. We do not join the number to a name or to any other data, and no profile is built from it. Switching the statistics off deletes the number and everything not yet sent. Events sent earlier stay in the statistics, but nothing connects them to you or to your device any more.

4.5 Things the app looks up for you

• Links. When you add or share a link, and later when a card made from a link needs its preview filled in, the app requests that page from your device and reads its title, description, picture and, where the page states them, facts such as a name, an address, dates or a price. If the page shows nothing without running its scripts, the app opens it once in a hidden browser view with a private session, lets it draw itself and reads what is shown; nothing is typed or clicked, and the session is discarded. The website receives what any website receives from a visitor, including your IP address. For a link to TikTok, YouTube or Pinterest the app asks that platform’s public embed service for the post’s title, author and picture; for Instagram it uses Apple’s link preview framework; a public Google Sheet is downloaded as a table. What comes back stays on your device.
• Maps and places. When you look for a place or an address in a card, open a trip’s map, or ask how long a journey between two cards takes, the app asks Apple’s map service (MapKit). What is sent is the words to look up: what you typed, or the place names and addresses on that trip’s cards and the trip’s destination. The same happens when you add a place, by a link to it or from a photo, screenshot or document that names a place together with its address: then only the place’s name, with its address or its point on the map as they were read, is sent, never the document itself or anything else in it, and of the answer the app keeps only what kind of place it is and Apple’s identifier for the place. When you open a card that has such an identifier, the app asks Apple Maps for the place by that identifier, sending nothing else, and shows its address, phone number and website beside Apple’s map, marked as Apple Maps, without storing them (section 3). Before any words go to the map, the app checks them for passport, identity, visa and payment card numbers and does not send words that carry one; a document in which such a number was found is not looked up at all. When a card for a place has no picture of its own, the app also asks Apple for a picture of it from the street (Look Around), sending only the place’s point on the map; that picture is shown in the app and never saved: it is not kept with the card, copied to iCloud, put into a PDF or published. The request goes directly from your device to Apple, which handles it under Apple’s own privacy policy. We have no server in between: we do not receive the request, store it or see it.
• Exchange rates. To show a budget in one currency, the app downloads a public table of exchange rates from open.er-api.com and, if that fails, from api.frankfurter.dev (European Central Bank rates). The request asks for the whole table and carries nothing about you, your trip or your amounts. The conversion is done on your device.
• Two small files from roamdrop.app. The app checks whether these documents have changed, and whether this version of the app is still supported and trip sharing is available. The request carries nothing about you; Netlify, which hosts the site, receives it like any web request.

4.6 Purchases

Purchases are made with Apple. When you buy a trip pass, the app attaches the trip’s internal identifier, a random code, to the purchase, so that the pass finds its trip again when purchases are restored. Apple keeps that code with the purchase; it says nothing about what is in the trip. Apple gives us sales figures by country and product, not the identity of buyers.

4.7 Writing to us, and this website

• Email. If you write to us, we receive your address, your message and whatever you attach. Our mail is handled by Migadu. Please do not send passports or other identity documents by email.
• News by email. If you leave your address in the form on this website, it is stored for us by Netlify, which hosts the site, and used only to send you news about RoamDrop. Write to privacy@roamdrop.app to be removed.
• Counting visits. roamdrop.app measures visits with PostHog (EU cloud), configured so that no cookie and no browser storage entry is written and no profile is created. To tell how many people the visits represent, PostHog combines your IP address and browser details with the name of the site and a secret that changes every day into a hash that cannot be reversed; the secret is destroyed once the day has been counted, and neither your IP address nor your browser details are stored. What is recorded is the page, the link that brought you, a coarse device type, and whether the App Store button or the email form was used. Setting “Do Not Track” in your browser switches the measurement off. See the Cookie Policy.
• Reading a published page. A published trip page is put together in the reader’s own browser: the page fetches the encrypted copy directly from Apple and opens it with the key from the link. Apple receives that request like any web request. The page sets no cookies and is not measured.

5. Passport, identity and payment documents

RoamDrop is made for tickets and bookings, not for identity or payment documents, and we ask you not to keep them in it. Because such documents still turn up among travel papers, the app looks for them, on your device, in the text it has read:

• A page that is itself a passport, an identity card, a driving licence, a residence permit or a visa (the app knows it by its machine-readable lines, or by its heading and the fields such a page prints) is not read into a card: none of its text is kept, except the dates a visa is valid from and to. In the app you are asked what to do with the file: keep it only on this device, or not keep it; such a file is never put in a shared trip. When it arrives through the share sheet you are asked the same, and nothing is kept before you answer. A kept file sits on a card named for the document (“Passport”, “Visa”, “Residence permit”, “ID card”, “Driving licence”), and that card, like the file, stays on this device: it is not in iCloud, not in the iPhone backup, not in the PDF and not on a published page.
• A booking or ticket that contains a passport, identity card, visa, driving licence or residence permit number, a payment card number or its security code has those numbers, and any date of birth, cut out of the text before the card is filled in. The card is made from what remains. Whether the file itself is kept, and where, is your choice; when it arrives through the share sheet, the file is not attached unless you have already chosen to keep such files on this device.
• A file kept “only on this phone” is left out of iCloud and is lost if the app is deleted. A file kept “in the trip” is stored like any other attachment: if the trip is shared or copied to iCloud, the file goes with it, and everyone on the trip can open it.
• Text in which such a number is detected is never included in a recognition report, whatever your settings, and a document in which one is detected is never looked up on the map (section 4.5).

The detection is automatic and works on patterns. It can miss a number that is printed in an unusual way, and it sees only what the reader managed to read. Do not rely on it: look at a card and its file before you share or publish a trip. We do not use such data for statistics, advertising or any other purpose.

6. Why we use information, and the legal basis

• To do what you ask of the app (keep and show your trips, read documents, share a trip, publish a page, look up a link, a place or a rate, check your purchases): performance of our contract with you, the Terms of Use.
• Recognition reports, document text, and news by email: your consent. You can withdraw it at any time; that does not affect what was done before.
• Usage statistics in the app and counting visits on the website: our legitimate interest in knowing what works and what breaks, limited to data that carries no content and no name. You can object at any time by switching the statistics off in Settings, or with “Do Not Track” on the website.
• Answering your messages, handling complaints, keeping the records the law requires and defending legal claims: legal obligation and our legitimate interest.

We do not sell personal data, do not use it for advertising, do not build profiles, and make no decisions about you by automated means. Your documents are not used to train any model.

7. How long things are kept

• On your device: until you delete the card, the trip or the app. Deleting the app removes what it stored on the device, except the allowance counters in section 3.
• In iCloud: until you delete the trip or use “Erase my data”. Deleting the app from a device does not remove what is in iCloud; you can also manage it in the device’s Settings, under your name, iCloud, Manage Storage. Backups of your device are yours and Apple’s, not ours.
• A published page: until you turn its link off. It stops opening 365 days after its last update (section 4.2).
• Recognition reports and donated text: 24 months from the day they are sent, or until you delete them (section 4.3).
• Usage statistics and website visit counts: up to 12 months at PostHog.
• Email: for as long as it takes to deal with your message and up to 24 months after the last one. A written consumer complaint and our answer are kept for at least 1 year, as Croatian law requires.
• News sign-up address: until you ask us to remove it or we stop sending news.

8. Who else is involved

• Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., USA): iCloud and CloudKit, Apple Maps, the App Store and push notifications. For your own iCloud, for Maps and for the App Store, Apple acts under its own terms and its own privacy policy with you. The database that holds recognition reports and published pages is provided to us by Apple as part of its developer services.
• PostHog Inc.: usage statistics and website visit counts, as our processor, stored in the EU (Frankfurt, Germany).
• Netlify, Inc. (USA): hosts this website, keeps the addresses left in the news form, and serves the two small files the app checks.
• Migadu (Switzerland): handles email sent to our addresses.
• Exchange rate services (open.er-api.com and api.frankfurter.dev) and the websites and platforms behind the links you add (including TikTok, YouTube, Pinterest and Google): they receive the request itself, as any website does, and nothing from your trips.
• Authorities, where the law requires us to disclose something we hold.

RoamDrop is run from Croatia, in the European Union. Statistics are stored in the EU. Apple, Netlify and the platforms above may process information in other countries, including the United States. Where personal data that we are responsible for is transferred outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework, where the provider is certified) or on the Commission’s Standard Contractual Clauses.

9. Your controls and your rights

In the app, in Settings:

• “Anonymous usage statistics”: on or off.
• “Improve recognition” and “Send document text too”: on or off.
• “Your data”, “A copy in your iCloud”: on or off.
• “Your data”, “A copy of my data”: one file (JSON) with your trips, cards and the people on them. Attached files are not in it; export those from their cards.
• “Your data”, “Delete my recognition data”: deletes the reports this device has sent (section 4.3).
• “Your data”, “Erase my data”: deletes every trip from this device and from iCloud, including trips you shared, which the others then lose; takes down the pages you published; deletes the recognition reports this device has sent; and starts the usage statistics again under a new random number. In version 1.1 it does not take pages down or delete recognition reports: there, turn the links off and use “Delete my recognition data” first.

By law. Depending on where you live, you have the right to ask for access to your personal data, for its correction or deletion, for its processing to be restricted, to receive it in a portable form, to object to processing based on legitimate interest, and to withdraw consent. Write to privacy@roamdrop.app; we answer within one month. You also have the right to complain to a data protection authority: in Croatia, the Personal Data Protection Agency (AZOP, azop.hr), or the authority of the country where you live.

What we can and cannot find. Most of what is described here carries no name, no email address and no account, so we usually cannot tell which reports or statistics came from you, and cannot look them up when asked. The controls in the app work without our knowing who you are, which is why they are the reliable way to exercise these rights. What we can find by your address is the email you sent us and your news sign-up.

10. Regional notes

EEA and UK. The legal bases are listed in section 6 and your rights in section 9.

United States. We do not sell your personal information and do not share it for cross-context behavioral advertising. You may ask for access to, or deletion of, personal information we hold about you.

Russia. RoamDrop does not collect, record or store the personal data of people in Russia on servers of its own. The tickets, bookings and other documents you add are kept by you: on your device, where they are also read, and, if you share a trip or keep a copy, in your own iCloud, which Apple provides to you under your agreement with Apple and stores under Apple’s terms. RoamDrop cannot open that storage and is not a party to it. Newer versions of the app do not offer the optional “Send document text too” setting (section 4.3) in the Russian App Store, so nothing read from your documents can reach RoamDrop from them; in version 1.1 the setting exists and is off unless you turn it on. What RoamDrop does receive from the app is limited to the usage statistics and recognition quality reports described in sections 4.3 and 4.4, which carry no name and no content and which you can switch off in Settings, and, if you choose to publish a trip as a web page, the encrypted copy described in section 4.2, which only the holder of the link can read.

11. Children

RoamDrop is made for adults organizing their own travel and is not directed at children. You must be at least 16 to use it. We do not knowingly receive personal data from children; if you believe a child has sent us any, write to us and we will delete it.

12. Security

What is on your device is protected by the device: its passcode, Face ID or Touch ID, and Apple’s encryption. What is in iCloud is protected by Apple. A published page is encrypted on your device before it leaves, and its key exists only in the link. Every request the app makes to our providers uses an encrypted connection. No method of storage or transmission is perfectly secure, so we cannot promise absolute security. See Security & Trust for more, and for how to report a vulnerability.

13. Changes to this policy

When this policy changes, the date at the top changes and the version it replaced stays in the archive. When a change affects what the app does with your information, the app shows a notice with a link to the new text. A feature that sends something new from your device is described here no later than the day it reaches you.

14. Contact

Questions about privacy? Email privacy@roamdrop.app, or write to Mariia Tararova (OIB 17233930874), Primorska 8, 51000 Rijeka, Croatia. See also our Terms of Use and Support page.