Security & Trust

Last updated: October 4, 2026

The simplest security guarantee RoamDrop has is structural: your trips and documents live on your device and, if you choose, in your own iCloud, and reading a screenshot or PDF happens on the device too. We run no server that receives them, so there is no store of everybody’s trips for anyone to break into.

How your information is protected

On your device. Your trips, cards, notes and attached documents are kept by the app on your device, protected by its passcode, Face ID or Touch ID, and Apple’s encryption. We hold no copy.
Read on your device. Screenshots, photos, PDFs and pasted text are read on the device. No document is sent anywhere to be read.
In your own iCloud, if you choose. A trip you share, and your other trips if you turn on “A copy in your iCloud”, are stored in iCloud through your own Apple Account, under Apple’s protection. We cannot open that storage.
Published pages are encrypted before they leave. A trip you publish as a web page is encrypted on your device. The key exists only in the link, in the part after the “#”, which browsers do not send to servers. Apple stores a file it cannot read, and anyone you give the link to can read the page.
Identity and payment documents. RoamDrop is not meant for them. On the device, the app looks for passport pages and for passport, identity, visa and payment card numbers in what it has read. A passport page is not read into a card, and such numbers are cut from the text before a card is filled in. You choose whether the file itself is kept, and a file kept “only on this phone” stays out of iCloud. The detection is automatic and can miss things, so do not rely on it.
Encrypted connections. The requests the app makes to Apple, to our statistics provider and to our website use encrypted connections. A link you add is fetched from the address you gave.
Minimal data. Usage statistics carry event names, counts and technical details, never the contents of your cards or documents, and can be switched off in Settings. Recognition reports are sent only if you agree. No advertising or tracking code is built into the app. See the Privacy Policy for exactly what is and is not sent.

Our practices

RoamDrop is run by one person, and nobody else has access to its developer, statistics and hosting accounts.
The app uses Apple’s own frameworks and no third-party code libraries, which keeps the attack surface small.
Reports of security problems are investigated and fixed, and people are told where the law requires it.

What you can do

Use a strong device passcode and biometric lock.
Keep device backups, or turn on “A copy in your iCloud”, so that you do not lose your trips with the device.
Invite to a trip only people you trust with it: everyone on a shared trip can edit it and open its files.
Treat a published page’s link like the page itself: whoever has the link can read it. Turn the link off when the page is no longer needed.
Check recognized details (dates, times, places, prices) against the original before relying on them.
Delete documents you no longer need.

Reporting a vulnerability

If you believe you have found a security issue in RoamDrop, please email security@roamdrop.app with enough detail to reproduce it. Please do not disclose it publicly until we have had a reasonable chance to investigate and fix it. We appreciate responsible disclosure.

Contact

Security: security@roamdrop.app · Privacy: privacy@roamdrop.app. See also our Privacy Policy and Legal Center.