Privacy Policy
Roamkeep · com.roamkeep.app · last updated 12 August 2026
Roamkeep has no servers. Every family runs its own private database, which they create and control. Your location is sent to that database and nowhere else.
The developer of Roamkeep cannot see your location, your saved places, your family members, or your messages — not because of a promise, but because there is no system under the developer's control that receives them.
Who is responsible for your data
When your family sets up Roamkeep, you create your own project on Supabase, a third-party hosting provider. Your family is the controller of that data. You choose the region it is stored in, you hold the credentials, and you can delete the entire project at any time, which erases everything at once.
The developer of Roamkeep has no account access, no credentials, and no technical route into your project.
What Roamkeep collects, and where it goes
| Data | Why | Where it is stored |
|---|---|---|
| Precise location, including in the background | To show your position on your family's map, and to send arrive/leave alerts for places your family has saved | Your family's own database |
| Location history (a breadcrumb trail) | The map trail and the History timeline | Your family's own database, automatically deleted after 7 days |
| Email address | To sign in | Your family's own database |
| Display name and avatar | So your family can tell members apart | Your family's own database |
| Battery level | So your family can see when someone's phone is about to die | Your family's own database |
| Device notification token | To wake your phone when there is something for it to fetch | Your family's own database, and briefly the relay described below |
Roamkeep contains no analytics, no advertising, no trackers, and no crash reporting. Nothing is sent to the developer.
Why the app needs background location
Roamkeep's main purpose is to tell your family when you arrive home, or at school, or at any place they have saved — and to show your position on the family map. Those things have to keep working when the app is closed, or the app cannot do the one job it exists to do.
Roamkeep asks for this permission explicitly, explains it in the app before asking, and shows a permanent notification in your phone's status bar whenever it is recording your location. You can pause your own tracking at any time from inside the app.
The notification relay
There is exactly one piece of infrastructure the developer runs: a small relay that wakes up phones when there is something for them to fetch — a notification, or a change to your family's saved places. It exists because notification delivery on Android has to be signed with a key belonging to the published app, which a family's own database cannot hold.
The relay never receives the content of a notification. It receives a list of device tokens and sends each one a fixed, meaningless wake-up signal. Your phone then fetches the actual details from your family's own database and writes the notification text itself, on the device.
The relay therefore sees device tokens, how many there are, and when. It cannot see names, places, coordinates, messages, or even what kind of event occurred — every wake-up is identical, and many of them produce no notification at all. It stores nothing and logs nothing.
The relay's complete source code is published, and this claim can be checked against it.
Who can see your location
Only the members of your Keep. The database enforces this with row-level security, so it is a property of the data itself rather than of the app: a modified or malicious client still cannot read another family's rows.
Roamkeep does not sell data, does not share data with advertisers, and has no third-party SDKs that receive your data.
Children
Roamkeep is designed for families and is intended to be set up by a parent or guardian, who invites the rest of the household. Members marked as children cannot disable their own tracking; adults can. Roamkeep is not directed at children as an audience and children cannot create a Keep of their own without an invitation.
Because your family holds all of the data, a parent can delete a child's location history, remove them from the Keep, or delete the entire database at any time, without asking anyone.
Keeping and deleting your data
- Location history is deleted automatically after 7 days.
- Leaving a Keep removes your membership and your location history.
- Deleting the Supabase project destroys everything your family ever recorded, immediately and permanently.
- Disconnecting a device (Settings → Disconnect this device) clears the app's stored credentials and stops all tracking on that phone.
Because the developer holds no copy of your data, there is no deletion request to submit and nobody to ask. Deleting it is entirely in your hands.
Security
All traffic between the app and your database is encrypted in transit (HTTPS). Access is controlled by row-level security enforced by the database. Setup links carry your family's server address in the part of a URL that browsers never transmit to a web server, so it does not appear in anyone's access logs.
Changes to this policy
If this policy changes materially, the date at the top of this page will change and the change will be described in the app's release notes. Because the app is source-available, any change to what the software actually does is publicly visible.
Contact
Questions about this policy: privacy@roamkeep.app
See also the Terms of Use, which covers what Roamkeep does and does not promise — in particular that it is not an emergency service.