Privacy Policy
Roamkeep · com.roamkeep.app · last updated 17 October 2026
No server of ours holds your family's data. Every family runs its own private database, which they create and control. Your location is sent to that database. None of it is sent to the developer, and the few other services your phone uses are listed below.
The developer of Roamkeep cannot see your location, your saved places, your family members, or your messages, not because of a promise but because there is no system under the developer's control that receives them.
Who is responsible for your data
When your family sets up Roamkeep, you create your own project on Supabase, a third-party hosting provider. Your family is the controller of that data. You choose the region it is stored in, you hold the credentials, and you can delete the entire project at any time, which erases everything at once.
The developer of Roamkeep has no account access, no credentials, and no technical route into your project.
When the app sets up your family's server, it asks for a temporary access token from your Supabase account. The token is kept only in the app's memory, sent only to Supabase, never saved, and forgotten when setup ends. The app then reminds you to delete it in Supabase.
What Roamkeep collects, and where it goes
| Data | Why | Where it is stored |
|---|---|---|
| Precise location, including in the background | To show your position on your family's map, and to send arrive/leave alerts for places your family has saved | Your family's own database |
| Location history: a breadcrumb trail of positions, each with its speed and how precise it was | The map trail and the History timeline | Your family's own database, automatically deleted after 7 days |
| Check-ins: arriving at and leaving saved places, and SOS alerts with where they were sent from | Alerts to your family, the activity feed and the History timeline | Your family's own database, automatically deleted after 7 days |
| Who is told about each check-in: which members are to be notified of it, worked out when it happens from everyone's notification choices | So turning alerts back on later doesn't bring back ones you chose not to get | Your family's own database, deleted with the check-in after 7 days |
| Saved places: each place's name, icon, position and size, and who added it | For arrive/leave alerts, and to show the places on the family map | Your family's own database, until someone in the family deletes the place. Each member's phone keeps a copy, so alerts work while the app is closed. |
| Email address and password | To sign in | Your family's own database. The password is kept only as a one-way hash, which can't be turned back into the password. |
| Display name and avatar | So your family can tell members apart | Your family's own database |
| Your place in the family: whether you are an owner, an adult or a child, whether your sharing is paused, your status (for example "Not sharing: notifications are off"), the saved place you are at, and when your phone last reported in | So your family knows who can do what, and whether you are sharing right now | Your family's own database, until you leave |
| Notification choices: whether you get arrival and departure alerts at all, and anyone whose arrivals and departures at a particular place you've chosen not to hear about | So you are told only what you want to know. An SOS always comes through. | Your family's own database, until you change them or leave |
| Battery level | So your family can see when someone's phone is about to die | Your family's own database |
| Requests to join a Keep or, from a child, to delete their account, and password reset codes | So owners can approve new members and delete a child's account, and so a forgotten password can be reset without email | Your family's own database. A reset code is stored only as a one-way hash, and works for 15 minutes. An owner can make one for any member who isn't an owner, adults included. That member's phone is sent a notification as soon as a code is made for them and again when it's used, and the app shows it too when it is next opened. A code stops working if, before it is used, its member becomes an owner or leaves the family, or whoever made it is no longer an owner. |
| Device notification token | To wake your phone when there is something for it to fetch | Your family's own database, and briefly the relay described below |
Roamkeep contains no analytics, no advertising, no trackers, and no crash reporting. Nothing is sent to the developer.
Why the app needs background location
Roamkeep's main purpose is to tell your family when you arrive home, or at school, or at any place they have saved, and to show your position on the family map. Those things have to keep working when the app is closed, or the app cannot do the one job it exists to do.
Roamkeep asks for this permission explicitly, explains it in the app before asking, and shows a permanent notification in your phone's status bar whenever it is recording your location. If that notification can't be shown, Roamkeep doesn't record. With notifications turned off for Roamkeep, it stops sharing your location, your family sees "Not sharing: notifications are off", and the app shows you how to turn them back on. Adults can pause their own sharing from inside the app for a set time (an hour, two, or the rest of the evening), and it turns back on by itself when the time is up. Children can't pause, but anyone can disconnect their phone, and the family sees that they did.
What the developer runs
- The notification relay, described below. It is the only service the developer runs for the app itself.
- The Roamkeep websites, roamkeep.app and get.roamkeep.app. They have no analytics and set no cookies. Like most websites, their hosting provider keeps standard access logs (IP address, page, time and browser) for 90 days. An invite link's family details are in the part of the address that browsers never send, so they never appear in those logs.
- A demonstration server for app store review. It contains only invented people and invented places.
The notification relay
The relay wakes up phones when there is something for them to fetch: a notification, or a change to your family's saved places. It exists because notification delivery on Android has to be signed with a key belonging to the published app, which a family's own database cannot hold.
The relay never receives the content of a notification. It receives a list of device tokens and sends each one a fixed, meaningless wake-up signal. Your phone then fetches the actual details from your family's own database and writes the notification text itself, on the device.
The relay therefore sees device tokens, how many there are, and when. It cannot see names, places, coordinates, messages, or even what kind of event occurred. Every wake-up is identical, and many of them produce no notification at all. It stores nothing and logs nothing.
The relay's hosting provider applies a rate limit to it and keeps a short record of requests it blocks. Those records identify the family server that made the call, never your phone. Your device never contacts the relay directly.
The relay's complete source code is published, and this claim can be checked against it.
Other services your phone talks to
- Google. Wake-ups are delivered through Google's Firebase Cloud Messaging, which sees your phone's notification token and when a wake-up arrives, and nothing about your family. Your phone's position is worked out by Google Play services on the phone itself, under your phone's own location settings.
- OpenStreetMap. The map pictures come straight from OpenStreetMap's tile servers. Like any website, they see your phone's IP address and which part of the map is being shown, and the app tells them the request comes from Roamkeep, as their rules ask. They don't see who you are or anyone's location in your family. Their privacy policy applies.
What stays on your phone
To keep working while the app is closed, Roamkeep keeps a few things on your phone itself: your sign-in to your family's server, your family's saved places, your last few positions (so it can tell real movement from GPS drift), arrivals and departures waiting to be sent when the signal comes back, and a diagnostic record of what the app did, which you can read in the app and which keeps nothing older than 7 days. Android does not back any of it up. Disconnecting the device or signing out deletes it. Notifications the app has shown stay in your notification shade until you dismiss them.
Who can see your location
Only the members of your Keep. The database enforces this with row-level security, so it is a property of the data itself rather than of the app: a modified or malicious client still cannot read another family's rows.
Roamkeep does not sell data, does not share data with advertisers, and contains no advertising or analytics code.
Children
Roamkeep is designed for families and is intended to be set up by a parent or guardian, who invites the rest of the household. Members marked as children cannot pause their own tracking, leave the Keep or delete their own account; adults can. A child can always disconnect their device, and the family sees that they did. A child can ask the Keep's owners to delete their account (Settings → Leave and delete my account), and an owner completes it from the Family tab. Roamkeep is not directed at children as an audience and children cannot create a Keep of their own without an invitation.
Because your family holds all of the data, a parent can remove a child from the Keep, which deletes their account and everything recorded about them on your family's server, or delete the entire database at any time, without asking anyone.
Keeping and deleting your data
- Location history is deleted automatically after 7 days.
- Check-ins (arrivals, departures and SOS alerts) are deleted automatically after 7 days. Every phone that is sharing runs this clean-up once a day, and so does your family's server where it is set up to.
- Leaving your family (Settings → Leave and delete my account) deletes your account on your family's server: your sign-in, your membership, your location history and your check-ins. Places you added stay with the family. The same happens when an owner removes someone, or declines someone's request to join. Two people can't leave this way: a member marked as a child, who asks the owners instead, and the only remaining owner of a Keep with other people in it, who must make someone else an owner first.
- Deleting the Supabase project destroys everything your family ever recorded on it, immediately and permanently, subject to Supabase's own retention of backups.
- Disconnecting a device (Settings → Disconnect this device) clears the app's stored credentials and everything else it keeps on that phone, and stops all tracking there. Your family is told: that device is marked offline and your status is set to ‘Disconnected this device’, so switching tracking off is visible to them rather than looking like a phone that simply went quiet. If the phone has no connection at that moment, the app says your family couldn't be told.
Because the developer holds no copy of your data, there is no deletion request to send to us. Deleting it is in your family's hands.
Security
All traffic between the app and your database is encrypted in transit (HTTPS). Access is controlled by row-level security enforced by the database. Passwords must be at least 8 characters and can't be one of the most commonly used, and changing a password needs the current one. Setup links carry your family's server address in the part of a URL that browsers never transmit to a web server, so it does not appear in anyone's access logs.
Changes to this policy
If this policy changes materially, the date at the top of this page will change and the change will be described in the app's release notes. Because the app is source-available, any change to what the software actually does is publicly visible.
Contact
Questions about this policy: privacy@roamkeep.app
See also the Terms of Use, which covers what Roamkeep does and does not promise, in particular that it is not an emergency service.