Privacy Policy

Who provides information

The parent provides an email address, an optional display name and a password when creating an account. ROAMA stores a password hash, an internal account identifier, account role and status, and account timestamps. Sign-in creates access and refresh tokens; refresh-token hashes, expiry and revocation records are kept by the service. On the device, tokens are held in operating-system secure storage.

A parent creates child profiles and Explorers and provides their display names, avatar selections and age bands. ROAMA uses the age bands 6–9 and 10–12 and does not request a child's date of birth.

Mission evidence and Explorer Spot

As a child uses ROAMA, the service can store mission outcomes, answers, child-authored text, interpretations, certainty selections, structured answer metadata, timestamps and revisions of earlier answers. These records support mission progress, the Discovery Book and the world shown in the app.

An Explorer Spot can include a child-chosen label, description and metadata. When a Spot is changed, the earlier Spot remains in the history. ROAMA does not request GPS coordinates or use location tracking for this feature.

Other gameplay records include XP, level, mission and adventure completion, discoveries, rewards, collection items, companion state and progression data.

Why information is used

Information is used to create and secure the parent account, authenticate the parent, keep and refresh sessions, reset passwords, create and manage child profiles and Explorers, save and display gameplay progress, adapt content to the selected age band, and check subscription entitlements.

Before a parent can create or manage a child Explorer, the parent must explicitly consent to ROAMA processing the child's profile, gameplay, progress and child-generated content, including processing by the service providers needed to provide ROAMA. ROAMA records the consent version, status and time; existing accounts are asked to consent before child or Explorer data is accessed.

The active child and Explorer selection and language preference may also be stored locally on the device. Authentication tokens are stored in the device's secure storage.

Service providers and purchases

The ROAMA API runs on Render in Singapore. Application records are stored in MongoDB Atlas on AWS in Frankfurt, Germany (eu-central-1). MongoDB Atlas creates daily snapshots and retains them for 8 days.

Resend delivers password-reset email. The configured sending domain is roama.tech and the service location is Tokyo, Japan. RevenueCat receives the parent account identifier and subscription or purchase information to manage the production pro entitlement. Its applicable processing locations depend on RevenueCat's service and are not specified here.

Apple App Store or Google Play processes store purchases and billing when a subscription is bought through that store. The production product identifiers are roama_pro_monthly and roama_pro_yearly. Store subscriptions are managed by the relevant store; each provider's own terms and privacy information apply.

When a parent opts in to notifications in Parent Settings, ROAMA stores the parent's Expo push token, device platform, selected app language and notification preference, linked to the parent account. While this preference is enabled, ROAMA also stores the catalog identifier and time of an adventure view or mission start to evaluate reminders; these records are separate from product analytics, expire after 90 days and are deleted with the account. To deliver notifications, ROAMA sends generic text, a generic notification category and an allowlisted destination through Expo Push Service, which forwards it to Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM). The Expo payload does not include child, Explorer or content identifiers, child names, ages, answers, journal text, discoveries or location. Opting out removes push-token associations. When a logout request includes the current installation's notification-device ID, logging out removes only that installation's push-token association and device-permission record; other devices and parent-level notification preferences are not changed. A legacy logout request without a notification-device ID revokes authentication only and does not remove push records. Account deletion removes all push-token associations and notification-device associations and preferences for all of the parent's devices.

Technical and security information

The API uses an in-memory rate limiter keyed in part by the network address for abuse protection. The application also processes technical information needed to authenticate requests and operate the service. The regions above describe the configured services; no specific international-transfer mechanism is stated here because one has not been verified.

The service stores passwords as bcrypt hashes and refresh tokens as hashes. App-to-API traffic uses HTTPS. Requests for family records are checked against the signed-in parent account.

Deletion and retention

Information is kept for as long as needed for the purposes described here and applicable legal obligations. A parent can delete the ROAMA account in Parent Settings. The implemented deletion flow removes the parent account, associated child profiles and Explorers, their gameplay records, refresh sessions, password-reset records, notification token associations and preferences, and related push-delivery records from the application database. The steps are not a transactionally atomic database operation; if a database operation fails, some records may require further action.

Deleting one child or Explorer removes associated gameplay records and marks the profile record as deleted. No fixed retention period is configured for these individually soft-deleted profile records. MongoDB Atlas daily snapshots are retained for 8 days; deleted data may remain in a snapshot until it expires. Records may be retained where applicable law requires it.

If the production credential is configured, ROAMA requests deletion of the RevenueCat customer. RevenueCat handles its side of the request; processing may not be immediate, and completion is not guaranteed by ROAMA. Apple and Google store records are managed by those providers. Deleting a ROAMA account does not cancel a store subscription; the parent must manage or cancel it through Apple or Google.

Additional collection and retention details

When a parent opens the notification area in Parent Settings, the app sends ROAMA an app-generated notification-device identifier, the operating-system permission state (granted, denied or undetermined), and whether another permission prompt is allowed. The identifier is stored on the device and linked to the parent account when sent. Parent Settings also sends the device time zone, which is saved with the parent's notification preferences for delivery scheduling. If push registration is enabled and the parent opts in, ROAMA stores the Expo push token, device platform, app language and notification preferences linked to the parent. The generated identifier is not a hardware advertising identifier.

When child-engagement notifications are enabled, reminder-eligibility activity records the parent and Explorer identifiers, an allowed activity type, a catalog content identifier and a timestamp. It is separate from product analytics, expires after 90 days and is deleted with the account. Expo Push Service receives the push token, generic notification text and an allowed destination, then forwards the notification through APNs or FCM. Delivery receipts are retained for up to 7 days and notification idempotency records for up to 90 days; these records are removed with the account.

Product analytics records contain the parent account identifier, event type and time, and may contain a limited catalog content identifier. Events include signup, Explorer creation, adventure or mission interactions, paywall views, and subscription purchase or restore actions. They do not contain free text or mission answers. These are ROAMA's own product-event analytics records; the app does not integrate a third-party analytics SDK. Server-recorded signup, Explorer-creation and first-mission-completion events are collected only while analytics is enabled in the service configuration; typed client events are also accepted only while analytics is enabled. Product-event records expire after 90 days and are deleted with the parent account.

Operational render-error reporting stores a fixed error category, a request correlation identifier and a timestamp, not an account or Explorer identifier, stack trace or child-authored content. These records expire after 14 days. This is limited operational error reporting, not native crash reporting.

Provider deletion and notification-device records

If RevenueCat deletion fails or its server-only credential is unavailable, ROAMA attempts to queue the parent account identifier and retry deletion. A queued identifier is kept until RevenueCat returns success or reports that the customer is not found; retries run while the service is running and pause while it is stopped. There is no fixed expiry for a pending retry. If the retry record cannot be saved, the failure is logged and follow-up may be needed. Local account deletion proceeds independently.

Account deletion removes all push-token associations, notification preferences and activity, delivery receipts, idempotency records and device-permission records for all of the parent's devices. When a logout request includes the current installation's notification-device ID, logging out removes only that installation's push-token association and device-permission record; other devices and parent-level notification preferences and activity remain unchanged. A legacy logout request without a notification-device ID revokes authentication only and does not remove push records. While retained, each device-permission record contains the parent and app-generated device identifiers, permission state, whether another prompt is allowed, and timestamps, with no automatic expiry configured. The app-generated identifier remains in local app storage until that storage is cleared or the app is removed.

Contact and rights

For privacy questions or requests concerning personal information, contact the data controller, Kerem Eyüboğlu, at info@roama.tech. For account or data deletion, use Parent Settings or contact this address if you cannot access the account.