Privacy policy · WeRoam

Who we are

WeRoam is a free mobile app for planning group trips, on iOS and Android. In this policy, “we” means WeRoam and “you” means the person using it. WeRoam is responsible for the personal data this policy describes.

What this policy covers

This policy covers the WeRoam app and the website weroam.app, including its launch waitlist form.

WeRoam helps a group pick dates, like destinations, plan an itinerary on a map, keep trip documents and share expenses. It works out who owes whom. It never holds or moves money: you settle up with each other outside the app.

What we collect and why

Signing in

You sign in with your Google or Apple account. There is no WeRoam password.
Sign in with Apple may not be available yet. Until it is, Google is the only way to sign in.
Your Google or Apple account is your identity in WeRoam. If you sign in once with Google and once with Apple, you get two separate WeRoam accounts that are not linked.
If you sign in with Apple, your email address may be a private relay address that Apple creates.

Your profile

Your name (required), up to 40 characters.
Your confirmation that you are 18 or older (required). We do not verify it.
An account ID of 8 characters that the app creates for you. You cannot choose or change it, and it is never reassigned to another account, even after you delete yours.
A public or private setting for your profile. It starts as private.
A photo (optional): JPG, PNG or HEIC, up to 10 MB. It is uploaded as a JPEG, and the app removes the location data (GPS) stored in the image before uploading it.
Your exact age (optional). An age under 18 is rejected.
A bio (optional), up to 140 characters.
Four optional fields, each chosen from a fixed list: trips per year, languages, what you bring to the group, and travel style.
Your tastes on four axes — climate, setting, pace and budget — which you set when you sign up. We use them to rule destinations out of your trips’ catalogue. Nobody else sees what your tastes ruled out; they only see the catalogue that results.

Trips and the itinerary

Each trip’s name, its mode (destination still to decide, or already decided), tentative dates, currency, destination, and an optional link to the group’s chat in another app.
Who is in the trip (up to 12 people), who its admin is, and when each member joined.
Requests to join a trip, with the time each request was made.
The days each member marks as blocked in the date poll.
The destinations each member likes.
Itinerary entries, each with a title, an optional place and an optional note, and the activities each member likes.
When you add a place found through Mapbox, the details Mapbox provides — name, category, opening hours, phone number and photo — are saved in the trip.
When a trip is finished, it moves to your history.

If you export the itinerary as a PDF, the file is created on your phone and handed to your phone’s share menu. We do not store it.

Documents and receipts

Each trip has a shared zone for all its members and a private zone for each member. A new document is private unless you choose otherwise.
For each document we store the file, its title, date, type and a note.
Files can be PDF, JPG, PNG or HEIC, up to 10 MB each. A trip holds up to 30 shared files, and each member up to 10 private files.
Each expense can have one receipt (an image or a PDF), up to 100 receipts per trip.
Documents and receipts are stored as you upload them, including any location data inside the file. Only profile photos have their location data removed.
When you open a document, a copy stays on your phone so you can open it again without an internet connection.
We do not scan files.

Expenses and payments

We store expenses so the app can work out who owes whom. We never hold, move or process money.

For each expense: its amount and currency, how it is split (equally, with some members left out if you choose, or with exact amounts), a description of up to 40 characters, and its date.
Who last edited the expense, and when. We do not keep earlier versions.
For an expense in another currency: the exchange rate our provider offered, the rate actually used (you can adjust it) and the converted amount. The rate used is fixed together with the converted amount. If the provider does not answer, an expense in another currency cannot be saved.
Payments you record between members, with their amount and date.
Balances are not stored: the app works them out each time from the expenses and payments. The suggested transfers for settling up are calculated on your phone.
WeRoam does not send payment reminders.

Your location

WeRoam uses your location in two places only: “near me” on the trip map, and the option that centres activities on where you are.
The app asks for permission when you turn “near me” on. If you say no, the map shows the trip’s destination instead.
WeRoam only asks to use your location while you are using the app. On Android it asks for precise and approximate location.
Your position is used in the moment. We do not store it, we do not share it with your group, and nothing is kept from one use to the next. What Mapbox’s own software may collect is under “Services we use”.
To find places near you, the app sends your position to Mapbox. In “near me”, if you are more than 5 km from the trip’s destination, the app does not ask Mapbox for places.

Notifications

WeRoam sends push notifications for three events only:

a trip admin approves your request to join, and someone you have blocked is already in that trip;
a trip admin lets someone you have blocked into a trip you are in;
you are removed from a trip.

The notification itself shows no names and no subject. New expenses never trigger a notification.
We ask for permission the first time you create or join a trip, and explain why. If you say no, we never ask again. You can turn notifications on or off in your phone’s settings.
When you allow notifications, we register a push token for your device. We delete it when you sign out, when you delete your account, and when Firebase reports that it is no longer valid.
Each notice addressed to you is also stored, so you can read it in the app. It is deleted with your account.
Notifications are delivered by Firebase Cloud Messaging, a Google service; on iPhone, through Apple’s push notification service (APNs). Firebase collects your phone’s operating system version, the device’s model name, brand and form factor, and the app’s version, and creates a Firebase installation ID.

Reports and blocks

When you report a user, a piece of text or an uploaded file, we store the report: who made it and whose content it is (by their account IDs), and one of four categories. There is no free-text field.
A report keeps a copy of the reported text as it was at that moment, so it can be reviewed even if the text changes later.
When you block someone, we store that block.

Who can see what

Your profile

You see everything in your profile. Your history of finished trips is visible only to you: not even the people in your current trips can see it.
People in an active trip with you see your full profile, including your photo and your account ID, whatever your public or private setting says. This stops, in both directions, when one of you leaves the trip, is removed from it or deletes their account. After that you see each other as people outside your trips do, but the remaining members still see your name on your balance line and on the expenses and payments you were part of.
Other people signed in to WeRoam, if your profile is public, see your name, exact age, bio and the four optional profile fields. They do not see your photo or your account ID.
Other people signed in to WeRoam, if your profile is private, see only your name.
People can invite you to a trip only by typing your exact account ID: there is no search by name and no partial match. Blocking also works by account ID, and trying to block one can show whether that ID exists.
Your email address is never shown to other members, and profiles carry no contact details.

Inside a trip

Every member sees every expense, every receipt and what each member owes.
Only the admin sees the list of requests to join, with each person’s name and the time of the request.
Someone waiting for approval is shown only the trip’s name, how many members it has, its dates and whether the dates are settled, and never who the members are or any amounts. From how the app responds, they may still be able to work out how many former members still have money pending in the trip, or that someone is changing something in it at that moment.
Only members see the link to the group’s chat.
In the date poll, members see who blocked each day.
Liked destinations and liked activities are shown with the faces of the members who liked them.

Documents

Your private documents are seen and deleted only by you. Not even the trip admin can see them.
Documents in the shared zone are visible to every member. Any member can upload one, and the person who uploaded it or the admin can delete it.
Every member can open and download shared documents and receipts as they were uploaded, including any location data inside the file.
Members who open a shared document keep a copy on their phone. If the document is deleted or removed, their copy is deleted the next time their app connects.

Blocking

You can block anyone. Outside a trip you share, neither of you can invite or find the other by account ID, and neither of you sees the other.
Inside a trip you both belong to, nothing changes: names, expenses and the balance stay visible.
The person you block is not told, but may be able to work it out.

WeRoam’s administrator

WeRoam’s administrator reviews reports. A review shows the reported item, who reported it and whose content it is; never the trip’s expenses, balances or member list.
Private documents are not shown in moderation, and we do not open them.

Services we use

Supabase provides our database, sign-in, real-time updates and file storage. Receipts, documents and profile photos are kept in three private storage areas.
Google and Apple handle sign-in.
Mapbox provides the maps, the place search for activities and “near me”, and the place search for the itinerary. When you use “near me” or centre activities on where you are, Mapbox receives your position. Photos of places saved in a trip load from the web address saved with the place, normally a Mapbox address, so that server receives your phone’s request.
Mapbox’s map software on your phone can also send Mapbox usage data (telemetry), under Mapbox’s own privacy policy. Mapbox says this can include your location, randomly generated identifiers, your IP address (which it says it deletes after 30 days) and your phone’s user agent, and that users can opt out of it.
ExchangeRate API proposes the exchange rate for expenses in another currency and provides the rates shown on the destination card.
OpenWeather provides the weather forecast on the destination card.
Pexels is the source of the destination photos. Your phone never connects to Pexels: we copy the photos to our own storage when we prepare the catalogue.
Google Maps opens only when you tap “open in Google Maps”. The app sends it the coordinates of that day’s stops, never their names. We do not store or record that you did it.
Firebase Cloud Messaging, from Google, delivers push notifications, through Apple’s push notification service (APNs) on iPhone, as described above.
The app uses no analytics, crash reporting or advertising services.

What we never do

Hold, move or process money. WeRoam has no payment system; you settle up outside the app.
Store the position the app uses for “near me” or for centring activities on you, or share it with your group.
Show your email address to other members.
Store your nationality.

How long we keep data

Nothing is deleted just because it is old. Your data stays while your account exists, and a trip’s data and files stay while the trip exists.
The record that you were a member of a trip is never deleted, even after you leave. If you delete your account, it stays under an internal ID that is never shown.
Requests to join a trip do not expire while they are pending.
Reports are never deleted, even after the trip or the accounts involved are deleted.

When you leave a trip or are removed from it

You no longer see the trip at all, including what you owe or are owed there.
The trip’s expenses stay, including the ones you were part of, and your line stays in its balance while you still owe or are owed money there.
The remaining members still see your name on your balance line and on the expenses and payments you were part of. Otherwise, you and they see each other as people outside your trips do.
Your private documents in that trip are removed from it at once; the files themselves are deleted from storage by a later cleanup. Shared documents you uploaded stay, and receipts stay with their expense.
Your liked destinations, your marks in the date poll and the activity categories you marked in the discover view are removed, and your tastes no longer rule destinations out of that trip’s catalogue.
Itinerary entries and liked activities you added stay, without showing who added them.
If you were the admin of a trip that is not finished, the role passes to the longest-standing member.

Being removed by the trip’s admin has the same effect as leaving. In a trip where you are the only member there is no leaving: you delete the trip if it has no expenses, or finish it if it has.

When you delete your account

You can delete your account at any time, even if you still owe money in a trip. How to do it, and how long it takes, is on Delete your account.

These are deleted:

your name, photo, bio, exact age and the four optional profile fields;
your tastes;
your private documents;
your blocks, in both directions;
your marks in date polls;
your liked destinations, and your tastes’ effect on each trip’s destination catalogue;
the activity categories you marked in the discover view;
pending requests for you to join a trip, whether you asked to join or someone invited you;
your devices’ push tokens and the notices addressed to you;
your sign-in record on our servers.

Your name is removed from your profile and from your trips; a report that copied it keeps that copy (see below). Some things stay, so each trip still adds up to zero for the other members and their shared records stay complete.

Shown as “Deleted account” instead of your name:

expenses, whole, with their description, the “last edited by” mark and their receipt;
payments between you and other members;
documents you uploaded to a trip’s shared zone;
the date you joined each trip;
your admin badge, only in finished trips; in a trip that is not finished, the admin role passes to the longest-standing member;
your line in each trip’s balance, while you still owe or are owed money there (the amount itself is not stored: the app works it out from the expenses and payments);
notices sent to other people that mention you.

Kept with no author or sender at all:

itinerary entries you added, with their title and note, and the activities you liked;
invitations that trips you were admin of sent to other people, which whoever is admin now takes over.

Kept on our side and never shown to other members:

your account ID, retired: we keep a record of it, linked to an internal ID, only so that it is never reassigned to another account;
an internal ID for your place in each trip, which ties the items above together;
reports you made or that were about you, with that internal ID, both people’s account IDs and the copy of the reported text, which can be your name or your bio. We keep them as a record of why content was removed or an account was closed.

Trips where you are the last active member are deleted completely, with their files, even if former members still owe or are owed money there; those records are destroyed too.

Your choices and rights

You can switch your profile between public and private.
You can refuse location permission; the map then shows the trip’s destination. You can refuse notifications, and we will not ask again.
You can leave any trip at any time, unless you are its only member, and delete your account at any time.
Depending on the law that applies to you, you may have the right to access your data, correct it, delete it, receive a copy of it and object to how we use it. To make a request, write to us at hello@weroam.app. You can also complain to your local data protection authority.

Children

WeRoam is only for people aged 18 or older, because we do not process data about minors. You confirm your age with a checkbox when you sign up; we do not verify it. If you enter an exact age under 18, the app rejects it.

The website and the waitlist

weroam.app sets no cookies, uses no local storage and uses no analytics. It loads nothing from other companies: its fonts and images are served from the site itself.
The waitlist form asks only for your email address. We use it only to tell you when WeRoam is on the App Store and Google Play.
When you join, we store three things and nothing else: your email address (in lower case, without spaces around it), the date you joined and the version of this policy you accepted.
They live in WeRoam’s own database, the same Supabase project as the app, in a table nobody can read from outside: the form can only add an address to it.
We do not send you a confirmation email.
We delete the whole list once we have sent the launch announcement. Before that, write to us at hello@weroam.app and we remove your address by hand.

Changes to this policy

When we change this page, we update the date at the top.

Contact

Questions about this policy or your data: write to us at hello@weroam.app.