Your data in Roamingo.
As a guest, trips and files are stored in this browser or device. Clearing its data deletes that copy.
When you sign in
Firebase manages the account. The trips you create with the account and the ones you choose to import are synced with Cloud Firestore. The files you upload are stored in Cloud Storage for Firebase. Cloud Functions for Firebase processes authenticated requests. All three are Google services. Google and Apple credentials are handled by those providers.
Shared trips
Only authorized members can access the trip and its files. Editors can change its content; the owner manages permissions. An invite link does not make the trip public. Your profile name is visible to the other people on the trips you share. The organizer sees the email address you accepted the invitation with.
Notifications and maps
Connecting Gmail or Outlook is optional. Roamingo looks for possible bookings using read-only access and saves suggestions for you to review. If AI extraction is enabled, the subject, sender and part of the content of those emails are sent to the configured provider (OpenAI or Anthropic). You can disconnect your email from Profile; its connection and pending suggestions are deleted.
The apps can send you notifications about invitations, new expenses, changes to today's plan and reminders. They require your permission and you can turn them off in your system settings or in Profile. When you open Google Maps or load a map, Google receives the location query and the usual connection data.
Vault and personal data
The vault encrypts documents and metadata on the device before syncing them. Its password and recovery key are separate from your Firebase sign-in. Recovering your account does not let anyone decrypt the vault. It locks after five minutes of inactivity or when you sign out. The emergency card includes only the fields you choose to export.
Removing an item from the vault hides it, but its encrypted file may be kept to prevent data loss across devices and still counts toward the storage used. Deleting the account includes those kept files.
The travelers and households you add do not get access to the trip by appearing on the list. Personal memories are stored with account permissions; their photos, if they belong to the trip's shared files, remain accessible to the trip's members.
Links, calendars and versions
You can share a selection of the itinerary through a read-only link or a calendar subscription, with expiry and revocation. Anyone with the link can view that selection. The vault, private files, notes and booking codes are not included. Revoking a link prevents future views, but does not delete copies already downloaded.
History keeps up to 50 versions per record for 30 days, subject to a quota of 10 MiB per trip or account. A restore creates a new version. Permanently deleted files cannot be recovered. Deleting an account or trip takes precedence over that retention.
Weather, currencies and imports
When you request the weather, the backend sends the place's coordinates to MET Norway and keeps a cached forecast. When you update a conversion, it sends the currencies and, where applicable, the date to Frankfurter. Reading images and PDFs with OCR happens on the device; on the web you first need to download its models. Map packages you import are stored locally and must have a license that allows their use.
Operational flight tracking and AI itinerary generation remain turned off until access, terms and budget are verified. Deterministic suggestions use your trip's data and require your review.
Usage metrics
We use Google Analytics for Firebase for metrics on visits, trip creation, shared links and clicks on the founder offer. We do not send titles, email addresses, trip identifiers or invite codes in these metrics. Private routes are grouped as /private, without parameters or fragments. It uses cookies or browser identifiers to count visits.
Payments
Roamingo does not receive or store your card details. The founder plan is paid on a Stripe page. Stripe sends us the subscription and customer identifiers, their status and the purchase email; of the email we keep a fingerprint that cannot be read back, until the purchase is linked to your verified account.
In the apps, Roamingo Plus is bought with your Apple (App Store) or Google (Google Play) account, which process the payment. We use RevenueCat to validate those purchases: it receives your Roamingo account identifier and the store receipts, and tells us the product, status and expiry date of your subscription.
When you delete your account we erase your subscription status and ask RevenueCat to delete its record. From Stripe we keep only the identifier of the deleted subscription so we can ignore its renewals: we do not recreate the customer, the email fingerprint or the pending entitlement. Payment references and review notices are kept for up to 90 days; unconfirmed purchases, for up to 30 days. Deleting the account does not cancel a subscription: cancel it in the store or in Stripe. See the terms of use.
Deleting data
From Profile you can delete the local copy or delete your account and the trips you own. Signing out deletes that account's local copy. Documents or summaries you have exported remain under your control and that of their recipients.