Your memories deserve a careful home.

What Roam Keeps collects

Account and sign-in information

Roam Keeps stores your username, display name, account email, email verification state, preferences, plan and usage totals, and account creation date. Passwords are stored only as password hashes. If you connect Google, Roam Keeps stores Google’s stable account identifier and a verified email address; it does not receive your Google password.

Your travel content

Roam Keeps stores the trips, cities, countries or regions, dates, notes, photos, comments, reactions, collaborators, book designs, and public selections that you choose to save. Photos can include people and places, so they may be sensitive even when they do not contain a name.

Photo details

Your browser can read a photo’s capture date and GPS metadata to suggest a date and nearby city. Precise GPS coordinates are not saved by Roam Keeps. The resized journal copy is re-encoded without camera metadata. If you explicitly preserve an original-quality file, that original can still contain its embedded metadata.

Technical and device information

Servers receive ordinary request information such as IP address, request time, route, browser details, and security or error events. Operational logs are used to keep the service reliable and investigate abuse. Your browser also stores unfinished drafts, the last account used on that device, and short-lived return or invitation state.

Orders and messages

If you subscribe to Plus, Roam Keeps stores Stripe customer and subscription references, subscription status, confirmed access dates, checkout references, and processed payment-event identifiers. Stripe collects payment and billing details. Roam Keeps does not store card numbers, and subscription records contain no journal text, photos, or locations.

If print ordering is enabled and you order a product, Roam Keeps keeps an order reference, product, displayed price, status, and tracking details. Payment and delivery providers collect the billing, payment, and shipping information needed to complete the order. Roam Keeps also processes the name, reply address, subject category, message, and account context you provide through the contact form when requesting support or exercising a privacy right. The conversation is stored in Roam Keeps so an authorized administrator can review your request, email a reply, and keep the response with it.

How Roam Keeps uses information

Roam Keeps uses personal information to:

• create and secure your account and recover access;
• store, organize, display, export, and print your memories;
• support shared trips, invitations, comments, and reactions;
• create public pages only after you choose what to publish;
• send account, invitation, order, and optional memory emails;
• provide AI writing help only when you request a suggestion;
• operate, secure, troubleshoot, and improve the service; and
• meet legal, accounting, and fraud-prevention obligations.

Optional “On this day” and yearly recap emails can be turned off in Account & privacy. Roam Keeps does not use your journal or photos to build an advertising profile or train a Roam Keeps model.

Who can see a memory

Standalone memories are visible to you. Memories inside a shared trip are visible to accepted members according to their role. Trip owners control membership and can delete the trip, including contributions from companions.

A public timeline or keepsake is created only after its owner reviews and publishes a selection. Anyone who receives or guesses its readable address may be able to view, copy, download, or screenshot that published content. Turning off a link stops future access through Roam Keeps, but cannot recall copies already saved or cached by other people or social networks.

Service providers and transfers

Roam Keeps gives providers only the information needed for their part of the service. Current providers may include:

• Oracle Cloud Infrastructure for Canadian-region hosting, private object storage, backups, logs, and account email delivery;
• Google when you choose Google sign-in;
• OpenAI when you request writing help. A memory suggestion sends a low-detail copy of one selected photo plus the place, date, and draft text shown in the editor. A trip-story request sends only the memories you select and does not send photos;
• Stripe for checkout, payment, tax, billing, and shipping collection; and
• Prodigi for printing, delivery, and order status.

The primary application database, photos, backups, and operational logs are hosted in Montréal, Canada. Google, OpenAI, Stripe, Prodigi, or their subprocessors may process information outside Canada. Information processed in another country can be subject to that country’s laws and lawful access requests.

You can review the providers’ own notices at Oracle, Google, OpenAI, Stripe, and Prodigi.

Roam Keeps may also disclose information when required by law, to protect a person or the service from harm, or as part of a business transfer where the recipient must continue to protect the information.

Storage and security

Hosted photos are kept in private OCI Object Storage buckets. Data is encrypted in transit and at rest, and each environment’s media bucket uses a customer-managed AES-256 Vault key. Database access, storage access, and operator access are restricted by separate credentials and roles.

Roam Keeps uses secure session cookies required for sign-in and request protection. It does not use advertising cookies. On staging and production, Oracle Cloud Infrastructure browser monitoring measures page loads, browser and device type, and API timing and status. It does not create a tracking cookie or use your Roam Keeps account or sign-in session identifier. Page categories replace identifying paths; query strings and fragments are redacted. Journal text, photos, form contents and screen text are not collected by this monitoring. Browser requests still expose network information such as your IP address to Oracle as the service provider. Browser monitoring respects Global Privacy Control and Do Not Track, and is excluded from recovery, invitation and admin pages. Monitoring trace data is retained for up to 31 days.

No method of storage or transmission is perfectly secure; if Roam Keeps discovers a breach that creates a real risk of significant harm, it will investigate and provide notices required by applicable law.

How long information is kept

• Account and journal content remain while your account is active, unless you delete an item sooner.
• Turning off a public page removes access immediately. Retired public address names remain reserved so an old link cannot later point to somebody else’s content.
• Account deletion makes database content and photos inaccessible immediately. Deleted object-storage files are normally removed after an eight-day recovery delay, and database backups normally expire after seven days. A failed backup cycle can preserve an older restricted backup for longer until a new verified backup succeeds.
• Hosted operational logs are retained for 30 days.
• Recovery links expire after 30 minutes and trip invitations after seven days. Private print artwork expires after 35 days, while order records may be kept for support, accounting, fraud prevention, and legal requirements.
• Contact conversations are kept only as long as reasonably needed to answer the request, maintain necessary support records, or meet legal requirements.

Copies you or another person downloaded are outside Roam Keeps’ control. Information may also be retained where the law requires it or to establish, exercise, or defend legal claims.

Your choices and rights

You can use Roam Keeps’ controls to:

• edit your profile, trips, memories, dates, and notes;
• review and change trip membership and public selections;
• remove a stored original while keeping its resized copy;
• turn optional memory emails off;
• download a portable ZIP from Account & privacy;
• disconnect Google after setting another sign-in method; and
• permanently delete your account.

Depending on where you live, you may also ask for access, correction, deletion, portability, information about disclosures, or withdrawal of consent. Roam Keeps may need to verify that the request comes from the account owner. Withdrawing information necessary to provide the service can require closing the account.

Children

Roam Keeps is not directed to children under 16, and Roam Keeps does not knowingly collect their account information. If you believe a child has created an account without appropriate permission, use the contact form so it can be reviewed and removed.

Changes to this policy

The effective date will change when this policy changes. Roam Keeps will provide a clear notice in the service or by email before a material change takes effect when required. If a new use requires consent, Roam Keeps will ask before applying it to your information.

Contact the privacy lead

Use Roam Keeps’ contact form for a privacy question, access request, or complaint. Do not include a password, recovery link, payment-card number, or private photo. Roam Keeps will acknowledge a privacy request and explain the next steps.

You can also learn about Canadian privacy rights or raise an unresolved concern with the Office of the Privacy Commissioner of Canada.