Effective date: August 23, 2026
The short version
We store the minimum we need: your email, an optional passport country, and the trips you enter. Your data is hosted in the EU, we don’t sell it, we don’t run ads, and payment card details never touch our servers. You can get a copy of your data or delete everything by emailing us.
The data controller is Patrício Cecílio, operating RoamBorders from Portugal. Contact for any privacy matter: hello@roamborders.com.
Account data — your email address and a password (stored by our authentication provider in hashed form). Legal basis: performance of our contract with you. Passport country (optional) — a single country code you may provide so the service applies the right rules to you. Legal basis: performance of the contract. Trip data — the countries and dates you enter. This is the core content of the service and is used solely to compute your day counts, calendars and alerts. Legal basis: performance of the contract. Waitlist email — if you join the waitlist, we store your email to contact you about the launch. Legal basis: consent, which you can withdraw at any time. Technical data — minimal server and security logs (such as IP addresses in transient logs) needed to operate and protect the service. Legal basis: legitimate interest in security and reliability. The public calculator runs entirely in your browser and does not store the trips you type into it.
We do not sell or rent your personal data. We do not show ads. We do not use your data to train AI models. We do not collect payment card details — payments are handled entirely by Stripe as merchant of record (see section 5).
We use only essential cookies: the session cookies required to keep you signed in. We do not use third-party advertising or tracking cookies. If we add privacy-friendly, cookieless analytics in the future, this policy will be updated first.
We use a small set of service providers under data processing agreements: Supabase hosts our database and authentication, with data stored in the European Union (AWS eu-west-1); Vercel hosts the application and delivers it globally; Stripe processes payments as merchant of record — when you buy Pro, your payment and billing details are collected and processed by Stripe under Stripe’s own privacy policy, and we receive only what we need to know your subscription status; and, once alerts launch, Resend will deliver our transactional emails. Where a provider processes data outside the EU/EEA, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.
Account, passport and trip data are kept while your account exists and deleted when your account is deleted. Waitlist emails are deleted after launch communications or on request. Minimal logs rotate on short schedules. Records that must be kept for legal reasons (for example, billing records held by Stripe) follow their statutory retention periods.
You have the right to access, rectify, delete and receive a portable copy of your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. To exercise any right, email hello@roamborders.com from your account address — we respond within one month. Self-serve account deletion and data export are planned in-product. You also have the right to lodge a complaint with a supervisory authority; in Portugal, that is the CNPD (Comissão Nacional de Proteção de Dados).
Data is encrypted in transit, access to production systems is restricted, and the database enforces row-level security so each account can only read its own records. No system is perfectly secure; if a breach affecting your data ever occurs, we will notify you and the authorities as required by law.
The service is not directed at children and requires users to be at least 18.
If we change this policy in a material way, we will give notice in the app or by email before the change takes effect.
© RoamBorders · Terms of Service · Home