Privacy Policy for the app “ROAMR”#

Effective: 4 November 2026 · applies to the ROAMR app for iPhone. The German version is binding.

1. Who is responsible?#

Pamuk und Kuscu GbR (PAKU Media), brand “PAKU Studios”, Friedhofstraße 171, 33659 Bielefeld, Germany · E-mail: hello@pakumedia.de · Represented by its partners Aykut-Rasih Pamuk and Bünyamin Kuşcu

2. In short#

No ads, no advertising or analytics SDKs, no session recording, no selling of data.
You can use ROAMR without an account (explore, search, read). An account is needed for your collection, friends, quiz, place suggestions and the ROAMR Pass.
Location is used only while you use the app, never in the background. To confirm a visit on site (“Gold”), a few seconds of location and motion data are sent to our server, checked there and deleted at the latest 24 hours after the decision.
You can delete your account in the app at any time (Settings › Delete account).

3. Using ROAMR without an account#

Content: At launch and at most every six hours the app downloads new place content (catalogue, texts, images) from our storage at Supabase (section 12). These requests carry no account, location or device identifier; as with any internet request the server technically receives your IP address, which appears in the provider’s server logs.

Map and search: The map is Apple Maps (MapKit); your iPhone loads map tiles directly from Apple, without any ROAMR account or user identifier. An address search sends only the typed text to Apple’s geocoding service. Apple’s privacy policy applies as well. Collection zones come from OpenStreetMap (© OpenStreetMap contributors, ODbL); no data is sent to OpenStreetMap.

Images and texts: Place photos come mostly from Wikimedia Commons and are served, with licence and credit, from our own storage; the app does not contact Wikimedia servers. Only when you tap a source link does the page (e.g. Wikipedia) open in the browser.

On your iPhone: Settings, cached content, memory photos and unsent place suggestions stay on your device. A memory photo is chosen through the iOS photo picker; ROAMR stores a resized copy without metadata (no place or time of capture) inside the app and sends it nowhere.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (secure operation); access to your device is necessary for the service you request (Section 25(2) no. 2 TDDDG).

You sign in with “Sign in with Apple”. Apple sends us a sign-in token, a unique identifier and your e-mail address (or an Apple relay address if you choose “Hide My Email”). We do not ask for your name; there is no password. In ROAMR you appear under a generated nickname you can change, never your name or e-mail. We store your account ID, e-mail address, sign-in times, nickname, chosen profile picture (from the app, no own photo), language and the account content described below. The sign-in token is kept in your iPhone’s keychain. Legal basis: Art. 6(1)(b) GDPR.

5. Location#

ROAMR asks for your location only when you use a feature that needs it, and only “While Using the App”. There is no background location and no public or shared live position.

“My location” on the map is shown on your iPhone only and is not sent.
Confirming a visit on site (“Gold”): when you choose “Collect on site” at a place, the app records 5–30 seconds of location fixes (with accuracy and iOS’s flag whether a location is simulated) and device motion, seals them cryptographically and sends them to our server. The server checks automatically whether the fixes lie in the place’s approved zone and plausibly come from a real device. A small random share (about one in ten) and unclear cases are also looked at by a person on our team.
What is kept: the recording is deleted at the latest 24 hours after the decision (at most 14 days while a review is open). Only the result is kept: which place, the date of the visit in local time and month/year for your stamp’s postmark – no coordinates.
Country of the connection: when a check is started and sealed, the server derives only the country from the connection’s IP address (offline database “IP to Country Lite” by DB-IP). The IP address is not stored for this; the country code is kept for at most 14 days and is only a weak signal.

There is no automated decision with legal or similarly significant effect under Art. 22 GDPR: the only question is whether the app awards a stamp. After a rejection you can try again or contact us. Legal basis: Art. 6(1)(b) GDPR (the check you start) and Art. 6(1)(f) GDPR (protection against fraud and manipulation).

6. Device integrity (App Attest)#

To make sure a check comes from the genuine ROAMR app on a real iPhone, ROAMR uses Apple’s App Attest. We store your app installation’s public key, a counter, the time of attestation and which accounts use the installation. It contains no advertising or device identifier. Legal basis: Art. 6(1)(f) GDPR.

7. Camera, microphone, contacts, notifications#

This version of ROAMR does not use the camera. It never accesses the microphone or contacts and sends no push notifications.

8. Your collection#

With your account we store your saved places, visited places with stamps (section 5), your own “I was there” entries (Bronze/Silver) with the year you give, Explorer XP, milestones and souvenirs. Legal basis: Art. 6(1)(b) GDPR.

9. Friends and quiz#

You can add friends with a friend code. Friends see your nickname, profile picture and – where a feature shows it – which places you collected or marked. Friends can confirm that you were at a place together (with the year). For the World Icons quiz we store games, rounds, answers and points. You can block and report people; only we see reports. Legal basis: Art. 6(1)(b) GDPR; reports and abuse protection Art. 6(1)(f) GDPR.

10. Suggesting places (“Place missing?”)#

We store the name, city/country, note, an optional link and – if you set one – the point you placed on the map (not your device location), together with your account. Suggestions are deleted 365 days after receipt, handled ones 90 days after handling. Legal basis: Art. 6(1)(b) GDPR.

11. ROAMR Pass and purchases#

You buy the ROAMR Pass through the App Store; Apple handles payment and we receive no payment details. We use RevenueCat (RevenueCat, Inc., USA) to manage purchases. The app shares only your pseudonymous ROAMR account ID with RevenueCat – no name, no e-mail, no advertising identifier. RevenueCat processes Apple’s receipts and technical device information (e.g. app version, operating system, App Store country) and reports purchases, renewals and cancellations to our server, where we store your Pass status and purchase events (events for at most 400 days). Legal basis: Art. 6(1)(b) GDPR; statutory retention Art. 6(1)(c) GDPR.

12. Service providers and transfers outside the EU#

Supabase (Supabase, Inc., USA) runs our database, sign-in, storage and server functions. Database and storage are in Frankfurt am Main (region eu-central-1); server functions may run in a data centre near you. Supabase keeps technical request logs (including IP address, time, function called) for 7 days.
RevenueCat (RevenueCat, Inc., USA) for purchases, see section 11.
Apple (Apple Distribution International Ltd., Ireland) for the App Store, Sign in with Apple, App Attest and Apple Maps, under Apple’s own privacy policy.

Data processing agreements under Art. 28 GDPR are in place with Supabase and RevenueCat. Transfers to the USA rely on the EU-U.S. Data Privacy Framework where the provider is certified, and the European Commission’s Standard Contractual Clauses.

13. How long we keep data#

Account data until you delete your account. Shorter periods: location check recordings 24 hours after the decision (at most 14 days), connection country 14 days, place suggestions 365 days (handled: 90 days), purchase events 400 days. Statutory retention obligations remain unaffected.

14. Deleting your account#

In the app under Settings › Delete account; for safety you sign in again briefly. We then delete your account and all data linked to it. To recognise repeated deletion requests we keep only an irreversible, secret-salted hash of the account ID. An active subscription is cancelled in your Apple Account settings; deleting the account does not cancel it automatically. You can also remove ROAMR from “Sign in with Apple” in your iPhone’s Apple ID settings.

15. Your rights#

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw permissions such as location at any time in iOS Settings. Write to hello@pakumedia.de. You may lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

16. Children#

ROAMR is not directed at children under 13.

17. Changes#

If the app changes in a way that requires this policy to change, we update it and show the new date at the top.