Privacy Policy

Roamly is a privacy tool. We treat your data the same way we'd want ours treated: kept only when there's a real reason, encrypted in transit, deleted when no longer needed, and never sold.

Who we are

Roamly is operated by an independent vendor accessible at roamlyvpn.com. Contact: [email protected]. For legal/abuse matters: [email protected].

Data we collect

1. Account information

• Your email address (for account, password reset, billing receipts)
• Hashed password (Argon2id; we never see your plain password)
• Account creation date, last login date, IP address at login

2. Connection data (while you're using the VPN)

• Connection start and end times
• Bandwidth used per session
• Server you connected to
• Your originating IP address (kept for the duration of the session, then truncated to /24)
• The exit IP we assigned you

3. Connection logs

When you're connected to Roamly, our exit servers record basic connection metadata to support service operation, abuse prevention, and lawful disclosure obligations:

• Connection time and duration
• Bandwidth used per session
• Source IP (your IP at session start, truncated to /24 after 7 days)
• Exit IP (the server IP we assigned you)

We do not keep a log of the websites or domains you visit. We record the connection metadata above, not your browsing. Our threat protection (below) blocks known-malicious domains at the DNS level without recording the sites you request. This data is recorded only at our WireGuard exit servers, and we use it for debugging connection issues, identifying abuse, and responding to lawful requests.

4. Built-in threat protection

Roamly can block known dangerous and restricted domains (phishing, malware, crypto-miners, trackers, and CSAM, which is a legal requirement). When enabled, matching happens at the DNS level inside the tunnel; we do not record which sites you tried to visit as a result of this filtering.

5. Payment data

Purchases are made through Apple In-App Purchase. Apple processes the transaction and handles billing and receipts. We never see your card number or payment details — we only receive Apple's purchase confirmation (transaction identifier and the product you bought) so we can activate your premium plan.

6. Device information

To run sessions, provide support, and (if you allow notifications) send service alerts, the app registers your device with your account. This may include:

• A random device identifier generated locally on your device
• Device model, iOS version, and app version
• A push notification token (only if you enable notifications)

This carries no browsing data. We use it solely to operate your account's sessions, support, and optional notifications.

Data we do not collect

• The contents of your encrypted traffic (we can't, it's encrypted end-to-end with the destination)
• Form submissions, message bodies, file uploads/downloads
• Any browsing, connection, or domain data when the VPN is disconnected, no sites, IPs, or traffic are recorded while you're off.
• Browsing activity on traffic that doesn't pass through the Roamly tunnel
• Cross-device or cross-account behavioral profiles for advertising

Third parties

We share data only with operational service providers, and only the minimum needed:

• Apple: processes In-App Purchases as the seller of record; handles billing, receipts, and tax. They see your payment details (we don't), not your VPN activity.
• VPS / WireGuard server providers: operate the actual VPN exit servers. They see encrypted traffic, source/destination IPs, and bandwidth. They do not see your account identity.
• Hosting providers: host our backend and database. Subject to their security and privacy practices.

We do not share data with: advertising networks, data brokers, analytics platforms, or social media trackers.

How long we keep data

• Account data: until you delete your account, then 30 days for backup rotation, then permanent deletion
• Connection logs (times, IPs, bandwidth): up to 24 months (operational + abuse response window)
• Payment records: per applicable accounting law (typically 5–7 years)
• Email logs (sent receipts, password resets): 12 months

Lawful disclosure

We comply with valid legal requests from courts of competent jurisdiction. We do not respond to informal requests, requests from non-governmental parties, or requests from jurisdictions where we have no legal nexus.

We will fight requests we believe are overbroad or fishing. We will publish (anonymized) annual transparency reports beginning in our second year of operation.

Your rights

You may, at any time:

• Request a copy of all data we hold about you
• Request deletion of your account and all associated data (subject to legal retention obligations on payments)
• Correct inaccurate information
• Withdraw consent (which will close your account)
• File a complaint with your local data protection authority

To exercise any of these: [email protected]. We respond within 14 days.

Security

We use TLS 1.2+ for all client-to-server traffic. Passwords are hashed with Argon2id. Database connections are TLS-encrypted. Server access uses key-based SSH only, passwords are disabled. We monitor for intrusion and run regular security audits.

If we discover a data breach, we will notify affected users within 72 hours of confirming it.

Children

Roamly is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has registered, please email [email protected] and we will delete the account.

Changes

Material changes to this policy will be announced via email to all active accounts at least 14 days before taking effect. Minor clarifications may be made at any time and noted at the top of this page.

Questions?

Email [email protected]. Real human, usually responds in under 48 hours.