Privacy Policy

Roamly is a privacy tool. We treat your data the same way we'd want ours treated: kept only when there's a real reason, encrypted in transit, and never sold. The one thing we do not delete is connection records, which we keep so we can answer lawful requests (details below).

Who we are

Roamly is operated by an independent vendor accessible at roamlyvpn.com. Contact: [email protected]. For legal/abuse matters: [email protected].

Data we collect

1. Account information

Roamly has no passwords. You sign in with Sign in with Apple or Sign in with Google, or you continue as a guest, so we never receive, store, or reset a password of yours. From an Apple or Google sign-in we keep:

• Your email address, or the relay address Apple gives us if you chose "Hide My Email". If no address is provided at all, we generate an internal placeholder instead.
• The provider account identifier (Apple or Google), so we can recognise you on your next sign-in
• Your name, only if the provider sends it to us
• Account creation date, last sign-in date, and the IP address used at sign-in

If you continue as a guest, we create an account tied to the random device identifier described in "Device information" below. A guest account has no email address and no name: we store an internal placeholder address that can never receive email. Signing in again as a guest on the same device returns the same account. You can later link Sign in with Apple or Google in Settings to keep your account and subscription on all your devices; if that Apple or Google account already has a Roamly account, your guest purchases move to it. We keep the creation date, last sign-in date, and sign-in IP address for guest accounts as well.

2. Connection logs (while you're using the VPN)

When you connect, we record session metadata to run the service, prevent abuse, and meet lawful disclosure obligations:

• Connection start time, end time, and session duration
• The server you connected to and the exit IP we assigned you
• Your originating IP address at session start, and again when you disconnect from the app (when our server ends a session on its own, for example after inactivity, no disconnect address is recorded)
• The country your connection came from, and the app version and device type that connected
• The public half of your device's WireGuard key, which is what identifies your tunnel to the server

To be direct about one thing: we keep your originating IP in full as part of the connection records described below. We do not shorten or mask it. Storing it is what lets us answer a lawful request or trace abuse back to a session, and pretending otherwise would be the kind of claim this page exists to avoid.

We do not keep a log of the websites or domains you visit. We record the connection metadata above, not your browsing. Our threat protection (below) blocks known-malicious domains at the DNS level without recording the sites you request. This data is recorded only at our WireGuard exit servers, and we use it for debugging connection issues, identifying abuse, and responding to lawful requests.

3. Built-in threat protection

While you are connected, DNS queries inside the tunnel are answered by a filtering resolver on the exit server. It blocks domains on our threat list, which is built from public threat intelligence feeds covering phishing and malware domains, plus anything we add manually after an abuse report. Queries that are not on the list are forwarded to Quad9 (9.9.9.9), a security-focused public resolver that blocks additional known-malicious domains on its own.

This filtering is always on and applies to every connected user. We do not record which domains you requested, or which ones were blocked. To be precise about what this feature is and is not: it blocks known-malicious destinations. It is not an ad blocker or a tracker blocker, and we do not advertise it as one.

4. Payment data

Purchases are made through Apple In-App Purchase. Apple processes the transaction and handles billing and receipts. We never see your card number or payment details. We receive Apple's purchase confirmation (transaction identifier, the product you bought, and the renewal or expiry date) so we can activate and maintain your plan, plus the IP address and device the purchase was made from as a fraud record.

5. Device information

To run sessions, provide support, and (if you allow notifications) send service alerts, the app registers your device with your account. This may include:

• A random device identifier generated locally on your device. It contains nothing about you or your hardware, but it is stored in the iOS Keychain, which means it survives deleting and reinstalling the app. We keep it that way so that a device banned for abuse cannot return with a fresh install or a new account.
• Device model, iOS version, and app version
• Your device's language and region, used to decide which service notifications to send
• A push notification token (only if you enable notifications)

This carries no browsing data. We use it to operate your account's sessions, support, optional notifications, and abuse enforcement.

Advertising measurement

We advertise Roamly, and we want to know whether those ads work. We do that without handing your data to anyone.

Roamly does not send information about you to Meta, Google, TikTok, or any other advertising or analytics company. That includes your email address, your name, your IP address, your device identifiers, your purchases, and your VPN activity. There is no advertising or analytics SDK in the app, the app never asks for tracking permission, and it never reads your device's advertising identifier (IDFA).

The only ad measurement we use is Apple's SKAdNetwork, which is part of iOS. When you install the app or subscribe, iOS itself can tell the ad network, anonymously and after a delay, that an ad led to an install or a purchase. That report carries no identifier and nothing about who you are, and it is not sent by our servers.

Data we do not collect

• The contents of your encrypted traffic (we can't, it's encrypted end-to-end with the destination)
• Form submissions, message bodies, file uploads/downloads
• Any browsing, connection, or domain data when the VPN is disconnected, no sites, IPs, or traffic are recorded while you're off.
• Browsing activity on traffic that doesn't pass through the Roamly tunnel
• Behavioural advertising profiles built from your VPN usage. Your connection history is never used for advertising, and is never sent to an advertising platform.
• Your advertising identifier (IDFA). The app never asks for tracking permission and never reads it.

Third parties

This is the complete list of companies that receive any data from us, and exactly what each one gets:

• Apple: handles Sign in with Apple, and processes In-App Purchases as the seller of record including billing, receipts, and tax. They see your payment details (we don't). They do not see your VPN activity.
• Google: handles Sign in with Google if you choose it, and delivers push notifications through Firebase Cloud Messaging if you enable notifications. Firebase receives a push token for your device and the notification content, which is limited to service messages. It does not receive your VPN activity.
• VPS / WireGuard server providers: operate the actual VPN exit servers. They see encrypted traffic, source and destination IPs, and bandwidth. They do not see your account identity.
• Hosting provider: hosts our backend and database. Subject to their security and privacy practices.
• Email delivery provider: delivers the transactional email we send (support replies, service notices). Receives your email address and the message content.

We do not sell, use, or disclose your data to third parties for any purpose other than running the service with the providers listed above. We do not share anything with data brokers, advertising networks, or analytics companies, and we do not run analytics on your VPN usage.

How long we keep data

• Account data: until you delete your account. Deletion from the app is immediate and irreversible; backup copies age out within 30 days.
• Connection logs (session start and end times, your originating IP, the exit server and its IP, your in-tunnel address, the block of source ports on the exit IP reserved for your session, and the account email at the time of the session): kept and not deleted on a schedule, so that we can answer lawful requests and trace abuse back to a session. They are kept even if you delete your account. Reserving a fixed port block per session lets us match a lawful request to a single session without logging any individual connection. They never contain the websites you visit or your DNS queries.
• Email logs (support replies, service notices): kept, not deleted on a schedule.
• Diagnostic system logs: kept, not deleted on a schedule.
• Payment and audit records: kept and not deleted on a schedule, so that we can meet accounting and lawful-disclosure obligations. They are kept even if you delete your account, together with the account email at the time of the record.

Lawful disclosure

We comply with valid legal requests from courts of competent jurisdiction. We do not respond to informal requests, requests from non-governmental parties, or requests from jurisdictions where we have no legal nexus.

We will fight requests we believe are overbroad or fishing. We will publish (anonymized) annual transparency reports beginning in our second year of operation.

Your rights

You may, at any time:

• Request a copy of all data we hold about you
• Request deletion of your account and all associated data (subject to legal retention obligations on payments and connection logs)
• Correct inaccurate information
• Withdraw consent (which will close your account)
• File a complaint with your local data protection authority

To exercise any of these: [email protected]. We respond within 14 days.

Security

All app-to-server traffic uses TLS 1.2 or higher. The VPN tunnel itself is WireGuard: your device generates its own private key, that key never leaves your device, and we only ever receive the public half.

There are no user passwords to steal, because sign-in is handled entirely by Apple and Google. Our database is not reachable from the public internet. Exit servers accept administrative SSH only on a non-standard port, behind a host firewall that blocks all other inbound traffic and automatically bans repeated failed logins. Sensitive values we do store, such as server credentials, are encrypted at rest with AES-256-GCM.

If we discover a data breach, we will notify affected users within 72 hours of confirming it.

Children

Roamly is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has registered, please email [email protected] and we will delete the account.

Changes

Material changes to this policy will be announced via email to all active accounts at least 14 days before taking effect. Minor clarifications may be made at any time and noted at the top of this page.

Questions?

Email [email protected]. Real human, usually responds in under 48 hours.