This is a translation. The Polish version is binding. This English text is provided for convenience. In case of any discrepancy, the Polish version prevails.
1. Who is the controller of your data#
The controller of personal data processed in the “Roamcrown” mobile app (in Polish stores: “Roamcrown – Władca Gminy”), on the websites at https://roamcrown.com (home page, public profile, municipality and region pages) and in the web panel at https://roamcrown.com/panel is:
Konrad Litwinowicz, running a sole proprietorship registered in CEIDG (Central Register and Information on Economic Activity), ul. Zawidowska 21 lok. 11, 54-106 Wrocław, Poland, NIP (tax ID) 8982297401, REGON 526287974 (hereinafter: “we”, the “Controller”).
Contact in matters concerning personal data: kontakt@roamcrown.com or in writing to the address above.
We have not appointed a data protection officer. In all matters concerning your data, write directly to us.
2. In brief#
- The app collects GPS location only during a recording that you start yourself (from “Start” to “Finish”), or when you import a workout yourself.
- You create an account via Google or with an e-mail address and password. We do not know your password: we store only its one-way hash.
- A route is first saved on your phone, then sent to our server in the European Union, which calculates the municipalities you have completed and the rankings.
- Your routes are never public. When you create an account, a private profile is selected by default. If you set your profile to public, your name, profile photo, completed municipalities, Ruler of the Municipality titles and ranking positions are visible.
- When importing from photos, the photos and their coordinates never leave your phone. Only a list of municipalities and dates is sent to the server.
- From Health Connect we read only workouts (walking, running, cycling) with routes and daily step totals. We do not read heart rate, weight, sleep or any other health data, and we do not write anything to Health Connect.
- We do not sell data, do not show ads and do not use any third-party analytics, advertising or crash-reporting tools.
- You can export all your data and delete your account yourself in the app (Settings) or at https://roamcrown.com/konto/usun.
3. What data we process#
3.1. Account data#
| Data | Source | Notes |
|---|---|---|
Google account identifier (the so-called sub), e-mail address, information whether Google has verified that address, first and last name (display name), profile photo URL |
from Google when you sign in with Google Sign-In | Your initial display name is the first and last name from your Google account; you can change it in the app. Your e-mail is not shown to other users. |
| E-mail account: e-mail address (in lowercase), display name, password in the form of a one-way hash, date of address verification, date the password was set or changed | from you, when registering with an e-mail and password or when setting a password in the app Settings | We store the password solely as a PBKDF2 hash with a random salt: we do not know your password and it cannot be read from the database. An e-mail account has no profile photo. Details in section 3.12. |
| Account settings: private profile (yes/no), “my municipality” and the date it was last changed, language, role (user/administrator) | from you | “My municipality” can be changed every 30 days. |
| Acceptance of the Terms of Service and the Privacy Policy (version, date) and confirmation of being at least 16 years old (date) | from you, at first sign-in (for an e-mail account: at registration) and after the documents change | Proof of conclusion of the contract and of compliance with the age requirement. |
| Account creation date, date of last activity | automatically | For deleting inactive accounts (section 7). |
The app can be used without signing in (a local “guest” account). In that case your data stays on your phone only and is not sent to our server until you sign in. After your first sign-in, guest recordings are transferred to your account.
3.2. Location and activity data (GPS routes)#
This is the most important category of data. Routes show where and when you were, so they may reveal, for example, your place of residence, workplace or habits. We treat them as precise location and location history data.
- On your phone (local SQLite database): route points (latitude and longitude, time, measurement accuracy), segments between pauses, activity type, upload queue status. Points are saved continuously so that an app crash or lack of network does not erase the recording.
- On the server: activity type (walking, running, cycling), source (recording in the app, GPX file, Health Connect, watch service), start and end time, distance, moving time excluding pauses, number of points (including rejected ones), the cleaned route, route length in each municipality, and derived from these: completed municipalities (with the date of first visit and the source: route / manual / photo), visited places and monuments from albums, season points, leads and Ruler of the Municipality titles, badges, completed albums and challenges, statistics.
- The server rejects inaccurate points (worse than 50 m) and unrealistic speeds (walking above 12 km/h, running above 30 km/h, cycling above 50 km/h) — see the Terms of Service.
- The “New municipality!” notification during an activity is calculated on the phone, without sending your position to the server for that purpose.
Location is collected only during a recording that you start yourself, including when the screen is locked. On Android, a foreground service with a persistent notification runs during that time; the app has no permission for background location outside of recording. Pausing or finishing a recording stops location collection.
3.3. Health Connect data and steps#
Only if you start the given feature yourself and grant consent in the system dialog:
- Workouts from Health Connect (Android): reading exercise sessions (
ExerciseSession), exercise routes (ExerciseRoute; the system may ask for consent for each route separately) and the permission for data older than 30 days (ReadHealthDataHistory). We take only walks, runs and bike rides with a GPS route (by default from the last 365 days). An imported workout becomes a regular activity (section 3.2) marked with its source. - Daily step totals from Health Connect (consent to read steps,
READ_STEPS): the date and number of steps for that day, excluding steps entered manually in Health Connect. The totals are sent to the server for the step ranking. - Steps from the phone's sensor during recording: while recording a walk or run, the app counts steps using the
phone's step sensor (Android “Physical activity” permission,
ACTIVITY_RECOGNITION). The number of steps is saved with the activity. Outside of recording, the app does not use the sensor. - Step ranking (weekly and monthly: friends, club, country, global): shows your name and step total in accordance with your profile privacy setting (with a private profile, strangers see “Private player”).
- Apple Health (iOS) — once the iPhone version is released: reading workouts and their routes (
HKWorkoutRoute) on the same terms; we do not write anything to the Health app.
We do not read heart rate, calories, weight, sleep, cycle or any other health data. In our view, physical activity data (type, duration and distance of a workout, route, number of steps) are not data concerning health within the meaning of Art. 9 GDPR, because they do not in themselves reveal information about a person's health status. Nevertheless, we treat them with care: we collect them from the phone only with your system consent, use them solely for game features (collection, rankings, statistics), do not combine them with other health data, do not share them for advertising or for creditworthiness or insurance assessment, and do not sell them. You can withdraw your consents in Android settings (Apps → Roamcrown → Permissions → Physical activity) and in Health Connect (App permissions → Roamcrown); from that moment we do not collect any new data.
3.4. Photos (importing history from photos) — processing on the phone only#
If you start the import from photos and select photos in the system picker (Android; the app has no access to the rest of the gallery and receives the photos' location only if you allow it in that picker) or grant access to the gallery (iOS: full or to selected photos), the app on your phone reads the date and location stored in the photos (EXIF metadata), determines the municipality based on the boundaries stored on the phone and shows you a list. Neither the photos themselves nor their coordinates are sent to the server. After your confirmation, only the following are sent to the server: the municipality identifier, the earliest visit date and the “from photo” marker. The progress of scanning the gallery (iOS) and the municipalities found are saved on the phone so that you do not have to start over.
3.5. Social data and content#
- Friends: invitations, acceptances, dates.
- Clubs: name, description, colour, club municipality, role (founder/member), date of joining.
- Feed: events about your achievements (new municipalities, titles, badges, completed albums, joining a club, completed challenges) and cheering (“kudos”).
- Reports of suspicious results (by e-mail): whom you report, description, your e-mail, outcome of the review.
- Content reports (Art. 16 DSA; the “Report” button in the app, the form at https://roamcrown.com/zglos or e-mail): what you report (a player's name or photo, a club's name or description) together with a copy of that content as at the time of the report, the reason selected from a list, an optional description (up to 1000 characters), a statement of good faith, the date, the source (app / website), the language and the reporter: the account identifier (in the app) or — on the website — the e-mail, if you provide it (without an e-mail the report is anonymous and you will not receive information about the outcome). We do not store the IP address (the limit on reports from a single address is counted only in the server's memory). We add the moderator's decision to the report: its type (content stays / removed / changed, any account sanction), statement of reasons, date and the person deciding. The author of the reported content is not told who reported it.
- Moderation: account status (active / suspended until a specified date / blocked) with the reason, invalidation of an activity with the reason, changes to your content by a moderator (name changed to a neutral one, profile photo hidden, name or description of a club you founded), a log of moderation decisions concerning you (what decision, when, reason, who made it — in the export without the administrator's identity) and your appeals (text up to 2000 characters, optionally an activity, the response). We send the statement of reasons for a decision to the inbox in the app, by push notification and — if the account has an e-mail address (from Google or an e-mail account) — by e-mail.
- Contests: results and prizes won. Partner discounts: unlocked offers, codes, redemption marker.
3.6. Notifications and devices#
- Content of notifications in the in-app inbox (title, body, type, related data, date read).
- The device's push notification token (Firebase Cloud Messaging) and platform, dates of registration and last use.
3.7. Connections with watch and bike computer services#
If you connect your account with Garmin, Polar, COROS, Suunto or Wahoo (when the given integration is available in the app): the account identifier at the provider, the scope of permissions, OAuth access tokens (encrypted in the database, never in plain text), dates of connection and last synchronisation, the last error, as well as a list of the provider's imported workouts (identifier, import status) — so as not to import them twice. Workouts from these services become activities (section 3.2). Integrations are enabled gradually, after we obtain access to the providers' partner programmes.
Strava. If you connect a Strava account (when this integration is available), we retrieve (scope
activity:read, only activities visible to “Everyone” or “Followers”, without privacy zones) the athlete
identifier, OAuth tokens and, for each new activity with GPS: the sport type, start time and route (GPS points with
time). We retrieve the data automatically when Strava notifies us of a new activity; we do not retrieve earlier
ones. In accordance with the Strava API terms, we show data from Strava only to you: they complete
municipalities in your collection, but are not included in rankings, season points, contests, clubs, the feed, the
public profile or aggregate statistics. We delete the raw GPS route from Strava after 7 days (the result remains:
municipalities crossed, distance). We delete on our side an activity deleted on Strava (or set to “Only You”) when
Strava notifies us of this (usually immediately, at the latest within 48 hours). You can withdraw your consent in
the app (“Disconnect”) or at strava.com/settings/apps — we then immediately delete the tokens, the activities
imported from Strava and the municipalities completed only through them. Strava, Inc. may collect and use data
about the use of its API under its own terms.
3.8. Technical and security data#
- Sign-in sessions: the hash of the refresh token, the device identifier provided by the app, dates of creation, expiry and revocation. The token itself is not stored in plain text.
- IP address: used for rate limiting (protection against abuse); the counter is kept only in the server's memory for the time window (usually 60 seconds) and is not saved in the database.
- Failed password sign-in attempts: the counter for an e-mail address (including an address without an account) is kept only in the server's memory for 15 minutes, without the IP address and without being saved in the database (section 3.12).
- Server logs: application messages and errors and access logs of the reverse proxy server (Caddy): date, page address (without sign-in codes and tokens in the address), response code, time, browser/app and a truncated IP address (without the last byte for IPv4, IPv6 truncated to the /48 prefix). We do not log cookies or headers containing tokens. Logs are deleted automatically after 14 days.
- Technical metrics (number of requests, response times, server load, status of background jobs) without personal data and without user identifiers, stored for 15 days.
3.9. Data on the phone#
In addition to routes (section 3.2), the app keeps on the phone: the local account, a copy of completed municipalities, municipality boundaries (public data), settings, a copy of server responses, the last checked Premium status and downloaded offline maps. Sign-in tokens are kept in the system's secure storage (Android Keystore via Expo SecureStore). Uninstalling the app deletes this data from the phone.
3.10. Premium purchase#
You can buy Premium in the Android app via Google Play or — when the panel shows a purchase button — on the website (panel) via Stripe. We do not see or store card data or any other payment data.
- Google Play: payment is handled by Google under its own terms (Google is a separate controller of the payment and Google Play account data). The subscription status is maintained for us by RevenueCat, Inc. (section 5): it receives from the app the identifier of your account in our service (or a random identifier if you are not signed in) and purchase data from the store (product, purchase and period end dates, country, currency and price, transaction identifier).
- Stripe (website): you enter your card or other payment method details directly on the Stripe payment page. Stripe Payments Europe, Limited processes them as a payment service provider (a separate controller with regard to legal obligations, e.g. anti-money laundering and fraud prevention) and as our processor with regard to payment handling. On your first purchase, we create a customer in Stripe with the account's e-mail address, language and the account identifier in the service. On the payment page, Stripe collects the billing address or country (to determine the VAT rate — Stripe Tax, OSS procedure), first and last name or company name and — if you provide it — your NIP / EU VAT number for the invoice; Stripe issues and sends the invoice on our behalf. We receive from Stripe: the customer, subscription, invoice and payment identifiers, the plan, amount, currency, dates and status of payments and refunds. We do not store the card, its last digits or the billing address on our server; you can see them in the Stripe customer portal (“Manage subscription”), where you can also change the payment method, download invoices and cancel the subscription.
- On our server we store: until when Premium is active, the plan, the purchase channel, whether the subscription will renew, the Stripe customer and subscription identifiers (for purchases on the website), payment events (event type, product, store, environment, dates, outcome), and in the case of a refund following withdrawal from the contract — the refund decision (amount paid and refunded, period, date of the withdrawal statement, reason, who decided) — without card data. On the phone we store the last checked subscription status so that Premium features work offline.
- Confirmation of the conclusion of the contract (plan, price, period, information on the right of withdrawal, the Terms of Service attached) is sent by e-mail via Resend (section 5) to the Player's account address or the address provided at payment.
- Deleting the account cancels a subscription purchased on the website (Terms of Service § 11(4)). The customer in Stripe and the invoices remain in Stripe for the period required by tax law (section 7); refund decisions remain with us without any link to the account.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR), legal obligations related to complaints, tax settlements and accounting (Art. 6(1)(c)) and prevention of payment fraud (Art. 6(1)(f)).
3.11. Waiting list#
On the home page (https://roamcrown.com) you can sign up for a list of people whom we will notify about the launch of the app. In that case we store:
- the e-mail address (in lowercase),
- optionally, the municipality you choose in the form,
- the language of the page from which you sign up (we write to you in that language),
- the sign-up date, the date consent was ticked, the date the address was confirmed, and the date and number of e-mails sent with the link.
We do not store the IP address or browser data (the IP address is only held temporarily in the server's memory to limit the number of attempts, section 3.8). Signing up requires confirmation (so-called double opt-in): we send one e-mail with a link, and the address is added to the list only after you click it. This message and every subsequent one contains an unsubscribe link; unsubscribing immediately deletes the entry. Apart from that e-mail, you will receive one message about the launch of the app; we do not send newsletters or advertising.
Legal basis: your consent (Art. 6(1)(a) GDPR), which also covers consent to receive this message by electronic means, and which you can withdraw at any time using the link in the e-mail or by writing to kontakt@roamcrown.com; withdrawal does not affect the lawfulness of processing carried out before the withdrawal. E-mails are sent for us by Resend (section 5).
3.12. E-mail account and password#
Instead of signing in with Google, you can create an account with an e-mail address and password (in the app and in the web panel). Just as with Google, you accept the Terms of Service and the Privacy Policy and confirm that you are at least 16 years old, and the profile is private by default. We store the data from section 3.1 (e-mail account) and:
- the password solely as a one-way hash (PBKDF2 with a random salt, many thousands of iterations). We do not know your password, it cannot be read from the database and we never send it; if you forget it, you set a new one using a link from an e-mail;
- one-time links from e-mails (address confirmation and setting a new password): in the database we keep only the SHA-256 hash of the token from the link, the owner, the purpose and the dates of creation, expiry and use. The address confirmation link is valid for 24 hours, the link to set a new password — for 1 hour; each works once.
Signing in with a password works only after the address has been confirmed (by clicking the link in the e-mail). Setting a new password using a link from an e-mail signs the account out on all devices and in the panel.
Account-related e-mails (in the account's language) are sent via Resend (section 5): address confirmation, a link to set a new password, the notice “someone tried to create an account with this address” (when the address already has an account — the account itself does not change in that case) and confirmation that the password has been set or changed. These are messages necessary to maintain the account, not advertising or a newsletter. The number of such e-mails per address is limited (at most 5 per hour).
Linking with a Google account. If you sign in with Google using an address that already has a confirmed e-mail account, and Google verifies that address, Google sign-in is added to the same account (one account, two sign-in methods). We do not link an e-mail account whose address nobody has confirmed (someone may have created it using another person's address): such an account has never signed in and has no other data, so we delete it together with its password and links, and Google sign-in creates a new account. You can also add a password to a Google account in the app Settings — you then sign in with the e-mail address of the Google account and that password.
Protection against abuse. After 10 failed sign-in attempts for one address within 15 minutes, sign-in for that address is suspended until the end of that window. The attempt counter is kept only in the server's memory, without the IP address and without being saved in the database. Server responses do not reveal whether a given address has an account.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — the account, password, links and account-related e-mails; legitimate interest (Art. 6(1)(f)) — protecting accounts against takeover and abuse (limits on sign-in attempts and the number of e-mails).
4. Purposes and legal bases#
| Purpose | Data | Legal basis (GDPR) | Justification |
|---|---|---|---|
| Creating and maintaining an account, sign-in, synchronisation | account, sessions | Art. 6(1)(b) (contract) | Without this we cannot provide the service described in the Terms of Service. |
| E-mail account: password (hash), address confirmation, setting a new password, account-related e-mails, linking with Google sign-in (section 3.12) | e-mail, name, password hash, dates, hashes of tokens from links | Art. 6(1)(b) (contract) | Without this you cannot create an account with an e-mail or recover access. |
| Confirmation of acceptance of documents and of age | version and date of acceptance, date of age confirmation | Art. 6(1)(b) and (c), (f) (demonstrating compliance with the law) | |
| Recording and saving routes, calculating completed municipalities, badges, albums, statistics | location, activities | Art. 6(1)(b) | This is the essence of the service you request by starting a recording. Access to location on the phone takes place with your system consent and is necessary to provide the service you request. |
| Season rankings, Ruler of the Municipality title, clubs, municipality duels, contests | results, name, avatar | Art. 6(1)(b) | Competition is part of the service under the Terms of Service. |
| Steps: counting during recording, importing daily totals from Health Connect, step ranking | number of steps, dates, name in the ranking | Art. 6(1)(b) | A game feature you enable by granting system consent; you can withdraw consent in Android / Health Connect settings (section 3.3). |
| Public profile and public municipality pages (name, avatar, completed municipalities, titles, ranking positions) | as above | Art. 6(1)(b) | Only with a public profile; by default, a private profile is selected when creating an account. |
| Friends, feed, cheering | social data | Art. 6(1)(b) | Features you enable yourself (invitation, joining a club). |
| Importing workouts from Health Connect | workouts and routes | Art. 6(1)(b) | Voluntary import at your request, with system consent, which you can revoke in Health Connect. You can delete imported activities individually or together with the account. |
| Import from photos | municipalities and dates (photos only on the phone) | Art. 6(1)(b) | Voluntary; on iOS you can withdraw gallery consent in the phone settings, on Android the app sees only the photos you select. |
| Watch and Strava integrations | tokens, workouts | Art. 6(1)(b) | You connect accounts at your request; disconnecting in the app deletes the tokens and withdraws consent at the provider. |
| Push notifications | device token, notification content | Art. 6(1)(b); system consent to notifications (Android 13+) | You can turn them off in the phone and app settings. |
| Premium: purchase, subscription status, refunds, complaints | purchase data (section 3.10) | Art. 6(1)(b), (c) and (f) | |
| Tax and accounting settlements of sales on the website | transaction data, country | Art. 6(1)(c) | VAT and accounting regulations. |
| Fair play and content moderation: rejecting erroneous points and excessive speeds, reports of results and content (including from people without an account, via the website), moderation (invalidation of an activity, exclusion from the step ranking, changing a name to a neutral one, hiding a photo, changing a club's name or description, suspension, blocking), statements of reasons for decisions and information for the reporter, appeals | activities, steps, reports (with the reporter's e-mail, if provided), content, moderation log, appeals | Art. 6(1)(f) (legitimate interest: reliable rankings and protection of other players); Art. 6(1)(c) (obligations under the DSA Regulation: content reports, statements of reasons, appeals) | |
| Security, rate limiting, abuse detection, logs, limits on password sign-in attempts and on the number of e-mails per address | IP, sessions, logs, sign-in attempt counters (only in the server's memory) | Art. 6(1)(f) | |
| Partner discounts (codes) | unlocks | Art. 6(1)(b) | We do not share data with the partner; you show the code yourself. |
| Awarding contest prizes, tax settlements | winner's data and shipping data | Art. 6(1)(b) and (c), (f) | Details in the contest rules. |
| Establishment, exercise and defence of legal claims, complaints | necessary data | Art. 6(1)(f) | |
| Waiting list for the app launch (section 3.11) | e-mail, optionally municipality, language, dates of consent and confirmation | consent – Art. 6(1)(a) | You can withdraw it using the “unsubscribe” link in the e-mail; the entry is then deleted immediately. |
| Contacting you in matters concerning the account, reports, complaints and the service | e-mail, content of correspondence | Art. 6(1)(b) / (f) | We do not send newsletters or advertising. |
Providing data is voluntary, but without signing in with Google or an e-mail address and password you cannot create an account on the server (you can use the app as a guest, without rankings and synchronisation), and without location consent you cannot record a route (you can import GPX).
5. To whom we disclose data (recipients and processors)#
We do not sell data. We use the following providers:
| Provider | Role | What data | Location / transfer |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | two dedicated servers with the application and database in a data centre in Germany and storage for encrypted backups (Hetzner Object Storage, in a different location from the servers, in Germany) (processor, data processing agreement — Hetzner AVV/DPA) | all data on the server; backups are encrypted with our key before being sent, and Hetzner does not have the key to read them | Germany (EU) |
| Cloudflare, Inc. | DNS service for the domain and — when proxying is enabled — protection and acceleration of traffic to the websites (processor) | IP address, headers and addresses of requests passing through the Cloudflare network | global network, possible transfer to the USA |
| Google LLC / Google Ireland Ltd. – Google Sign-In (and Google Identity Services in the web panel and on the account deletion page, there only after clicking “Sign in with Google”) | sign-in | Google knows that you are signing in to our app; we receive from Google the data from section 3.1 | possible transfer to the USA |
| Google – Firebase Cloud Messaging | delivery of push notifications (processor) | device token, notification content (e.g. municipality name, friend's name) | possible transfer to the USA |
| Google – profile photos (googleusercontent.com) | displaying the avatar in the app, in the panel and on the public profile page | IP address of the viewer | possible transfer to the USA |
| Google Play (Google Ireland Ltd. and other Google companies) | app distribution and in-app payments for Premium; separate controller | data that Google Play collects itself (Google account, payment) | possible transfer to the USA |
| RevenueCat, Inc. | handling purchases and Premium subscription status (processor) | account identifier in the service (or a random guest identifier), purchase data (section 3.10), IP address and device model with requests | USA |
| Stripe Payments Europe, Limited (Dublin, Ireland), within the Stripe group | payments for Premium on the website (section 3.10); payment service provider and processor | payment data, e-mail, country, device data for fraud prevention | EU, possible transfer to the USA (Stripe, Inc.) |
| Resend (Plus Five Five, Inc.) | sending e-mails (confirmation of signing up for the waiting list, launch message, e-mails related to the e-mail account: address confirmation, link to set a new password, “someone tried to create an account with this address”, “password has been changed”, confirmation of the conclusion of the Premium contract, moderation messages: statement of reasons for a sanction or content change, acknowledgement of receipt and outcome of a content report) (processor) | e-mail address, content of the e-mail with links (for the account: one-time confirmation or password-setting link; for Premium: plan, price, period, subscription number; for moderation: reported content, decision and statement of reasons), technical delivery data | USA |
| OpenFreeMap (tiles.openfreemap.org) | base map in the app; independent provider of open map tiles (the phone connects to it directly) | the phone's IP address and the area of the map being viewed (tiles downloaded) | according to OpenFreeMap's policies |
| Expo (650 Industries, Inc.) – EAS Build | building the app | we do not share user data | USA |
| Strava, Inc.; Garmin, Polar, COROS, Suunto, Wahoo | only after you connect them; separate controllers of your data on their side | exchange of OAuth tokens, retrieval of your workouts, revocation of consent on disconnection | depending on the provider (EU, USA, other) |
| Contest prize sponsors | only when they hand over a prize to the winner (rules in the contest rules) | data for shipping the prize | |
| Public authorities | where required by law | ||
| Other users | see section 6 |
Wikipedia, Wikidata, dane.gov.pl (NID) and OpenStreetMap: we retrieve public data from them only from our server; your data is not sent to them. Links to Wikipedia and NID open in the browser only when you click them.
Transfers of data outside the EEA#
Some providers (Google, Cloudflare, RevenueCat, Stripe, Resend, Expo) may process data in the USA. The basis is the European Commission's adequacy decision under the EU-US Data Privacy Framework (for certified entities) or the standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR) included in these providers' data processing agreements, together with supplementary safeguards (encryption in transit). You can obtain a copy of the safeguards by writing to kontakt@roamcrown.com.
6. What other users and website visitors see#
| Information | Public profile | Private profile (default when creating an account) |
|---|---|---|
| Activity routes | never public | never public |
| Name and profile photo in rankings (including the step ranking), municipality leaders, on municipality web pages, in contests | visible to everyone | strangers see “Private player” without a photo, with a pseudonym that is different in each municipality; you and your friends see the real data |
Profile page /u/{id} (name, photo, map of completed municipalities, number of municipalities, badges, titles) |
accessible to anyone with the link; may be indexed by search engines | no page (“Private profile”) |
| Friend search | visible | not visible |
| Feed | friends and members of your club | friends only |
| Share card | you create and share it yourself; by default it cuts 200 m from the start and end of the route (you can turn this off) | as above |
Remember: even without routes, completed municipalities and titles reveal the areas you frequent.
7. How long we keep data#
| Data | Period |
|---|---|
| Account, activities with routes (including invalidated ones), steps, completions, badges, titles, friends, clubs, feed | until you delete the account or an individual activity. An account unused for 24 months (no sign-in and no activity uploaded) is deleted automatically as with “Delete account”, after an in-app notice 30 days in advance |
| Acceptance of documents and age confirmation | until the account is deleted (a new acceptance replaces the previous one) |
| Password hash, address confirmation date and password change date (e-mail account) | until the account is deleted; we replace the password hash with a new one each time the password is changed |
| E-mail account with an unconfirmed address (never signed in) | 7 days from registration, then deleted automatically together with the password hash and links; earlier — when you sign in with Google using that address (section 3.12) |
| One-time links from e-mails (token hashes) | valid for 24 hours (address confirmation) or 1 hour (new password); we delete the record 7 days after expiry or use, and immediately — when the account is deleted |
| Notifications in the in-app inbox | read: 180 days from creation, unread: 365 days |
| Sign-in session (refresh token) | valid for 180 days from the last refresh (rotation); access token 60 min. We delete the session record 30 days after expiry or revocation (sign-out, rotation) |
| Device push token | until sign-out, account deletion or until FCM reports that the token is invalid |
| Watch and Strava integration tokens | until the integration is disconnected or the account is deleted |
| GPS route of a Strava activity | 7 days from retrieval (after that, the municipalities crossed and the distance remain); the whole activity until it is deleted on Strava, Strava is disconnected or the account is deleted |
| Reports of suspicious results and content reports (app, website, e-mail) | 12 months from the closure of the case (the moderator's decision), then anonymisation: we delete the description, the reporter (account or e-mail) and the copy of the reported content; what remains: what it concerned, the reason from the list, the decision and its statement of reasons (accountability for decisions and any appeal). E-mail correspondence in the matter — the same period. Reports not yet reviewed — until the decision |
| Moderation log and appeals | until the account concerned is deleted (the history of sanctions is needed in the event of further violations and appeals) |
| Premium status and payment events | until the account is deleted; data held by Google Play, RevenueCat and Stripe — according to their policies |
| Billing data for sales on the website (Stripe) | 5 years from the end of the year in which the tax liability arose (tax and accounting regulations), also after the account is deleted |
| Premium refund decisions (amounts, period, date of the withdrawal statement, reason) | 5 years from the end of the year of the refund (tax settlements, complaints), after account deletion without any link to the account |
| Complaints, withdrawals from the contract and related correspondence | until the limitation period for claims expires (as a rule 2 years for claims under the Premium contract, for complaints — until the end of the liability period) |
| Queue of changes in municipality control by clubs | 7 days from sending the aggregate notification |
| Waiting list (section 3.11) | unconfirmed sign-up: 7 days from the last sign-up; confirmed: until unsubscribing, and at the latest 12 months from the launch of the app on Google Play |
| Rate limit counters (IP) | in the server's memory, usually 60 seconds |
| Failed password sign-in attempt counters (per e-mail address) | in the server's memory, 15 minutes (a successful sign-in resets the counter) |
| Server logs (application and access logs with truncated IP) | 14 days |
| Technical metrics (without personal data) | 15 days |
| Backups | up to approx. 6 months: daily backup for 7 days, weekly for 4 weeks, monthly for 6 months. Backups are encrypted and stored in the EU (section 5). Data deleted from the server (e.g. after account deletion) disappears from the backups at the latest after this period; we do not use backups for anything other than restoring the server after a failure, and after a restore we delete again any data deleted after the backup date |
| Contest results | the record of a win remains in the contest results; after account deletion without any link to the account (position, result, the name “Deleted account”). Data for awarding the prize and settling tax is collected by the contest organiser outside the app and stored for 5 years from the end of the tax year |
| Data on the phone | until the account is deleted (the app clears it after account deletion), sign-out or uninstallation |
8. Your rights#
You have the right to:
- access your data and obtain a copy (Art. 15) and to data portability (Art. 20) — in the app: Settings → “Download my data” (also at https://roamcrown.com/konto/usun). You receive a JSON file with your profile, activities (with routes), completions, badges, titles, friends, notifications, sessions, devices, your own reports, integrations, clubs, feed, cheering, visits to places, albums, challenges, discounts, contest prizes, moderation and Premium, as well as sign-in methods (Google, e-mail), the e-mail address confirmation date and information about the password (whether it is set and when it was changed — without the password hash and without tokens from links);
- rectification (Art. 16) — you can change your display name in the app; for anything else, write to us;
- erasure (Art. 17) — in the app: “Delete account” or at https://roamcrown.com/konto/usun. We immediately delete the account and all data from the server (including routes and the history of Ruler titles; the record of a contest win remains in the results without any link to the account, and billing data — for the period required by law, section 7), withdraw consents at connected watch providers, and for a club you founded, ownership passes to the longest-standing member (an empty club disappears). We also delete other users' notifications containing your name. You can delete individual activities and manual municipality entries in the app;
- restriction of processing (Art. 18) and to object (Art. 21) to processing based on legitimate interest;
- withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal) — in the phone settings (Health Connect, Physical activity, Photos, Location, Notifications) or using the “unsubscribe” link in an e-mail;
- lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).
In other matters, write to kontakt@roamcrown.com. We will respond within one month (Art. 12(3) GDPR); where necessary, we may extend this period by a further two months, informing you of this.
9. Automated decision-making and profiling#
The server automatically calculates completed municipalities, season points, rankings (including the step ranking), Ruler of the Municipality titles, municipality control by clubs and contest results, and also rejects route points that do not comply with fair play rules (e.g. excessive speed). This is an assessment of sporting results according to the transparent rules set out in the Terms of Service; it does not produce legal effects concerning you or similarly significantly affect you, and therefore is not a decision within the meaning of Art. 22 GDPR. The organiser may verify the results of contests with prizes manually, and you may challenge any result (contest rules). Sanctions against accounts and activities (invalidation of an activity, exclusion from the step ranking, suspension, blocking) and decisions on reported content (name change, hiding a photo, removal of a club description) are made by a human (the administrator) after analysis; the app does not impose them automatically and does not filter content automatically. The decision is entered in the moderation log, and you can see its reason and appeal against it.
For payments on the website, Stripe automatically assesses the risk of fraud (e.g. a suspicious card) and may reject the payment; in that case you can pay with a different method or contact us.
We do not profile you for marketing purposes.
10. Children#
An account on the server may be created by a person who is at least 16 years old; at the first sign-in with Google or at registration with an e-mail you confirm this in the app or in the web panel. We do not collect dates of birth. If we learn that an account has been created by a person under 16, we will delete it together with the data. A parent or guardian may write to kontakt@roamcrown.com in such a matter.
11. Cookies and browser storage (websites and panel)#
- The home page, public profile, municipality and region pages and document pages do not set cookies.
The home page records in the browser's session storage (
sessionStorage, keyrc-map) that the map animation has already played; the entry disappears when the tab is closed and contains no personal data. We serve the fonts and the map library from our own server, so the pages do not connect to other companies' servers. Exceptions: the profile photo from Google (googleusercontent.com) on the profile page, and on the account deletion page the Google sign-in button, which we load only after you click “Sign in with Google” (see section 5). - The web panel (/panel) and the account deletion page, after sign-in, use:
- the
__Host-wg_rtcookie containing the session refresh token (HttpOnly, Secure, SameSite=Strict, valid for up to 180 days, deleted on sign-out) — strictly necessary to maintain the sign-in you request, and therefore not requiring consent (Art. 399 of the Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej)); - the browser's session storage (
sessionStorage, keywg.panel.access) containing the access token, which disappears when the tab is closed; - the browser's storage (
localStorage, keywg.panel.lang) containing the selected panel language, if you change it using the switcher. - The Google sign-in button (Google Identity Services) may set Google's own cookies under Google's terms.
- the
- Payment on the website takes place on the Stripe page, which may use its own strictly necessary cookies (payment security, fraud prevention).
- If traffic to the website passes through Cloudflare (section 5), Cloudflare may set a strictly necessary security cookie used to distinguish human traffic from bots.
- We do not use analytics or advertising cookies, so we do not display a consent banner.
12. Security#
- Connection to the server only via HTTPS (HSTS); the production version of the app does not connect without https.
- Sign-in tokens on the phone are kept in the system's secure storage (Keystore); on the server only hashes of refresh tokens, token rotation and revocation of the entire session upon an attempt to reuse a stolen token.
- Passwords of e-mail accounts solely as a PBKDF2 hash with a random salt; one-time links from e-mails as a SHA-256 hash, valid for a short time; a limit on sign-in attempts per address; setting a new password using a link from an e-mail revokes all sessions of the account.
- Watch integration tokens encrypted in the database.
- Pseudonyms of private accounts derived from a secret server key, different in each municipality.
- Rate limiting, security headers (CSP), running the service without administrator privileges, database accessible only from the application server.
- Processing of photos only on the phone; cutting 200 m from the ends of routes on share cards.
- Backups encrypted with a public key (age) before being sent from the server; the decryption key is held neither on the server nor by the storage provider. Servers: firewall (only SSH, HTTP, HTTPS open), protection against intrusion attempts, administrator sign-in only with an SSH key, automatic security updates.
13. Changes to the policy#
We will inform you of material changes in the app (a screen for accepting the new version) at least 14 days before they take effect. Previous versions are made available upon request sent to kontakt@roamcrown.com.