ICZAAR LLC | RoamAlley

Effective date: October 31, 2026
Last updated: October 31, 2026

1. Who we are and what this policy covers

ICZAAR LLC, a limited liability company based in Michigan, United States ("ICZAAR," "we," "us," or "our"), operates the RoamAlley app and website (the "Service"). RoamAlley is a travel-planning tool that uses artificial intelligence to suggest places and itineraries. We offer paid plans for additional features. We do not sell or book travel.

This policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices you have. ICZAAR LLC is the controller of the personal information described here. Our contact details are in Section 17. Other companies, such as Apple and Google, handle information under their own privacy policies for their own services.

2. Information we collect

What we collect depends on the features you use.

Account and profile information. You need an account to use the Service. You can sign in with Apple, with Google, or with an email address and password. We collect your email address, display name, account identifier, sign-in method, and a username we assign that you can change. If you sign in with Apple and hide your email, we receive Apple's relay address instead. Passwords are handled by Google's Firebase Authentication, which stores them only in hashed form; we never see them. Optional profile details you add, such as a profile photo, cover photo, bio, home base, profile theme, and travel personality, are visible to other signed-in travelers, who can find your profile by your username or display name unless one of you has blocked the other.

Trips and AI interactions. We store the trips, itineraries, and packing lists you save with your account. We process the destinations, dates, budgets, interests, preferences, and requests you enter so we can generate suggestions. Trip assistant conversations are not saved: they exist only while the assistant is open, and only the changes you choose to apply are saved to your trip. When "Smarter recommendations" is on, the AI request you type while planning a trip (up to 200 characters) is saved with that trip's planning record, described below.

Location information. With your permission, the app uses your device's precise location to show you on the map and to guide you between stops during a day you start. That guidance runs on your device, including in the background while a day is being guided. Your location leaves your device only when you choose to share it with tripmates on a shared trip:

  • Guiding a day together. When you start or join a day with tripmates, your position is sent to the people on that trip about every 20 metres you move, or every 5 minutes if you stay still, until you end or leave the day. Each position expires 2 hours after it was sent.
  • Sharing during the whole trip. If you turn this on for a trip, your position is sent to the people on that trip the same way, every day from the trip's first day through its last, and stops automatically after that. You can turn it off at any time.
  • "I'm lost." When you tap it, your precise position is shared with the people on that trip for one hour, with an optional note, and they are alerted.

Only the members of that trip can see these positions. Expired positions are removed automatically, and yours are removed immediately when you stop sharing, leave the trip, or delete your account. Your whole-trip sharing choice is stored on your device. We do not determine your location from your IP address or any other source.

Trips shared with tripmates. If you invite people to a trip or join someone else's, everyone on the trip can see its itinerary, dates, and cover photo; each tripmate's display name, profile photo, and role; a log of changes such as who updated the itinerary or joined; and any shared costs and paybacks logged on the trip, including who paid and each person's share. RoamAlley does not move money and does not collect payment details for this feature.

Purchase information. For your paid plan we receive the plan or pass you bought, transaction identifiers, purchase and expiration dates, renewal, trial, and billing-grace status, the price, currency, and App Store country Apple reports, whether the purchase was made in Apple's test environment, and your purchase history with us. We receive this through our subscription provider, RevenueCat. So that we can find and help your account, we send RevenueCat your account identifier, display name, email address, sign-in method, app version, and device language and region. Apple processes all payments. We never receive your payment card details or billing address.

Device, usage, and diagnostic information. For each device signed in to your account, we keep the device model, operating-system version, app version, an installation identifier, and when it was last used, so you can see and secure your signed-in devices. We keep a push-notification token for each device so we can send the notifications you turn on, and counts of how often you use features that have usage limits. When "Smarter recommendations" is on, we keep a record of each trip you plan: the destination and what you typed to find it, dates and daily times, how you get around, interests and trip notes, the places you picked or skipped and how you found them, any AI request you typed, how long planning took, and a summary of the result, along with running totals such as trips planned and countries visited. These records are linked to your account. Our hosting provider keeps server logs, which can include IP addresses, when the app or website contacts our servers. The app does not include analytics, advertising, or crash-reporting software.

Community content. If you publish a community guide, or post comments, ratings, or reactions, we store that content and show it to other signed-in travelers. If you follow, block, or report another traveler, we store that too. When you report something, we keep a copy of what you reported so we can review it.

Photos. If you add a profile photo, cover photo, trip cover, or photos for a community guide, we store those images. You choose photos with the system photo picker or take one with the camera; the app cannot see the rest of your photo library. Add to Calendar writes your trip's stops to your device's calendar; the app cannot read your calendar, and calendar content is not sent to us. We do not access your contacts or microphone.

Support requests. If you contact us by email or through the support form on our website, we receive your name, email address, message, and anything you attach, and we use them to respond.

Sensitive information. We do not ask for sensitive information, and you should not enter passport numbers, financial account details, medical records, or similar information. Free-text notes and preferences can still reveal sensitive matters, such as health, religion, or accessibility needs, so include only what you are comfortable sharing.

3. Where information comes from

We receive information directly from you and from your use of the Service. We also receive information from: Apple or Google, if you sign in with them (your email address or Apple's relay address and, if you choose, your name); Apple, through RevenueCat (the purchase information described above); and other travelers, who may add you to a trip, include you in shared costs, follow you, or report content involving you.

4. How we use information

We use personal information to:

  • provide the Service, including your account, saved trips, AI suggestions, maps, guidance, sharing, and community features;
  • verify and administer your paid plan;
  • respond to support requests and reports;
  • keep the Service secure, enforce our Terms, moderate community content, and prevent fraud and abuse;
  • send service notices about your account, security, or subscription, and the notifications you turn on;
  • improve the places we suggest and how we rank them, using planning records while "Smarter recommendations" is on; and
  • comply with the law and establish or defend legal claims.

"Smarter recommendations" is on by default. You can turn it off at any time in Settings (tap your profile photo on Home, then the gear icon) under Trip planning, which stops new planning records. We do not use your information for advertising or marketing, we do not sell it, and we do not use it to train AI models.

5. Artificial intelligence providers

RoamAlley uses Google's Gemini models, through Firebase AI Logic and the Gemini Developer API, to generate suggestions. Before any trip details are sent, the app asks for your permission.

  • What is sent: your destination, trip dates, and daily start and end times; how you get around, your interests, and your trip notes; a starting address you type, if you choose one; anything you type in an AI request; the places being considered, with their names, categories, addresses, and map coordinates; for the trip assistant, your itinerary's stops and times; and for packing lists, your trip's weather forecast, the kinds of places you'll visit, and what is already on your list. Earlier assistant messages are not sent with a new request.
  • What is not sent: your name, email address, photos, or your device's GPS location. Requests carry an app-verification token and your sign-in token so Google can authenticate them; these are not given to the model.
  • Purpose: generating place suggestions, trip assistant answers, and packing suggestions for you.
  • Retention: we do not keep AI responses apart from the changes you save. Google may keep requests and responses for a limited period for abuse detection and legal purposes under the Gemini API Additional Terms of Service (https://ai.google.dev/gemini-api/terms) and the Google Privacy Policy (https://policies.google.com/privacy). Deleting your account does not delete copies Google keeps under those terms.
  • Human review: our staff do not read your AI requests or responses. Authorized administrators can see a summary of an account's recent planning activity, such as destinations and the number of stops.
  • Training: neither ICZAAR nor Google uses your requests or responses to train AI models. Under the Gemini API terms for paid services, which apply to our use, Google does not use prompts or responses to improve its products.

You can withdraw permission at any time by turning off "Share trip details with AI" in Settings under Trip planning. AI features will then be unavailable.

6. How we share information

We do not sell personal information or share it for targeted advertising. We share it only as follows:

Service providers. Google (Firebase) for sign-in, database, file storage, server functions, push notifications, remote configuration, app verification, website hosting, Google Sign-In, and the AI models in Section 5; Apple for Sign in with Apple, App Store purchases, push notification delivery, maps and place search, weather, and device verification; RevenueCat for subscription management, which receives the account details described under "Purchase information"; and Zoho for our support email. These providers process information to provide their services to us under contractual terms that require them to protect it.

People you choose. Trips are private by default. Tripmates you invite, or whose trips you join, see the information described in Section 2. Anyone with an invite link you create can see the trip's name and who sent it until the link expires or is used. If you share a plan by link, anyone signed in who opens it can see and copy that plan. Exports such as PDFs and calendar entries are created on your device and go only where you send them.

Other travelers. Your public profile (display name, username, photos, bio, home base, travel personality, and published guides), who you follow, who follows you, and your comments, ratings, and reactions on community guides are visible to other signed-in travelers.

Legal, safety, and business reasons. We may disclose information to comply with the law or valid legal process, to enforce our Terms, to protect the rights, property, or safety of ICZAAR, our users, or others, or in connection with a merger, acquisition, financing, or sale of assets.

7. Cookies, tracking, and privacy signals

The app contains no advertising, analytics, or tracking software and does not track you across other companies' apps or websites. Our website does not set cookies or use tracking technologies. Because we do not sell personal information or use it for targeted advertising, Global Privacy Control and "Do Not Track" signals have no activity to stop; we treat every user as opted out of sale and sharing.

8. How long we keep information

  • Account, profile, trips, and preferences: until you delete them or delete your account.
  • Planning records and typed AI requests: until you delete your account.
  • Trip assistant conversations: not saved.
  • Shared location: positions shared while guiding a day or during a whole trip expire 2 hours after they are sent, and "I'm lost" positions after one hour. Expired positions are deleted automatically, usually within a day.
  • Community content and reports: published content stays until you delete it or your account. Reports, and the copy of reported content, are kept for up to 2 years for safety and enforcement.
  • Subscription status: the subscription status stored with your account is deleted when you delete your account. Apple, as the seller, and RevenueCat keep their own transaction records under their own policies.
  • Support requests: up to 2 years after your request is resolved.
  • Devices, push tokens, and usage counts: until you delete your account. Server logs are kept by our hosting provider for up to 30 days.
  • Backups: we do not keep separate backups of our database, so deleted information is not restored.

We may keep specific information longer if the law requires it or it is needed to resolve a dispute or enforce our Terms.

9. Security

We protect information with encryption in transit and at rest provided by our hosting provider, access rules that limit each account's information to that account and the people it is shared with, and administrator access limited to approved staff accounts on approved devices, with administrative actions logged. No system is perfectly secure, and we cannot guarantee the security of information you send. Protect your device and sign-in method, and contact us if you suspect unauthorized access. We will notify you of a security incident where the law requires.

10. International processing

ICZAAR is based in the United States. Your information is stored and processed in the United States, where our database, file storage, and server functions are hosted on Google Cloud and where RevenueCat operates. Google may process AI requests in other countries where it operates. Where the law of your country requires a safeguard for transfers to the United States, we rely on our providers' participation in the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or on the European Commission's Standard Contractual Clauses included in their data processing terms, and otherwise on the transfer being necessary to provide the Service you request.

11. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to appeal a decision about your request. We honor these requests for all users regardless of location, subject to legal exceptions.

In the app: edit your profile, trips, and content directly; turn off "Share trip details with AI" and "Smarter recommendations" in Settings under Trip planning; manage reminders and news alerts; review blocked travelers; turn location sharing on or off for each trip; and manage location, notification, camera, and photo permissions in your device's Settings.

By email: write to support@roamalley.com to request a copy of your information or anything you cannot do in the app. We may need to verify your identity, and we respond within the time the applicable law requires, normally 30 days. You will not be treated differently for exercising a privacy right.

12. Deleting your account

Open Settings (tap your profile photo on Home, then the gear icon) and tap Delete Account. After you confirm your identity, your account and its information are deleted as described in Section 8. You are removed from every trip shared with you and your shared location is deleted. Trips you own are deleted for everyone on them, along with their shared costs and activity. Costs you logged on other people's trips stay on those trips so their totals remain correct, but no longer show your name or photo. If you signed in with Apple or Google, RoamAlley is disconnected from that account.

Deleting your account or the app does not cancel a subscription; cancel it in your Apple Account settings.

13. Age requirement

The Service is only for people 18 and older. It is not directed to children, and we do not knowingly collect information from anyone under 18. If we learn that someone under 18 has an account, we will delete it and its information. If you believe a minor is using the Service, contact us at support@roamalley.com.

14. Information for users in the European Economic Area, United Kingdom, and Switzerland

We rely on these legal bases:

  • Contract: to provide your account, trips, sharing, community features, AI suggestions you request, and your paid plan.
  • Consent: to send trip details to our AI provider, to access your device's location, camera, and photos, and to send optional notifications. You can withdraw consent at any time without affecting earlier processing.
  • Legitimate interests: to keep the Service secure, prevent abuse, moderate community content, enforce our Terms, and improve suggestions through "Smarter recommendations," which you can turn off. Our interests are operating a safe, reliable, and useful service.
  • Legal obligation: to comply with the law and respond to lawful requests.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. AI suggestions are recommendations you can accept, change, or ignore. You may complain to the data protection authority where you live or work.

15. Information for United States residents

In the past 12 months we have collected the following categories of personal information, for the purposes in Section 4, from the sources in Section 3: identifiers (name, email, account ID, device identifiers); commercial information (purchase history); internet activity (feature usage, server logs); precise geolocation (only when you share it with tripmates); audio-visual information (photos you upload); and inferences (travel preferences). We disclose these only to the recipients in Section 6. We have not sold or shared personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.

To exercise a right, email support@roamalley.com. An authorized agent may submit a request with your written permission. If we deny your request, you may appeal by replying with the subject "Privacy appeal"; we will respond within 45 days. If your appeal is denied, you may contact your state attorney general.

16. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date and, for material changes, notify you in the app. We will ask for your consent where the law requires it.

17. Contact us

ICZAAR LLC
Michigan, United States
Email: support@roamalley.com
Support: https://roamalley.com/support