Privacy, in plain language.

1. Information We Collect

Account Information

• Name and Email Address: Collected via Apple Sign-In to create and manage your account. Your name and email are optional and controlled by Apple’s privacy settings.
• App Store Country: The country of your App Store account, as Apple reports it with a purchase. We use it to understand where our customers come from and to estimate the sales tax included in a price.
• Email Choices: Whether you have asked us to email you news about Roava, and each time you changed that choice: when, where in the App, and the wording you were shown. See “Email” in section 2.

Location Data

• Precise GPS Coordinates: Including latitude, longitude, altitude, heading, speed, and accuracy metrics. Location data is used to discover nearby landmarks and provide relevant audio tours.
• Continuous Location Tracking: While the App is in use, your location is monitored periodically to detect nearby landmarks. You can disable location access at any time through your device settings, though this will limit core functionality.
• City-Level Presence: When you walk in guided mode, the App sends your location to find your next stop. We also use that location to check whether you are inside a city Roava covers, and record only that city, the day, and the first time this happened. The presence record itself holds no coordinates. We use these records to count how many people walk with Roava in each city. The App sends no location for this purpose on its own.
• Guided Suggestions: Each time guided mode suggests your next stop, we record the stops we offered, how far away each one was, and which one you picked. We do not store your coordinates with them. These records are linked to your account, and we use them to improve which stops we suggest.

Usage and Interaction Data

• Listening History: We record which stories you start and finish, when, whether the listen was free or came with a city you unlocked, and — when a story fails to play — a short error code saying why. Your listening history is how we honour your free listens and your unlocked cities; the listening record and error codes are how we count what gets played and find and fix playback problems.
• Visit History: We record which landmarks you have stood at, and when you first and most recently arrived at each, so a story you have been to stays open in a city you unlocked and your history can show it. We check your location against the landmark when you arrive and then discard it: we do not store your coordinates with these records.
• No Third-Party Analytics: Neither the App nor our servers send analytics events to a third-party analytics service. What we learn about how Roava is used comes from the records described on this page, which we keep ourselves. We do not use any of it to track you across other apps or websites.
• Install Counts: The App sends us up to three anonymous signals per install: when it is first opened, when onboarding is finished, and when someone first signs in on it. Each carries only the date of the first open, the App Store country, and the App version. It carries no account, device, or advertising identifier, and is sent without your sign-in, so we can count installs but cannot link a signal to you or to your device. You can turn these off with the “Share anonymous usage and crash reports” switch on the Account screen.
• App Usage Events: The App tells us what you do in it, such as which screens you open, which landmark you open, when a story starts and finishes, and when you view or complete a purchase. Each event carries the App version and details of what happened: for example the landmark involved, a band for how far you were from it (“under 60 m”, “60 to 250 m”, and so on), how long a guided walk lasted, or a short error message when something fails. It never carries your coordinates, your account, or a purchase’s transaction number. Because stories only play near the landmark they are about, and the distance band says how near you were, these events show roughly where the install was: near which landmark, and when. Events are grouped by a random identifier the App creates for this purpose alone. It is not linked to your account, the App replaces it every 13 months, and events are sent without your sign-in, so we can see that several events came from the same install but not whose install it is. We also mark events from devices where a Roava staff code has been entered, until they sign out, so we can leave our own testing out. We use these events only to count, in aggregate, how people move through the App. We never study one install’s events, and we read individual events only on our own test devices or to fix a fault in the system. We never match them to your account, your purchases or your listening history. You can turn them off with the same “Share anonymous usage and crash reports” switch, which also deletes the identifier and any events not yet sent. It is on the Account screen and, if you have not signed in, on Roava’s page in the iPhone Settings app.

Reports You Send Us

• Reports: If you tell us that a story or a landmark is wrong, or that a landmark is missing, we store what you tell us: the kind of problem, the landmark it is about, any note you write, and any photo you add. When the App knows where you are, we also store where you were standing when you reported it; a missing landmark can’t be reported without it. A report is linked to your account so we can tell reports apart, and we use it only to check and correct what Roava says.
• City Suggestions: If you suggest a city for Roava, we store the city you named and, if you give one, your email address (see “Email” in section 2). When you are signed in, the suggestion is linked to your account.

Device Information

• Technical Data: Device type, operating system, app version, locale, and whether the app is running on an emulator.

Error and Crash Data

• Diagnostic Logs: We use Sentry to collect crash reports, error reports, and performance diagnostics (including those Apple’s MetricKit provides), along with the App version and which part of the App was in use. These reports are not linked to your account. Each carries a random identifier created when the App is installed, which lets us tell that several reports came from the same install but not whose install it is. Sign-in tokens and cookies are removed before a report leaves your device. Sentry receives the reports over the internet, so it sees the IP address they come from, but it does not store it.
• Errors on Our Servers: Our servers report their own errors to Sentry too. When an error happens while handling a purchase, the report can include your account identifier and the purchase’s transaction number, so we can put it right for you.
• Turning It Off: The “Share anonymous usage and crash reports” switch, on the Account screen or on Roava’s page in the iPhone Settings app, stops the install counts and App Usage Events above straight away, and crash reporting from the next time Roava starts. It also stops the Apple Ads check below. It does not affect errors on our servers.

Ads That Brought You to Roava

• Apple Ads Attribution: We advertise Roava on the App Store through Apple Ads. When the App first opens, it asks Apple’s AdServices framework for a token and sends it to us, with a random identifier the App creates for this alone. We give the token back to Apple, which tells us whether the install came from one of our ads and, if so, which campaign, ad group, search keyword and ad, the country, whether you tapped the ad or only saw it, and when. If the install did not come from one of our ads, we keep nothing.
• Linked When You Sign In: When you sign in, we link that record to your account, so we can count which ads lead to people unlocking a city, and forget the random identifier. We never send Apple anything about your account or what you do in the App. Apple states that AdServices does not track you across other companies’ apps or websites, and neither do we.
• Turning It Off: While the “Share anonymous usage and crash reports” switch is off, the App does not ask Apple and sends us nothing for this. Turning it off later does not remove a record we already hold; delete your account, or write to us, to remove it.

Information Stored on Your Device

• App Storage: The App keeps a few values on your device for its own use: your settings, whether it has been opened before, the date of that first open, and whether it has already counted a sign-in (the last two for the install counts above), the random identifier and the queue of not-yet-sent App Usage Events described above, held for up to seven days if you are offline, and, for spacing out requests to rate the App on the App Store, a count of the places you have walked to with in-app directions, and the date, App version and that count at the last such request. For the Apple Ads check it also keeps its own random identifier, when the App first opened, and whether the check has been sent. These are removed when you delete the App.

Photos You Submit

• Photo Files: If you add a photo to a landmark or to a report, we store the image itself. A photo can carry more than its subject — the people in it, and where and roughly when you were — so we treat it as personal information. We strip nothing from the image beyond resizing it, so any location or camera data your device embedded travels with it.
• Submission Record: Which landmark or report the photo belongs to, when you sent it, and that it was you. This is what links the photo to your account, and it is what lets us delete the photo if you ask.
• Where It Is Stored: Privately. Photos you submit are held outside the part of our storage that serves public images, and no photo submitted by a user appears anywhere in the App or on our website today. What we may do with one in future is set out in section 9 of the Terms of Use, which you are shown before you submit.

Our Website

• Website Analytics: Our website uses Plausible Analytics to count page visits and a few actions, such as taps on the download button and waitlist signups. Plausible sets no cookies and stores no personal data: it reports aggregate, anonymous counts — which pages were visited, the referring site, approximate location (no finer than city), and browser, operating system, and device type. To count unique visitors it uses a daily identifier derived from your IP address and browser, which it replaces every 24 hours and never stores in raw form. It does not track you across other websites.
• Waitlist: If you leave your email on our website to hear when Roava launches, we store the address, the city you named (if you named one), and when you signed up. See “Email” in section 2 for what we do with it.

2. How We Use Your Information

• Core Functionality: To discover nearby landmarks, deliver audio tours, and track your visit history.
• AI-Generated Content: Roava’s tour content is created ahead of time using artificial intelligence services. When producing this content we send landmark metadata (name, type, facts) to AI providers — your personal information and individual location queries are not included in these requests.
• Purchase Management: To validate your purchases and manage access to unlocked cities.
• Analytics and Improvement: To understand how the App is used and improve the experience.
• Error Resolution: To diagnose and fix technical issues.
• Correcting Our Content: To check and fix what Roava says, using the reports you send us.
• Email: To send you the email you asked for, described below.

We do not sell your personal information, show ads in the App, or share your information with advertisers. We market Roava ourselves in three ways only: by email to people who have asked for it, as described below; with App Store ads through Apple Ads, whose results we measure as described in section 1; and, in future, with photos you submit, as section 9 of the Terms of Use allows.

Email

• Only If You Ask: We email you news about Roava, such as new cities, only if you opt in: by ticking “Email me news about Roava, like new cities” when you sign in, or by turning on the switch of the same name on the Account screen. Both start off. Opting in is never a condition of using the App.
• Launch Notices: If you join the waitlist on our website, or give your email when you suggest a city in the App, we use that address only to tell you when Roava launches, or when it opens in the city you named. Nothing else.
• How to Stop: Turn the switch off on the Account screen, use the unsubscribe link in any news or launch email we send, or write to us at support@getroava.app. Stopping takes effect for every email after it.
• Hide My Email: If you chose Hide My Email when you signed in with Apple, we only know a private relay address. Apple forwards our email to you, and you can stop that forwarding at any time in your Apple Account settings.

Legal Bases (European Economic Area, United Kingdom, and Switzerland)

• To provide the App you asked for: your account, location for nearby landmarks, listening history, and purchases.
• Your consent: email with news about Roava, launch notices, and photos you choose to submit. You can withdraw your consent at any time, which does not affect what we did before you withdrew it.
• Our legitimate interests: city-level presence, guided suggestions, App Store country, the listening record and playback error codes, App Usage Events, the reports you send us, and crash and diagnostic reports — to understand how Roava is used, improve it, correct what it says, and keep it working; which Apple Ads ad led to your install, to learn which of our ads lead to purchases; and server logs and rate limiting, to keep our servers secure. You can object to this at any time: the “Share anonymous usage and crash reports” switch on the Account screen stops App Usage Events, crash reports and the Apple Ads check, and you can contact us about the rest.
• Our legal obligations: the record of your email choices, which proves when you gave or withdrew consent, and records of App Store sales and refunds.
• Anonymous statistics: the install counts described above, which identify no one. The same switch stops them.

3. Third-Party Services

We share data with the following service providers to run the App and our website. They process it on our behalf:

Where these providers process your information, and the safeguards that apply, are set out in section 9.

4. AI-Generated Content

Roava’s tour scripts and audio narration are created ahead of time using artificial intelligence. We send landmark information (not your personal data) to AI providers when producing this content, and the resulting audio is stored and served to everyone — it is not generated from your individual activity. Please review the privacy policies of our AI providers (OpenAI, ElevenLabs, Exa) for details on how they handle data.

5. Data Retention

• Your Account and What It Holds: Your account, purchases and unlocked cities, listening and visit history, city-level presence, App Store country, reports, and email choices are kept for as long as your account exists, and deleted when you delete it.
• Guided Suggestions: Kept for at most 13 months, and deleted sooner if you delete your account.
• Apple Ads Attribution: Kept for at most 13 months from your install, and deleted sooner if you delete your account.
• App Store Transaction Records: Apple’s notices to us about a purchase or a refund — the transaction number, the product, the App Store country, and the price — are kept after you delete your account, as our record of sales and refunds. Once your account is gone, nothing in them names you. We have no automatic expiry for them yet.
• Submitted Photos: Retained until you ask us to remove the photo, or until you delete your account — whichever comes first. We have no automatic expiry for them; if that changes, this line changes with it.
• Waitlist and City-Suggestion Email Addresses: Kept until you ask us to remove them. A city suggestion you made while signed in is also deleted with your account. We have no automatic expiry for them yet.
• Install Counts: Kept for about 25 months, then deleted. They identify no one, so there is nothing in them to delete on request.
• App Usage Events: Kept for about 25 months, then deleted. They are not linked to your account, so deleting your account does not find them, and they cannot be looked up for you; turning off the switch stops new ones.
• Crash and Error Reports: Kept by Sentry for up to 90 days, then deleted.
• Server Logs: Kept by Vercel for one day, then deleted.
• Rate Limiting: Upstash holds your IP address for about two minutes.
• Email Records: Resend keeps a record of each email it sends for 30 days.
• Backups: Deleted information can remain in our database backups for up to seven days, until those backups are replaced.
• AI-Generated Content: Stored indefinitely to serve all users. This content is associated with landmarks, not individual users.

6. Data Security

We implement reasonable security measures to protect your information, including:

• Encrypted data transmission (HTTPS)
• Token-based authentication with automatic rotation
• Rate limiting on API requests
• Secure storage of credentials on your device
• Sanitization of sensitive data before error reporting

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct personal data that is wrong or incomplete.
• Deletion: Delete your account in the App (Account, then “Delete account”) or ask us to. Deleting your account deletes all associated personal data, including the photos you submitted and their stored image files, except the App Store transaction records described in section 5. You can also ask us to delete a single photo, or an email address you gave us for the waitlist or a city suggestion.
• Restriction: Ask us to stop using your personal data, other than storing it, while a question about it is settled.
• Portability: Ask for the personal data you gave us in a structured, machine-readable format.
• Objection: Object to anything we do on the basis of our legitimate interests. The “Share anonymous usage and crash reports” switch on the Account screen stops install counts, App Usage Events and crash reports; for anything else, contact us.
• Withdrawing Consent: Stop our email at any time, as described in section 2, or withdraw the licence for a photo as the Terms of Use describe.
• Location Opt-Out: Disable location services through your device settings at any time.

To exercise any of these rights, contact us at the email below. We answer within one month. You also have the right to complain to your data protection authority — in France, the CNIL (cnil.fr).

8. Children’s Privacy

Roava is intended for users age 13 and older. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will promptly delete it. If you believe a child under 13 has provided us with personal information, please contact us.

9. International Data Transfers

Roava is operated from Canada. The European Commission has recognised Canada as providing adequate protection for personal data received by commercial organisations such as ours.

We use service providers to host and process your information on our behalf, and some of them process it in the United States. When they do, we rely on one of the following safeguards for information about people in the European Economic Area, the United Kingdom or Switzerland:

• the provider’s certification under the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. Data Privacy Framework), which the European Commission has found to provide adequate protection; or
• the Standard Contractual Clauses approved by the European Commission, included in our data processing agreement with the provider (with the UK and Swiss addenda).

Plausible, which counts visits to our website, is based in the EU and keeps that data in the EU.

You can ask us for a copy of the safeguards that apply by contacting us at support@getroava.app.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this page. Your continued use of the App after changes constitutes acceptance of the updated policy.

11. Governing Law

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of law principles.

12. Contact

For questions, concerns, or data requests, contact us at:

Email: support@getroava.app

Mail: SimpleSyrup Inc., 10-1338 Wellington St W, Ottawa, ON K1Y 3B7, Canada