← Back to Roamr

Privacy Policy

Roamr is a travel assistant that personalizes results using a context graph built from your stated preferences and the booking decisions you record. This policy explains exactly what is stored, where it lives, and how to remove it.

What we collect

Roamr stores only what it needs to personalize your results:

• Account details — your email address and display name.
• Password — never stored in readable form. It is hashed with scrypt using a unique random salt per account.
• Travel preferences — budget range, accommodation styles, dietary needs, mobility needs, must-haves, things you avoid, and interests.
• Trip history — destinations, dates, stays, and ratings you record.
• Decisions — what you booked or saved and the reasons you gave.
• Authorization records — OAuth clients you have connected and the access tokens issued to them, stored only as irreversible hashes.

How your data is used

Your context graph exists for one purpose: to rank travel results for you. When you search, Roamr scores each candidate against your stored preferences and returns the reasons for the score. When you record a decision, the graph updates so later searches reflect it.

Your data is never sold, rented, or shared with third parties, and is not used to train machine-learning models.

Connecting Roamr to an AI assistant

When you connect Roamr to ChatGPT, Claude, or any other client, you authorize it through a standard OAuth 2.1 flow. You enter your password on a Roamr page — the assistant never sees it. The assistant receives a scoped access token that expires after one hour, and can request only the permissions shown on the consent screen.

Note that the content of your conversation is handled by that assistant under its provider's privacy policy, not this one. Roamr only ever receives the tool calls the assistant makes.

Using Roamr on an aircraft

Roamr also runs on board aircraft operated by Cognair partners. On the aircraft there is no internet connection — the model and your profile both run locally on the hardware in the cabin.

Specifically:

• It is off unless you turn it on. The cabin assistant works for everyone with no app, no account and no sign-in. Your Roamr profile is only involved if you enable In-flight profile in settings, on the ground, before you travel.
• Your password never reaches an aircraft. You identify yourself on board with a short-lived boarding pass — a QR code issued on the ground. It contains no password, no password hash, and no email address, and it expires on its own.
• No itinerary is involved. Roamr does not receive your booking reference, seat, or travel plans from the airline.
• Nothing is loaded speculatively. Because we hold no passenger list, an aircraft cannot fetch anybody's profile in advance. Your profile transfers only at the moment you present your boarding pass at the gate — so only travellers who choose to do so have any data on board.
• The aircraft cannot reach other passengers. Its credential only permits it to return data for travellers who granted permission for that flight — never anyone else.
• Choices you make in the air come back with you. At turnaround, decisions recorded during the flight are merged into your graph. Nothing already in your profile is overwritten or lost.
• Deletion is attested. The aircraft confirms it destroyed its local copies, and that confirmation is recorded. Any flight that fails to confirm is flagged for review.
• You can withdraw at any time. Turning In-flight profile off immediately invalidates every boarding pass you hold.
• You can see where your profile has been — every aircraft and flight it was loaded onto, and whether deletion was confirmed.

One limitation we would rather state than gloss over: because an aircraft in flight has no connection, a withdrawal made after departure takes effect when that aircraft next reaches the ground. Boarding passes are deliberately short-lived to keep that window small.

Where your data is stored

Data is held in a SQLite database on the server operating this Roamr instance. If you self-host Roamr, that server is yours and no data reaches us at all.

Retention

Your context graph is kept until you delete it. Decision history is capped at the most recent 1,000 entries per account; older entries are discarded automatically. Authorization codes expire within one minute, access tokens within one hour, and refresh tokens within thirty days.

Your rights

• Access — call the get_context tool to see everything stored about you, in full.
• Correction — use update_preferences to change any preference.
• Deletion — request removal of your account and context graph at the contact address below. Self-hosted deployments can delete the record directly.
• Withdrawal — revoking access in your AI assistant immediately invalidates that assistant's tokens.

Security

Passwords are hashed with scrypt and verified in constant time. Access and refresh tokens are stored as SHA-256 hashes, so a database copy yields no usable credentials. All authorization flows require PKCE. Roamr should always be served over HTTPS in production.

Children

Roamr is not directed at children under 13 and we do not knowingly collect their data.

Changes

Material changes to this policy will be reflected in the date above and announced in the project repository.

Contact

Questions or deletion requests: [email protected]