Privacy Policy

Effective date: November 1, 2026

RoamFolio is an iOS app developed by Nossa ("Nossa," "we," "us," or "our") that helps you collect passport-style stamps for real-world cities you visit, connect with friends, and send postcards. This Privacy Policy explains what information the app accesses, how it's used, and the choices you have. RoamFolio has no user accounts of its own outside of Sign in with Apple, and most of what it does happens almost entirely on your device or inside your own iCloud account, using Apple's own frameworks (CoreLocation, Photos, HealthKit, CloudKit, Vision, and Apple Intelligence's on-device language model). For your RoamPost profile and friends, your avatar, and the in-app coin balance used for optional postcard-delivery upgrades, RoamFolio talks to small services Nossa operates and hosts itself, described below.

In short: RoamFolio requires signing in with Apple once, during setup, to give you an identity (there's no separate RoamFolio account, email, or password) — after that, your location is used only to find stamping stations near you, to tell you when a stamp is within reach (also with the app closed, if you allow "Always" location access), and to scale postcard delivery time, your photos are read on-device for their location/date metadata or, if they have none, for text and scenery that hint at the city (never uploaded to us — the one exception is a profile picture you choose to set), your collected stamps and postcards back up to your own private iCloud account, your RoamPost profile and friend list are kept by a small Nossa-operated service, your optional in-app coin balance lives in a small Nossa-operated ledger tied only to an opaque Apple identifier, the optional virtual Camino reads only your daily walking and running distance from Apple Health (never your location or routes), the short notes you choose to leave in a Good Vibes Box are shown to other travelers, if you choose to walk the virtual Camino with the community your name, photo, optional country and progress on the route are shown to other community walkers on the same route, deleting your account erases all of it everywhere it's stored, and the only third-party service we use is a privacy-focused analytics provider that doesn't track you across other apps or require a tracking prompt.

1. Information We Collect

Location data

RoamFolio asks for location access ("while using the app") to show which stamping stations are nearby and to verify you're within range of one before letting you collect its stamp. Location is read live on your device to power this proximity check and the map views; RoamFolio does not keep a background location log, does not build a location history beyond the stamps you actually collect, and does not sell or share raw location data with anyone. If you're signed in, RoamFolio also sends your most recent location (and the location of the last stamp you collected) to the RoamPost service described below, so postcard delivery time can scale with the distance between you and a friend. Only the latest position is kept, it is never shown to anyone, and the service only ever reveals a rounded distance (to the nearest 250 km) to a friend you've connected with.

Nearby-stamp alerts (optional). RoamFolio can notify you when a stamp you haven't collected is within reach. With "While Using" access this only works while the app is open. If you also allow "Always" location access (RoamFolio asks once, after your first stamp, and you can decline), iOS can wake the app in the background when you enter the area of a nearby stamp or move a long distance, so the alert can arrive with the app closed. The comparison between your position and the stamps' locations happens on your device, and a position read in the background is not sent to us. You can turn these alerts off in RoamFolio's Notifications settings, or change location access any time in iOS Settings.

Photos

RoamFolio can read photo metadata in a few different ways, depending on the feature:

Adding a past trip ("Retro-Add"): when you pick a photo from your library (via Apple's system photo picker, which does not grant RoamFolio ongoing library access) or share one in from Google Photos, Files, or another app, RoamFolio reads that single photo's embedded GPS coordinate and capture date to match it against nearby stamping stations. The photo is never stored or uploaded. If it has no embedded location, then on devices that support Apple Intelligence RoamFolio uses Apple's Vision framework on your device to read any text in the photo and label its scene, and passes that text to Apple's on-device language model to suggest which city it was taken in. This runs entirely on your device — neither the photo nor those clues are transmitted to us or any third party — and a suggested city is only ever offered for you to confirm, never added automatically. Otherwise only the location/date metadata is used, momentarily, to find a match.
Sending a postcard, and viewing "Photos From This Trip": to help you pick a photo taken near a stamp — either while composing a postcard, or when browsing the photos your library has near a stamp you've already collected — RoamFolio requests broader photo library access for these features (iOS only offers a combined read/write permission level here; RoamFolio only ever reads your photos and never modifies or deletes them). It scans your library's location metadata to surface nearby matches; a photo you actively choose for a postcard is cropped on-device (Apple's Vision framework picks the most visually interesting area to keep, entirely on-device) and becomes part of a postcard you send — see "Sign in with Apple, Friends, and Postcards" below for how that's stored and shared.

Apple Health: walking and running distance (optional)

The virtual Camino is an optional feature that moves you along a famous pilgrimage route as you walk in real life. If you start a journey and allow access, RoamFolio reads one thing from Apple Health: your walking and running distance. It does not read your location, your routes, your heart rate, or any other Health data, and it never writes to Health. RoamFolio totals that distance per day and sends only those daily kilometre totals (not the underlying Health samples) to the RoamPost service described below, which keeps your journey's progress on the route. If you let friends see your journey, they see which stop you've reached and your progress, never your Health data or location. Health data is not used for advertising or sold, and is not shared with anyone else. You can revoke access anytime in the Health app or iOS Settings, pause or leave a journey, or delete your account, which removes the journey and its daily totals.

Trail guide (optional)

The guide on the Home screen (Henry or Judy) answers questions about the app. On iPhones with Apple Intelligence, the answer is written by Apple's on-device language model, and the question you type (up to 300 characters) stays on your device. Your stamp counts and next badge are used on the device to make the answer relevant; your coordinates are never used. On other iPhones the guide shows a built-in list of common questions. Nothing you type to the guide is sent to us unless you choose to send it:

A thumbs-down report. If you rate an answer down, pick a reason and tap Send, we receive the question, the guide's answer, your reason, how the guide classified the question, which guide you picked and your language. It is sent only when you tap Send.
A suggestion. The "Suggest an improvement" form sends the category you pick and up to 500 characters you write. A switch, off by default, can add your last question and the guide's answer. It is sent only when you tap Send.

Reports and suggestions are anonymous: they are stored without your name or account, may contain whatever you wrote (so please don't include personal details), and are read only by us to improve the guide. Suggestions are also copied into a private issue tracker on GitHub so we can work through them; GitHub therefore processes the text of a suggestion on our behalf. Both are deleted after 12 months. Counts of how often the guide is used, and whether an answer was rated up or down, are sent as anonymous analytics and never contain your words.

Lock screen widget (optional)

If you add the virtual Camino widget, it shows your progress for the day and your streak. The numbers are shared between the app and the widget on your device only; the widget does not send anything anywhere.

Camera

The camera is used only to scan a friend's RoamPost QR code so you can connect with them. RoamFolio does not otherwise access the camera and does not store camera frames or images from this scan.

Stamps, badges, and friend activity you generate

The stations you've stamped and the dates you collected them, and the postcards you send and receive, are stored on your device and backed up to your own private iCloud account (via Apple's CloudKit) so they sync across your own devices. This data is private to your iCloud account — RoamFolio has no server that stores or has access to it. Your unlocked badge list and friend connections are also stored with your RoamPost profile, described below.

Name, avatar, country, and status

Your display name defaults to the name Apple shares with RoamFolio the first time you sign in (only ever provided on that first authorization, and only if you choose to share it); if you don't share a name, or want to change it later, you can set or edit it anytime from Account. It's used for your in-app greeting and shown to any friends you connect with. Your profile picture is a generated avatar rendered from your display name by a small image-rendering service Nossa operates and hosts itself, unless you choose to set your own photo from Account. A photo you choose is cropped and downsized on your device to a small square and uploaded to storage Nossa operates; friends you're connected with see it, and it can be viewed by anyone who has its long, unguessable link (which is only shared with you and your friends). You can switch back to the generated avatar at any time, which deletes the uploaded photo — see "Third-Party and Nossa-Operated Services" below. You can also set a short status line under your dashboard greeting ("What are you up to?") at any time; unlike your locally-stored stamps, this status is stored with your RoamFolio profile on Nossa's service so any friend you're connected with can see it on the Friends screen — see "Sharing With Other Users" below.

Sign in with Apple, Friends, and Postcards

RoamFolio has no separate account system of its own — Sign in with Apple, completed once during setup, is how you get an identity in the app at all, and there's currently no way to finish setup without it. What stays optional afterward is whether you actually use RoamPost, the social side built on top of that identity: connecting with friends and sending postcards. We store the opaque identifier Apple provides, your display name, a randomly generated friend code and invite code, your unlocked-badge list and status line, and your friend connections in a small database Nossa operates (on Cloudflare) — not in CloudKit. Adding a friend (by entering their code or scanning their QR code) sends that person a request through that service; the connection only becomes active once they accept it, and either side can remove the connection or block the other person afterward. When you send a postcard, its artwork (built from your chosen photo and stamp) and any short personal message you add are stored in a private, per-recipient CloudKit share that only you and that specific friend can access. Signing in also lets RoamFolio verify you for the optional coin wallet described next, and you can sign out again anytime from Account — your already-collected stamps keep working locally and via iCloud either way, since they don't depend on being signed in.

Coins and couriers (optional)

RoamFolio has an optional in-app currency ("coins") you can earn — for example, by collecting your first stamp, sending your first postcard, or referring friends who accept your requests, or drawing a coin voucher from a Good Vibes Box — and spend on optional upgrades, like an Extra Postman (to send another postcard while your free Postman is out on a delivery), extra passport pages and passports, or the full virtual Camino routes. This only applies if you've signed in with Apple; coins are not required to collect stamps or fill your passport. To stop a coin balance from being edited by tampering with the app's local storage, your balance and the history of how you earned or spent it are tracked in a small ledger Nossa operates and hosts itself (a Cloudflare Worker and database, not a third party), keyed only to the opaque, per-app identifier Apple's Sign in with Apple provides — the same identifier used for Friends/Postcards, not your name, email, or Apple ID itself. This ledger never sees your stamps, photos, postcards, or contacts.

Buying coins. You can also buy coin packs in the app with real money, as optional App Store in-app purchases. Apple handles the payment: Nossa never sees your card, Apple ID or other payment details. To credit the coins, RoamFolio sends the purchase receipt Apple signs for that transaction (which pack was bought and Apple's transaction id, tagged with an opaque identifier derived from your account) to our coin-wallet service, which checks it with Apple's published certificates and adds the coins once. We keep that transaction id and the coins credited in your wallet log, and delete them with your account. Refunds and receipts are handled by Apple.

Good Vibes Box notes (optional)

When you collect a Trail or World Tour stamp while standing at the stop, you may be offered a "Good Vibes Box": you write a short note (up to 150 characters) and draw another traveler's note in return, or occasionally a coin voucher. To confirm you are really at the stop, RoamFolio sends your current location to the RoamPost service once; it is compared with the stop and discarded, not stored. Your note is stored with your account and your note's language, and the person who draws it sees your display name next to it, even though you aren't connected as friends. A note is read by one traveler, and you are never told who drew it or liked it; you receive a notification that it was drawn or liked, if you allow it. Notes cannot contain links, email addresses or phone numbers, are filtered for abusive language, and can be reported by the reader, so we may keep a drawn note, its author and any report on it for as long as needed to review reports. Deleting your account removes your notes.

Notifications (optional)

Once you've signed in with Apple, RoamFolio will ask for permission to send notifications so it can let you know when a postcard is delivered to you, when a friend request arrives, when a postcard you sent reaches its recipient, and, for the virtual Camino and Good Vibes Box, when a friend invites you to walk, finishes a route, a weekly digest of your walk, when someone cheers you on during your walk, when your note is drawn or liked, or, if you leave "News from RoamFolio" on, when we publish news about the app. Postcard alerts use a silent CloudKit push to wake the app so it can prepare the alert — the push itself carries no postcard content or message text, only enough to tell the app something needs checking. Friend-request, referral, Camino, Good Vibes Box and news alerts are sent by Nossa's RoamPost service through Apple's push notification service (APNs); for that, your device's push token is stored with your profile (and removed if you delete your account), and the alert text includes the other person's display name. RoamFolio also sends an immediate, on-device notification whenever you earn bonus coins (e.g. your first stamp or first postcard) — this one doesn't involve a network push at all, it just reports something that already happened locally. Beyond the system-level permission, RoamFolio's own Notifications settings screen lets you turn postcard, friend-request, Camino, Good Vibes Box and news alerts on or off independently (the coins-earned notification doesn't have its own toggle yet), and a separate toggle controls nearby-stamp alerts, which are created on your device and don't involve a network push. You can decline or later disable notifications entirely anytime in iOS Settings → Notifications → RoamFolio without affecting any other feature.

Usage analytics

We use TelemetryDeck, a privacy-focused analytics service, to understand how people use RoamFolio — which screens are visited, how many stamps are collected and from which flow, aggregate friend-discovery activity (e.g. that a friend code was submitted, not who was found), postcard and trail-passport milestones, and non-identifying error events when something fails. TelemetryDeck does not use advertising identifiers, does not track you across other apps or websites, and does not require an App Tracking Transparency prompt because it doesn't perform cross-app tracking.

2. How We Use Information

To show you stamping stations near your current location and let you collect them.
To match a photo's embedded location/date against nearby stations for retro-adding stamps, or to suggest a city on-device when a photo has no location, and to surface nearby photos for postcards or your stamp's photo gallery.
To back up and sync your collected stamps and postcards across your own devices via iCloud.
To store your RoamPost profile and friend connections so you and your friends can find and see each other, via a service Nossa operates.
To move you along the virtual Camino using your daily walking and running distance from Apple Health, and to show your progress to friends you allow.
To run the Good Vibes Box, showing your note and display name to the one traveler who draws it.
If you choose to walk the virtual Camino with the community, to list you to other community walkers on the same route and let them cheer you on or ask to be friends.
To scale postcard delivery time by the distance between you and a friend, using your most recent location, which is never shown to anyone.
To power RoamPost's optional social features — friend requests, badge and status sharing between friends, and postcard delivery — for the parts of the app you actually choose to use beyond the required sign-in.
To notify you, if you allow it, when a postcard or friend request arrives, when a postcard you sent has been delivered, or when a stamp you can collect is within reach.
To render a generated avatar image from your display name, or store and show the profile photo you choose, via our own self-hosted services.
To track and update your optional coin balance and purchases, via our own self-hosted coin-wallet service, for signed-in users who use that feature.
To carry out a full account deletion when you request one — removing your profile, stamps, badges, connections, postcards, and coin balance from every place RoamFolio stored them.
To understand aggregate app usage and fix errors, via TelemetryDeck.

We do not use your information to serve third-party ads, and we do not sell your personal information.

3. Data Storage and Syncing

RoamFolio does not operate a general-purpose backend server for your data. Your collected stamps and postcards are stored using Apple's CloudKit, inside your own iCloud account; your RoamPost profile and friends live in a small service Nossa operates (described below):

Your private database: your collected stamps, and a one-time marker that you have sent a postcard (so a new device doesn't ask you to send your first one again), sync only to your own devices, tied to your Apple ID.
A shared, per-recipient record: a postcard you send, including any message you add, is placed in a CloudKit share scoped to you and the one friend you sent it to — not a public or queryable database.
Postcard delivery pointer: a small pointer used to notify a recipient that a postcard is waiting is stored in CloudKit's public database, scoped to the RoamFolio app — containing only what's needed to make delivery work, never postcard photo content.

Two things live on services Nossa runs itself (Cloudflare Workers, a database and file storage), separate from iCloud. Your RoamPost profile: Apple's opaque per-app identifier, your display name, friend and invite codes, unlocked-badge list, status line, the location described above, your device's push token together with your device's language and the app version (so news alerts are written in your language and sent only to versions that can show them), your friend connections and requests, invite redemptions, a profile photo if you set one, your virtual Camino journeys (route, start date, paused or finished state, whether you walk with the community, and daily kilometre totals), the optional country you choose, any reports you make about another community walker, the Good Vibes Box notes you write and draws you make, and any paid routes you own. The optional coin wallet described above: your coin balance and a log of how you earned or spent coins, keyed to Apple's opaque per-app identifier rather than your name or Apple ID.

If iCloud is unavailable or you're signed out, RoamFolio's core stamp-collecting features keep working fully offline using on-device storage; only cross-device sync and postcards require iCloud (Friends require an internet connection).

4. Third-Party and Nossa-Operated Services

Service	Purpose	What it sees
Apple CloudKit / iCloud	Stores collected stamps and postcards, plus a small postcard-delivery pointer	Whatever is described in "Data Storage and Syncing" above, governed by Apple's own privacy policy
Apple Sign in with Apple	Required identity, set up once during onboarding; also underlies the optional Friends/Postcards and coin-wallet features	An opaque user identifier; no profile data is requested
Apple Vision (on-device)	Frames the photo you pick for a postcard; reads text and scene labels from a photo with no location to suggest a city	Runs entirely on your device; nothing is transmitted
Apple Intelligence on-device language model	Suggests which city a photo with no location was taken in, from the text and scene labels Vision finds	Runs entirely on your device; nothing is transmitted to us or any third party
Nossa Avatar Service (self-hosted, not a third party)	Renders your generated profile avatar	Your display name (used as a rendering seed) and the resulting image size; operated by us on our own infrastructure, not shared with any outside company
Nossa RoamPost Service (self-hosted, not a third party)	Stores your profile, friend connections, optional profile photo, virtual Camino journeys and Good Vibes Box notes; scales postcard delivery time by distance; and sends friend-request, Camino and Good Vibes Box alerts	Apple's opaque per-app identifier (verified through your wallet session), display name, friend and invite codes, badge list, status line, your most recent location (never shown to anyone), push token with your device's language and app version, friend connections, and a profile photo if you set one; daily virtual Camino kilometre totals, and Good Vibes Box notes; never your photo library, postcards, contacts, or other Health data
Apple HealthKit (on-device)	Reads your walking and running distance for the optional virtual Camino	Read on your device only; just daily distance totals are sent to the RoamPost service. Nothing is written to Health
Apple Push Notification service (APNs)	Delivers friend-request and referral alerts to your device	Your device's push token and the alert text, governed by Apple's own privacy policy
GitHub (private repository)	Holds the suggestions you send from the Trail guide's "Suggest an improvement" form as issues for us to review	The text of the suggestion, its category, your language and which guide you picked, and your last question and the guide's answer only if you switched that on; never your name or account. Governed by GitHub's own privacy policy
Apple App Store (in-app purchase)	Processes optional coin-pack purchases and issues the signed receipt that credits them	Your payment and Apple ID details, governed by Apple's own privacy policy; Nossa never receives them
Nossa Coin Wallet Service (self-hosted, not a third party)	Tracks your optional coin balance, the coin packs you buy and Extra Postman/passport/passport-page purchases	Apple's opaque per-app identifier (verified via a signed Sign in with Apple token), your coin balance, a log of earn/spend events, and the Apple transaction id and pack of any coin purchase (never payment details); never your name, stamps, photos, postcards, or contacts
Nossa Content Catalog (self-hosted, not a third party)	Delivers new stamp artwork and station, peak and trail-route listings without an app update	A read-only request for public content, so like any web request it sees your device's IP address; it receives no account, location, photo or stamp data
TelemetryDeck	Privacy-conscious usage analytics	Anonymous, aggregate usage signals (see "Usage analytics" above)

5. Sharing With Other Users

RoamFolio has no public profiles, social feed, or searchable directory of users. Apart from walking with the community and Good Vibes Box notes (below), information is only shared with another person when you take a deliberate action to connect with them, or once they're already your accepted friend:

Sharing your friend code or QR code shares that code (not your location or stamp history) with whoever you show it to.
Sending or accepting a friend request shares your display name, avatar (including your profile photo, if you set one), status line, and unlocked badge progress with that friend, for as long as you're connected. Postcard delivery uses your approximate distance to a friend (rounded to 250 km) to set the delivery time; your location itself is never shown.
Sending a postcard shares that specific postcard's artwork, any message you wrote, the stamped station's name, the date, and your display name with the one friend you sent it to.
If you let friends see your virtual Camino journey, a friend walking the same route sees your display name, avatar, and the stop you've reached, and can send you a cheer. Daily distance and Health data are not shown to friends. Friends can also see that you're walking the route in a weekly digest.
Walking the virtual Camino with the community is a choice you see before you start: the start screen offers Community or Friends only, with Community pre-selected, and you can switch at any time from the walk's Community screen. If you walk with the community, other people who are walking the same route with the community, who need not be your friends, can see your display name, avatar, the country you chose (optional, a country only, never a city or location), how far you have walked, how many days you have been walking, and the stop you are near. They can send you a cheer and ask to be your friend, which you can decline. Your location and Health data are never shown. Walkers who log no distance for 14 days drop off the list, you can leave the community any time from the walk's menu, and either of you can block or report the other. A report is stored with both people's identifiers and the route for us to review.
A Good Vibes Box note you leave is shown, with your display name, to the one traveler who draws it, who need not be your friend. They cannot contact you through it.

6. Your Choices and Controls

Permissions: Location, Photos, Camera, Health, and Notifications access can each be reviewed or revoked anytime in iOS Settings → Privacy & Security, or Settings → RoamFolio. Declining a permission simply disables the feature that needs it (e.g., without location access, nearby stations won't be found; without notifications, you just won't get an alert for postcards and friend requests; with location set to "While Using" instead of "Always", nearby-stamp alerts only appear while the app is open).
Sign-in: Sign in with Apple is a required, one-time step during setup — there's currently no way to use RoamFolio, including basic stamp collecting, without completing it once. What's optional is everything built on top of it: you're never required to add a friend, send a postcard, or use the coin wallet, and you can sign out again anytime from Account (your already-collected stamps keep syncing via iCloud regardless of sign-in status). You can also decline any friend request, and remove or block a friend at any time from the Friends screen. Walking the virtual Camino with the community is likewise your choice: you can leave it any time, leave your country blank, and block or report any community walker.
Deleting your account: from Account → Delete Account, you can permanently delete your RoamPost profile, friend code, friend connections and requests, collected stamps, badges, sent and received postcards, and your virtual Camino journeys and Good Vibes Box notes, and your coin balance — from CloudKit, our RoamPost service (including any uploaded profile photo), our coin-wallet database, and your device, in one flow. This is separate from, and more thorough than, simply deleting the app.
Deleting the app: uninstalling RoamFolio removes all locally stored data. Because your stamps and postcards live in your own iCloud account, you can also remove that data separately via iOS Settings → [your name] → iCloud → Manage Account Storage; using the in-app account deletion above is the only way to also remove your RoamPost profile, friend data, and coin-wallet record.

7. Children's Privacy

RoamFolio is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us using the details below so we can address it.

8. Data Retention

Stamps and postcards persist for as long as your iCloud account retains them, or until you delete the app / remove that data from iCloud yourself. Your RoamPost profile, friend connections, any profile photo, virtual Camino journeys and daily totals, Good Vibes Box notes, your optional country, any reports you made about or received from a community walker, and your optional coin balance and its transaction log, persist until you delete your account, at which point they're removed from our services. Trail guide reports and suggestions are kept for up to 12 months and then deleted; because they are not tied to your account, deleting your account does not remove them earlier. Analytics signals sent to TelemetryDeck are anonymous and are not linked back to an individual identity we control.

9. Security

Your stamps and postcards live in your own iCloud account, so they inherit Apple's iCloud security and encryption protections; your RoamPost profile and friend data are held by Nossa-operated services on Cloudflare and are only accessible with a valid signed-in session. Postcards are stored in per-recipient CloudKit shares rather than a publicly queryable database, so only the intended recipient can access them. The coin-wallet service verifies your Sign in with Apple token cryptographically against Apple's own published keys before issuing it a session, and that session token is the only credential used for wallet and RoamPost requests afterward.

10. Changes to This Policy

If RoamFolio's data practices change materially — for example, if a future feature adds a new kind of data collection — we'll update this page and revise the effective date above.

11. Contact Us

Questions about this policy or how RoamFolio handles your data? Reach out at support@nossaapp.com.