Roam (the “Service”) is a mobile guide for visitors to exhibitions and trade fairs. It helps visitors discover booths, locate them on a venue floor plan, and keep a personal record of what they saw.

The Service supports signing in with a Google Account via Google OAuth. This policy explains what information the Service collects, how it is used, where it is stored, and how it is deleted.

a. Information received when you sign in with Google

The Service requests only the default OAuth scopes (openid, email, profile) and receives the following.

b. Information generated through your use of the Service

• Nickname
• Booth reactions, personal notes, photos, and bookmarks
• Reviews, community posts, and attached images
• Selected interests and preference data derived from your activity (used to personalize recommendations)
• Search queries made within the Service

c. Information collected automatically

• A session cookie that keeps you signed in
• Usage records for service improvement (access time, screens viewed, coarse device and browser information)

The Service does not request, access, or store any of the following.

• Data from other Google services such as Google Calendar, Gmail, Drive, or Contacts — the Service does not request those scopes and does not call those APIs.
• Your Google Account password — authentication happens entirely on Google’s side and the Service never receives it.
• Google access tokens or refresh tokens — they are used only to verify your identity at the moment of sign-in, then immediately discarded, and are never persisted on our servers.
• Payment information or government-issued identification numbers
• Precise location (GPS) — the venue map uses floor-plan coordinates only.

• Identifying you and keeping you signed in
• Recommending and personalizing booths you may care about
• Storing and re-displaying your reactions, notes, and photos
• Summarizing your visit and supporting reflection
• Improving service quality and diagnosing errors
• Complying with legal obligations

We do not use your information for any other purpose. If the purpose changes, we will obtain your consent in advance.

What is stored

• Account information (email, nickname, profile image URL, account identifier)
• Booth reactions, notes, bookmarks, reviews, and community posts
• Images you upload
• Preference data and usage records

What is not stored

• Google access tokens and refresh tokens
• Google Account passwords
• Data from other Google services
• The profile image file itself (only its URL)

We do not sell your personal information, and we do not share it with third parties for advertising purposes.

We engage the following processors to operate the Service. Each processes information only for the purpose we entrust to it.

We may disclose information in response to a lawful request from authorities, following the applicable legal process.

These providers may operate servers outside your country, in which case personal information is transferred internationally to the extent necessary to provide the Service.

Roam’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not:

• use Google user data for anything other than providing the features described in this policy;
• use it for advertising or transfer it to advertising platforms;
• sell it;
• allow humans to read it, except for security purposes, to comply with applicable law, or with your explicit consent.

• We retain personal information until you delete your account. On request, we delete your account information and the data you created within 30 days.
• Usage records kept for statistical purposes are retained only after being de-identified.
• Where law requires retention for a fixed period, we store that information separately for the required period and then destroy it.

To delete your account, contact us at roam.ai.kr@gmail.com.

• All traffic is encrypted with HTTPS (TLS).
• Stored data resides on infrastructure with encryption at rest.
• Authentication uses HttpOnly session cookies, and server access is limited to the minimum required for operations.
• Because we never persist Google access or refresh tokens, a breach of our systems cannot expose your Google Account.

You may exercise the following rights at any time.

• Request access to your personal information
• Request correction of inaccurate information
• Request deletion
• Request that processing stop, or withdraw consent

Send requests to roam.ai.kr@gmail.com and we will act without undue delay.

You can also revoke the Service’s access to your Google Account directly at Google Account permissions.

The Service is not directed to children under 14, and we do not knowingly collect their personal information. If we learn that we have, we delete it without delay.

If this policy changes, we will post the change and its effective date on this page. For changes that materially affect your rights, we will give notice in the Service or by email at least 7 days before the effective date, or at least 30 days in advance if the change is adverse to you.

For questions, complaints, or remedies regarding the handling of personal information, please contact us.

Email: roam.ai.kr@gmail.com