Privacy Policy
Last updated: October 3, 2026
Roam Idaho ("we", "us") is an independent outdoor-intelligence platform built in Boise, Idaho. This page explains what we collect, why, and what your rights are. We aim for minimum-necessary data and we don't sell user data to third parties.
1. What we collect
Account data (only if you sign in)
- Email address (from your Google account, or one you provide for an email-link sign-in).
- Display name and profile photo URL from Google, if provided.
- An internal user ID issued by Firebase Authentication.
Newsletter requests
If you submit a newsletter signup, your email address, signup source, and timestamps are stored in Firestore so we can manage the update list. To leave the list without deleting your account, email us with the subject "Newsletter removal" from the address you subscribed with. Signing up records your request; it does not guarantee a publication schedule.
App data you create
- Waypoints you save (name, coordinates, icon, color, notes).
- Ballistics profiles you save (rifle and bullet specs).
- Recently viewed and favorited units, waters, trails, and hot springs are stored in your browser's local storage under an account-specific key. Dashboard location and display preferences, map style, a pending checkout choice, and the email address used for an email-link sign-in may also be kept in browser storage. Waypoints and ballistics profiles are synced to Firestore under your Firebase user ID.
Usage data
- After analytics consent, page paths, a random browser-session identifier, browser information, and limited product events (such as map layer toggles) are stored in Firestore. First-party event metadata excludes search text, saved-place names, notes, coordinates, and full URLs. Google Analytics may receive public-page usage, and Microsoft Clarity may record interactions on public pages while you are signed out. Clarity is stopped when you sign in or enter account or map pages; it does not start on pages with a query string or fragment.
- Technical error and performance diagnostics, which may include browser, device, route, and limited request context. Provided by Sentry and used to monitor reliability and fix bugs.
- Server logs may include your IP address, user agent, and request path for security and abuse-prevention purposes.
Billing data (only Pro subscribers)
- Stripe processes all payments. We never see or store your full card number. We do receive a Stripe customer ID and your subscription status, which we use to grant Pro access.
2. Location and saved-data handling
- Roam Idaho does not store transient browser location in your account data. Map location permission can keep coordinates in your browser for map centering or distance calculations. Requested weather coordinates are sent to the National Weather Service. Idaho place-name and five-digit ZIP searches are matched locally against bundled Census Gazetteer data. Submitted street addresses are sent by Roam Idaho's server to the U.S. Census Bureau Geocoder; they are not sent to Open-Meteo or Nominatim.
- We do not sell user data to third parties.
- Waypoints and ballistics profiles are stored and processed by Firebase/Google Cloud under your Firebase user ID. Favorites and recent items remain browser-local; they are not sent by the app to those providers.
3. Why we collect it
- Sign-in: to identify you across visits and sync your saved data.
- Saved data: server-saved waypoints and profiles are available through your account across signed-in devices. Favorites and recent items remain in the browser where you saved them.
- Usage data: to improve the product (which features get used, which pages are slow).
- Billing: to provision Pro access and process renewals.
4. Where it's stored
Saved account data and synced app data live in Google Firestore under your Firebase user ID. Authentication is handled by Firebase Authentication. Payments are processed by Stripe. First-party analytics events are stored through Roam Idaho's server route in Firestore. The site is hosted by Vercel, and technical error and performance diagnostics are processed by Sentry. Roam Idaho does not currently use an AI chatbot or send user content to an AI provider.
5. Cookies and similar technologies
- roam_session: an HTTP-only signed cookie that keeps you signed in for up to 14 days. Firebase may also use browser storage to maintain your sign-in.
- Your analytics choice is stored in browser local storage. If you accept, consent-gated Google Analytics and Microsoft Clarity may use their provider cookies or browser storage.
Use to accept, reject, or withdraw optional analytics. Rejecting stops future optional tracking and removes accessible analytics cookies; it does not erase events already sent. Your choice applies to this browser. If browser storage is blocked, it may last only for the current page session. Essential sign-in and security functions remain available.
6. Your choices, deletion, and retention
- Access: you can see saved data on the dashboard and relevant feature pages, subject to your account's access level.
- Access, correction, or export requests: email taylorfoad@gmail.com from your account address. We may need to verify your identity before disclosing or changing account data. Browser-only favorites and recent items are not part of our server records.
- Delete account: open Settings and choose "Delete account". On success, the request removes your Firebase sign-in, Firestore account data (including waypoints and profiles), and newsletter records matching your account email. It expires open checkout sessions and cancels matching subscriptions immediately without issuing an automatic refund. Account access ends immediately, even when a billing period has time remaining. If any step fails, the app reports the failure and provides a support contact instead of claiming deletion is complete.
- Browser data: successful deletion also attempts to clear this account's saved favorites, recent items, and dashboard location from the browser making the request. Clear Roam Idaho site data in your other browsers and devices to remove their local copies. Browser permission settings control location access.
- Records that can remain: Stripe billing and transaction records, security logs, provider backups, prior analytics records, and support correspondence are not erased by the account button. A minimal account ID and revocation timestamp are retained to block old session tokens. Contact us about these records or a signup under a different email. Retention depends on the provider, operational need, and applicable recordkeeping requirements; account deletion is not a promise of instant removal from every backup.
- Privacy requests: depending on your location and the laws that apply, you may have additional access, correction, deletion, objection, or complaint rights. Contact us to make a request. This policy does not limit rights granted by applicable law.
7. Third-party services we rely on
- Firebase / Google Cloud (auth + database hosting)
- Stripe (payments)
- Vercel (hosting)
- Sentry (error and performance monitoring)
- Google Analytics and Microsoft Clarity (consent-gated telemetry)
- National Weather Service (weather coordinates); U.S. Census Bureau Geocoder (submitted street addresses) and Census Gazetteer data (local place and ZIP matching)
- USGS and IDFG (public outdoor data; requests may include map bounds or public record IDs)
- OpenStreetMap, Esri, and AWS (map tile and elevation requests)
8. Children
Roam Idaho is not directed at children under 13. We do not knowingly collect personal information from anyone under 13.
9. Changes to this policy
If we materially change how we handle data, we'll update this page and the "last updated" date above and provide additional notice when required by applicable law.
10. Contact
Questions or requests: taylorfoad@gmail.com or via the contact form.