Privacy Policy

Rumboo is operated by Ricardo Martín, an individual based in Spain, who is the data controller responsible for your personal data. If you have any questions about this policy or your data, you can reach us at rumboo.app@gmail.com.

Rumboois “local-first.” The trips you create live on your device and work without an account. We only store your trip data on our servers when you create an account so it can be backed up, synced across your devices, or shared with people you invite. If you use Rumboo without an account, your trip content generally stays on your device and is not sent to us (a subscription purchase is handled by Apple — see below).

Information you give us

• Waitlist email. If you join the waitlist on our website, we collect the email address you enter.
• Account information. When you create an account, you sign in with Google or Apple through our authentication provider. We receive your name, email address, and profile picture (if your provider shares one), plus a sign-in identifier.
• Trip content. The trips, destinations, items (such as flights, hotels and places), expenses, budgets, balances, itineraries, notes, participant names, photos, and documents (such as tickets, insurance, passports or visas) that you add to Rumboo.
• Messages. Anything you send us when you contact us for support.

Information from your device (with your permission)

• Location. If you allow it, we use your device location to show places on your trip map and to help you add nearby places. Rumboo does not track your location in the background.
• Photo library. If you allow it, you can pick photos to add to places or documents, and the trip gallery can show photos taken during your trip dates. Gallery photos are shown from your device only and are not uploaded. You can also save a shareable trip card image to your photo library.
• Notifications. If you allow it, Rumboo schedules local reminders on your device — for example, before a flight, ahead of a hotel check-in, or before a planned activity in your itinerary. These run on your device and are not sent through a push server.

Information created automatically

• Subscription information. When you buy Rumboo Premium, our subscription provider records which subscription and entitlements you have. Payment itself is handled by Apple — we do not receive or store your card details.
• Technical and usage data. Basic technical information needed to run and secure the Service (such as device model, operating system, app version, language and region, and timestamps), and privacy-friendly website analytics that help us understand how the website is used.
• In-app product analytics. Inside the app we record which screens you open and which features you use (for example creating a trip, adding an expense, or opening the Premium screen), together with the technical data above. Once you sign in, these events are linked to your Rumboo account identifier. We do not record what you type, the contents of your trips, your documents or your photos, and we never use advertising identifiers or track you across other apps and websites. You can turn this off at any time — see section 13.
• Error and crash reports. When something goes wrong we record the error, where in the app it happened, and the technical data above, so that we can fix it. These reports can include the text of an error message; they are not designed to carry your trip content.

Information about other people.When you add a participant’s name or invite someone to a trip by email, you give us their information so we can provide the shared trip. Please only add details of people who are happy for you to do so.

We use your information to:

• provide and operate the Service — create and sync your trips, split expenses, show maps and itineraries, and manage shared trips (legal basis: performance of our contract with you);
• manage your account and your Rumboo Premium subscription (performance of our contract; legal obligation for any records we must keep);
• send the waitlist confirmation and let you know when Rumboo launches (your consent, which you can withdraw at any time);
• keep the Service secure, prevent abuse, fix bugs, and improve and understand how Rumboo is used (our legitimate interest in running a safe, reliable product);
• respond to your requests and provide support (performance of our contract and our legitimate interest); and
• comply with the law and respond to valid legal requests (legal obligation).

We do not sell your personal data, and we do not use it for advertising.

We rely on a small number of trusted providers that process data on our behalf to make Rumboo work. They may only use your data to provide their service to us:

• Authentication — Clerk: manages sign-in and your account.
• Cloud database — Neon: backs up and syncs your trip data when you have an account.
• File storage and edge compute — Cloudflare: stores your documents and custom trip covers, and runs the service that securely connects to the data sources in section 6.
• Subscriptions — RevenueCat: manages Rumboo Premium entitlements, alongside the Apple App Store, which handles payment.
• Email — Resend: stores the waitlist and sends the confirmation and launch announcement.
• In-app feedback — UserJot: when you open the feedback tool inside the app, your name, email and avatar are shared so we can follow up on what you send.
• Product analytics and error reporting — PostHog, hosted in the European Union: receives the in-app usage events and error reports described in section 3. You can turn this off in the app — see section 13.
• Website hosting and analytics — Vercel: serves our website and reports aggregate traffic.

This list is current as of the “Last updated” date above. If we add or change a provider in a way that materially affects your data, we will update this policy as described in section 14.

To enrich your trips, Rumboo connects to outside data sources. When you use those features, limited information is sent to power them:

• Maps and places — Apple Maps, Google Places and Mapbox — when you search for a destination or place, or tap the map, your search text or the selected coordinates are sent to return results. Place and destination searches are proxied through our own service, so the provider does not receive your Rumboo account identifier.
• Flight details — AeroDataBox — when you use the optional flight autofill, the flight number and date you enter are sent to fill in the rest.
• Currency rates — ExchangeRate-API — to convert amounts, we request exchange rates by currency code only. Your expense amounts are never sent.
• AI suggestions and planning — OpenAI — if you use the optional AI features, the destinations, activity titles and dates needed for the request are sent to suggest places or arrange your itinerary. We do not send your name, contacts or financial details, and the provider does not use your input to train its models.
• Trip cover photos — Unsplash — when you search the built-in photo gallery for a trip cover, your search text is sent to return matching photos.

These providers handle that data under their own privacy policies. The information they return is theirs and may not always be accurate.

We share your information only:

• with the service providers and data sources described above, to operate Rumboo;
• with the people you choose — when you invite someone to a trip, the trip’s content (including expenses and participant names) is visible to its members;
• if required by law, to respond to valid legal requests, or to protect the rights, safety, and security of our users and the Service; and
• in connection with a business transfer, in which case we will let you know.

We never sell your personal data.

Some of our providers are located outside the European Economic Area (for example, in the United States). When your data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, or transfers to countries the Commission considers to provide adequate protection.

We keep your personal data only as long as we need it for the purposes above:

• Waitlist emails — until Rumboo launches and we have notified you, or until you ask us to remove your email, whichever is sooner.
• Account and trip data — for as long as your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must keep something to meet a legal obligation. Content you contributed to a shared trip may remain visible to that group.

We take reasonable technical and organizational measures to protect your data, including encryption in transit and access controls. No method of storage or transmission is completely secure, however, so we cannot guarantee absolute security. Please help by keeping your device and sign-in secure, and by being thoughtful about the documents you upload and the people you share trips with.

Depending on where you live, you have rights over your personal data. Under the EU/UK GDPR you can:

• access a copy of your data and ask us to correct it;
• ask us to delete it (“right to be forgotten”);
• ask us to restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these, email us at rumboo.app@gmail.com. You can also delete your account from within the app. If you are in the EEA and believe we have mishandled your data, you may lodge a complaint with your local supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es). If you are a California resident, you have similar rights to know, delete, and opt out of the “sale” of your data — and again, we do not sell your data.

Rumboo is not intended for children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, please contact us and we will delete it.

Website. Our website uses privacy-friendly, aggregate analytics to understand traffic and improve the site. It does not use advertising or cross-site tracking cookies.

App. The Rumboo app does not use cookies. It does send the product-analytics events and error reports described in section 3 to PostHog, hosted in the European Union, so that we can see which features are used and find and fix bugs. We rely on our legitimate interest in running a reliable product for this, and we keep it as narrow as we can: no advertising identifiers, no cross-app or cross-site tracking, no recording of your screen or keystrokes, and no trip content.

How to turn it off. Open Profile → Privacy → Share usage analytics in the app and switch it off. Collection stops on that device immediately, including error reports. Everything else in Rumboo keeps working exactly as before. You can also object to this processing, or ask us to delete what we have already collected, using the rights in section 11.

We may update this policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, notify you in the app or by email.

Questions about this policy or your data? Email rumboo.app@gmail.com.