Privacy Policy

Rumboo is operated by Ricardo Martín, an individual based in Spain, who is the data controller responsible for your personal data. If you have any questions about this policy or your data, you can reach us at ricardomarsanc@gmail.com.

Rumboois “local-first.” The trips you create live on your device and work without an account. We only store your trip data on our servers when you create an account so it can be backed up, synced across your devices, or shared with people you invite. If you use Rumboo without an account, your trip content generally stays on your device and is not sent to us (a subscription purchase is handled by Apple — see below).

Information you give us

• Waitlist email. If you join the waitlist on our website, we collect the email address you enter.
• Account information. When you create an account, you sign in with Google or Apple through our authentication provider. We receive your name, email address, and profile picture (if your provider shares one), plus a sign-in identifier.
• Trip content. The trips, destinations, items (such as flights, hotels and places), expenses, budgets, balances, itineraries, notes, participant names, photos, and documents (such as tickets, insurance, passports or visas) that you add to Rumboo.
• Messages. Anything you send us when you contact us for support.

Information from your device (with your permission)

• Location. If you allow it, we use your device location to show places on your trip map and to help you add nearby places. Rumboo does not track your location in the background.
• Photo library. If you allow it, you can pick photos to add to places or documents, and the trip gallery can show photos taken during your trip dates. Gallery photos are shown from your device only and are not uploaded. You can also save a shareable trip card image to your photo library.
• Notifications. If you allow it, Rumboo schedules local reminders on your device — for example, before a flight, ahead of a hotel check-in, or before a planned activity in your itinerary. These run on your device and are not sent through a push server.

Information created automatically

• Subscription information. When you buy Rumboo Premium, our subscription provider records which subscription and entitlements you have. Payment itself is handled by Apple — we do not receive or store your card details.
• Technical and usage data. Basic technical information needed to run and secure the Service (such as device and app version and timestamps), and privacy-friendly website analytics that help us understand how the website is used.

Information about other people.When you add a participant’s name or invite someone to a trip by email, you give us their information so we can provide the shared trip. Please only add details of people who are happy for you to do so.

We use your information to:

• provide and operate the Service — create and sync your trips, split expenses, show maps and itineraries, and manage shared trips (legal basis: performance of our contract with you);
• manage your account and your Rumboo Premium subscription (performance of our contract; legal obligation for any records we must keep);
• send the waitlist confirmation and let you know when Rumboo launches (your consent, which you can withdraw at any time);
• keep the Service secure, prevent abuse, fix bugs, and improve and understand how Rumboo is used (our legitimate interest in running a safe, reliable product);
• respond to your requests and provide support (performance of our contract and our legitimate interest); and
• comply with the law and respond to valid legal requests (legal obligation).

We do not sell your personal data, and we do not use it for advertising.

We rely on a small number of trusted providers that process data on our behalf to make Rumboo work. They may only use your data to provide their service to us:

• Authentication — to manage sign-in and your account.
• Cloud database — to back up and sync your trip data when you have an account.
• File storage and edge compute — to store documents and custom trip covers, and to securely connect to the data sources below.
• Subscriptions — to manage Rumboo Premium entitlements (alongside the Apple App Store, which handles payment).
• Email — to send the waitlist confirmation and launch announcement.
• In-app feedback — when you open the feedback tool inside the app, your name, email, and avatar are shared with our feedback provider so we can follow up on what you send.
• Website hosting and analytics — to serve our website and understand its usage.

To enrich your trips, Rumboo connects to outside data sources. When you use those features, limited information is sent to power them:

• Maps and places — when you search for a destination or place, or tap the map, your search text or the selected coordinates are sent to our mapping providers (such as Apple Maps and Google) to return results.
• Flight details — when you add a flight, the flight number and date you enter are sent to a flight-data provider to fill in the rest.
• Currency rates — to convert amounts, we request exchange rates by currency code only. Your expense amounts are not sent.
• AI suggestions and planning — if you use the optional AI features (part of Rumboo Premium), the destinations, activity titles, and dates needed for the request are sent to an AI provider to suggest places or arrange your itinerary. We do not send your name, contacts, or financial details for this, and the provider does not use your input to train its models.
• Trip cover photos — when you search the built-in photo gallery for a trip cover, your search text is sent to a stock-image provider to return matching photos.

These providers handle that data under their own privacy policies. The information they return is theirs and may not always be accurate.

We share your information only:

• with the service providers and data sources described above, to operate Rumboo;
• with the people you choose — when you invite someone to a trip, the trip’s content (including expenses and participant names) is visible to its members;
• if required by law, to respond to valid legal requests, or to protect the rights, safety, and security of our users and the Service; and
• in connection with a business transfer, in which case we will let you know.

We never sell your personal data.

Some of our providers are located outside the European Economic Area (for example, in the United States). When your data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, or transfers to countries the Commission considers to provide adequate protection.

We keep your personal data only as long as we need it for the purposes above:

• Waitlist emails — until Rumboo launches and we have notified you, or until you ask us to remove your email, whichever is sooner.
• Account and trip data — for as long as your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must keep something to meet a legal obligation. Content you contributed to a shared trip may remain visible to that group.

We take reasonable technical and organizational measures to protect your data, including encryption in transit and access controls. No method of storage or transmission is completely secure, however, so we cannot guarantee absolute security. Please help by keeping your device and sign-in secure, and by being thoughtful about the documents you upload and the people you share trips with.

Depending on where you live, you have rights over your personal data. Under the EU/UK GDPR you can:

• access a copy of your data and ask us to correct it;
• ask us to delete it (“right to be forgotten”);
• ask us to restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these, email us at ricardomarsanc@gmail.com. You can also delete your account from within the app. If you are in the EEA and believe we have mishandled your data, you may lodge a complaint with your local supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es). If you are a California resident, you have similar rights to know, delete, and opt out of the “sale” of your data — and again, we do not sell your data.

Rumboo is not intended for children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, please contact us and we will delete it.

Our website uses privacy-friendly analytics to understand traffic and improve the site, and does not use advertising or cross-site tracking cookies. The Rumboo app does not use cookies.

We may update this policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, notify you in the app or by email.

Questions about this policy or your data? Email ricardomarsanc@gmail.com.