Your privacy

ROVEBOUND · Staging notice · Updated November 8, 2026

This notice describes the development build. Infrastructure backup/log retention periods must be confirmed before public release.

Private ARC video pilot

The development build supports one video of up to 30 seconds per upload, inside an ARC only. When you upload, the selected original is quarantined in private Cloudflare storage, downloaded to the manually started isolated Mac processor, and replaced by processed output. Owners or appointed moderators review the processed clip before members can watch; someone else must review the uploader’s own clip. Processing and AI do not approve content. Videos never appear in Rove World.

Uploads remain device drafts when unavailable. Withdrawn, rejected, hidden or deleted-account clips lose access and their media is queued for removal if storage cleanup fails. Source deletion is retried after processing. Local processor temporary files are removed when the job finishes. Pilot records retain a lifetime slot; account deletion removes captions and personal review data. Existing copies cannot be recalled.

What stays on your device

My World memories, photos, posting drafts and recorded footprints are stored locally unless you choose to sync or share. Footprints recording starts only when you tap Record and grant location permission. In the iOS app it can continue while the screen is locked or another app is open, with the system location indicator; Pause or Finish stops it. Browser recording pauses when hidden. Force-quitting, revoked permission, or unavailable GPS can leave gaps. Native route points are stored in account-separated, device-protected files excluded from backup, then saved to your private device journal. Automatic account backup uploads are paused, including for older clients when they reach the updated service. Existing account backup objects are retained separately and removed through account deletion; signing in does not restore or upload journals/photos automatically. My Day’s bulk review saves completed manual activities and already-reviewed motion estimates privately to Footprints without starting motion or location collection. It keeps their original dates and existing saved edits; no GPS route or observed visit is invented for an activity without location. The saved journal copy enters a later manual device backup, while the original My Day and motion records remain separate and are not included. Deleting the saved Footprint does not erase the original activity or make a bulk retry restore that deleted copy. A manual Settings device backup includes saved route points, original points behind reversible view edits, journal drafts and inline day photos. Native media files require separate export. Keep exported files private. Trim and hide are reversible view edits: originals remain private on the device; deleting a recording removes it locally. You can revoke location access in device settings. Opening a new post does not request current location automatically. Use “Use where I am” to add current location details. The private Me map starts a location watch only for an explicit Locate action or an enabled Travel mode; it stops that map watch outside Me or when the app is hidden. Travel mode and recording are separate controls.

Shared trip planning

Creating a shared trip ARC stores its itinerary, selected places, nights, dates, interests and per-person planning budget on our service. Members can read the itinerary; owners and editors can change it. Shared changes are separate from private device drafts and booking confirmations. Owners or moderators can invite accepted friends or issue a code. Codes are valid for seven days. Anyone who redeems a valid code can join as an editor while capacity and eligibility allow; turning codes off prevents later code use, but does not remove people who already joined. Review who has access before adding details. Budget estimates do not confirm fares, reservations or payments.

Private trip drafts

Explore stores trip drafts in the current account’s private database on this device: the route, dates, traveler count, optional notes and your planning checklist. Up to 20 drafts can be saved, without automatic replacement of older drafts. They are not uploaded or synced. Saved private trip drafts are included in a manual Settings device backup export; unsaved form edits and native booking/media files are not included. You can edit or delete a saved draft in Explore. Deleting a draft does not cancel a reservation. “Copy flight search details” copies only the starting place, destination, trip type, travel dates and traveler count to your device clipboard; private notes and checklist choices are excluded. Partner links do not automatically receive those trip fields. You choose what to enter on the provider’s website, where its own terms and privacy practices apply.

What reaches our services

Sign-in uses your email address and security tokens. Optional sync sends selected places and text memories. Profile edits, friend requests, blocks, ARC membership, shared content and abuse reports are stored on the server. Public posting uploads only the photos and ARC highlight you select; photo metadata is stripped. Public video uploads are currently disabled.

Cloudflare hosts the staging API, database and uploaded media. Resend delivers sign-in emails. Online map and public-feed providers receive network information when the app requests their content. Data may be processed outside Canada. The app does not automatically upload your entire photo library.

Shared memories

Collaborating creates a separate private thread with its title, any date or place you choose to include, accepted participants and the words or photos they contribute. Your private My World is not copied into the thread. Sharing a designated location is off by default. A memory owner can deliberately select a place and separately confirm sharing its exact map coordinates. The selected point and place label are stored with the memory and available to its accepted participants, including people who accept an invitation later. They are not published to public Explore, public feeds or invitation previews. The app does not infer this point from photo metadata or automatically share GPS or private journal locations.

The owner can replace or clear the designated location. Clearing removes the shared point while keeping the shared place name. The point otherwise follows the memory’s retention and deletion: leaving, blocking or losing access removes your access, without erasing the owner’s shared point; deleting the memory or the owner’s account starts its removal under the cleanup and backup limits below. Copies saved by others cannot be recalled. A participant’s date filters or private-place settings can hide the pin on their own map without removing the shared location from the service or other participants’ access.

When there is no designated shared point, a shared place name can appear on accepted participants’ private maps. Towns are matched with the offline directory; looking up an unlisted place online requires a separate search and selection. A separate map place you choose privately is saved only for this account on this device. This local choice does not update the designated shared location or other participants’ maps, and does not recover photo GPS. Use “Remove my chosen map place” to delete that local choice. These private map choices are not included in the manual device backup. Settings → Privacy & safety → Saved shared-memory map places also offers “Clear saved shared-memory map places”, including choices for unavailable threads and unreadable preferences. This removes only this account’s saved map choices on this device; shared locations, shared memories, photos, your journal and server content are unchanged. Already-shared town names may still have approximate pins. Leaving, blocking or losing access clears the displayed pin and preview; a missing or unavailable thread does not silently erase your stored local choice.

Shared-memory map photos are small temporary previews derived from authenticated shared-photo responses. They use the thread’s existing audience and access checks, rather than public image links. Temporary image URLs are released when the map is redrawn, hidden, invalidated or the account changes. A preview is not a new public upload or a separately saved offline photo.

Leaving takes your contributions with you by default. If you explicitly choose to leave them, accepted participants can still see them while you lose access to the thread. The owner may remove contributions; account deletion removes your contributions. Contact us about access or removal after leaving. Copies already saved by others cannot be recalled.

Rovo chat and local recommendations

Rovo AI chat is paused in the launch candidate. The normal app does not open Rovo chat or automatically send chat messages to an AI provider. Local activity and planning tools are separate from AI chat. Pausing chat does not erase records from earlier use: earlier messages, if sent, went through our service to Cloudflare Workers AI. Cloudflare describes its content-handling commitments and exceptions in its data usage documentation. Prior service or provider records remain subject to their applicable retention and deletion rules.

Optional booking-file AI reading

Booking-file reading is separate from paused Rovo chat. It requires a separate unchecked permission for each selected file before the file is prepared or sent to Cloudflare Workers AI to extract flight details. A selected PDF reaches AI text conversion before an attempt to remove labeled sensitive lines for a later model step; that removal is not guaranteed. Images can include every visible detail. Crop or redact names, booking references, ticket numbers and payment details before choosing a file. Review the extracted output before creating or changing an ARC or trip. Importing a file does not buy a ticket or issue a booking. Accepted trip data and account rate-limit records have separate lifetimes; provider conversion, model, log and backup retention still requires verification. No zero-retention or guaranteed-redaction promise is made.

Explore can order posts using interests you select and topics inferred from your own posts. The Latest option orders posts by recency. Review and change your interests in Explore; changing a preference and deleting the posts it was based on are different actions.

Maps, place search, routes and weather

On supported iOS builds, the visible main map uses Apple Maps online as its primary basemap where available. Viewed regions can load automatically when the map opens or moves. Apple can receive the viewed map area and network information even when live GPS is off. The primary map bridge carries viewport and camera geometry with temporary control state, not photo bytes, notes or private journal identifiers. Photos, saved pins and route overlays keep their existing account and sharing controls. Opening this basemap does not start a new location watch, recording or public sharing.

The app’s browser map and safely selected web or offline fallback use OpenFreeMap, which receives requested map areas and network information. Automatic web basemap startup is deferred while the native basemap prepares or runs; web fallback follows a confirmed native handoff. Explicit offline-map downloads are a separate control. Place search uses our gateway and the Photon service at Komoot; search text and any location used to focus the search are sent for that lookup. Road-route requests send the selected stops to our gateway and a Valhalla routing service; the configured default is the public FOSSGIS service. These providers do not receive your private journal merely because you use a map or search.

Separately, choosing the optional 3D globe on supported iOS versions opens Apple Maps online. Apple receives requests for the map areas you view even when live GPS is off. The viewer shows selected saved pins privately; opening it does not start a new location watch, route recording or publication. Apple Maps service processing and retention are separate from your local journal and are described in Apple’s Maps privacy information.

Automatic weather lookup is disabled in the current app. If we enable an online weather feature later, it will require a location-sharing choice and an updated notice describing the provider and data sent. Provider request logs can have different retention periods from your account or device data.

Cookies, device storage and partner links

Web sign-in can use the secure, HTTP-only rb_community_login cookie for up to 10 minutes and rb_community_session for up to 30 days. Native sign-in also uses device authentication storage. Local preferences, drafts and cached map tiles use browser or native storage. Clearing cookies does not by itself delete native files, server records, downloaded maps or exported backups.

Rove Tools marks partner links and explains commissions. Opening one takes you to an external website or browser flow with that provider’s privacy and storage practices. Referral and campaign identifiers may be included in the link. ROVEBOUND website planners are a separate surface with their own account and data flows.

Information about other people

Content, invitations and reports can include information about people who do not have a ROVEBOUND account. Respect other people’s privacy and rights when sharing. You can contact contact@rovebound.ca about information concerning you without creating an account. Do not send unnecessary identity documents or copies of illegal imagery.

Notice and Community rules records

When you explicitly acknowledge a privacy notice or agree to Community rules, we record your account identifier, the document version identifier and checksum, the time, and the submission channel to manage changes and record your choice. Privacy-notice acknowledgement and agreement to Community rules are separate choices. Optional location, AI-file and backup permissions remain separate. New app publishing and sharing require agreement to the current Community rules; private recovery, reporting, blocking and account deletion remain available.

Your birthday

When you sign in we ask for your birthday, once. It is used only to confirm you are old enough to use Rovebound (16 or older) and to keep the app appropriate for your age. It is stored with your account, is not shown to other members and cannot be edited in the app. If you are under 16 we disable account access and start deletion without saving your birthday. Cleanup can remain queued while storage is unavailable; the retention and deletion limits below still apply. Account deletion queues its removal from active account storage. Limited authentication/security records and provider logs or backups may remain under their applicable retention rules. Email contact@rovebound.ca to request a birthday correction; a correction request is not confirmation that a change has been completed.

Places you’ve been

This is off until you turn it on in Settings. When on, your iPhone notes where you stayed (arrival and departure) and Rovebound keeps those notes, with the place name Apple’s maps service returns, only on your phone. The detected timeline is separated by the selected device account. Older unassigned device timelines are retained separately and are not automatically assigned to a signed-in account. Detected visits are not uploaded, included in Settings backups or used for ads. Choose Save to Footprints to add a visit to the private journal/map; that saved copy is included in manual journal backups. Turning off the timeline removes its detected notes; it does not erase Footprints already saved or files already exported. You can hide a visit or mark a private place to exclude. Storage failures are shown and retried when Settings is reopened; a full timeline stops collecting rather than silently replacing older visits.

Sharing choices

Public posts and public profiles may be viewed, saved or copied by other people. Discovery by username is optional. Being friends does not automatically disclose private locations, bookings or device memories. Friend-item map pins are unavailable in this launch candidate. Friend-item sharing sends the title, note and small summary, without map coordinates; the separately confirmed shared-memory location described above is a different sharing choice. Place names you include in those fields are visible to the selected recipients. Older shared map coordinates are hidden; your private originals are unchanged. Reviewers can inspect content submitted for publication. Reports include the reason and details you provide and are available to authorized moderators.

Nearby Whispers and Tales — controlled pilot

This optional text-only pilot is enabled separately for each service. The app checks availability without requesting location; paused discovery does not prevent your own-record, withdrawal and safety requests. The app’s minimum age remains 16; public nearby stories require an active account with a declared age of at least 18. Automatic nearby discovery starts only after you separately choose it. While the app is in the foreground, it obtains repeated fresh location fixes and sends latitude, longitude, reported accuracy and observation time to our API in the request body, normally no more often than every 30 seconds. Checks pause while the app is hidden and resume for the same signed-in account when you return, after a fresh availability and eligibility check. Use the visible Stop control to turn them off. The choice is kept only in the current account session, not as a global device preference. Permission or accuracy failures pause discovery rather than repeatedly prompting. There is no Tales background geofence or push alert. The same fresh fix may be used to read or add to a story for up to two minutes. The server checks a conservative 300-metre boundary including reported accuracy; a location claim is not verified physical presence. Reader fixes are not written to Tales tables, but infrastructure request-log and backup handling still needs verification.

You can write a note before requesting location. Posting requires separate sharing and location choices, then a fresh foreground fix at Submit. The current app uses that fix as the stored story anchor, without requiring an exact-point picker or inferring a location from your private journal or photos. The service stores the anchor, place label, title and text. When you explicitly choose immediate publication in the updated app, text that passes a bounded automated posting filter is published immediately to eligible nearby readers; a human does not preapprove every new note or reply. Older clients that ask to submit for human review retain pending review instead. The filter handles selected abusive phrases, links, contact and credential patterns; it cannot identify all harmful content or private information. Reported content can be reviewed and hidden by authorized reviewers, and older pending submissions retain their review status. A reviewer’s own account cannot manually approve its own submission. Stories are for nearby strangers, not private messages. Ordinary readers see “Contributor”, without the stored anchor coordinates or another author’s account identifier; authorized reviewers can inspect the anchor and link entries to accounts. Typed text and place labels can still reveal private information. Tales uses no photo, audio, video or AI processing. Tales-only reviewer grants store an account identifier and grant time until revocation or account cleanup; they do not change a global moderator role.

Your contributions and withdrawal controls do not require a nearby location check. Withdrawing a story you started clears its anchor, title, place and all its entry text; withdrawing a contribution clears your entry text. Minimal status, retry, review and report records can remain without automatic timed expiry. Account cleanup removes your Tales contributions, stories you started and reviewer grant from active storage under the deletion limits below. Private device backups do not include Tales. Contact contact@rovebound.ca to request access, a copy, correction or removal of your records; there is no complete automatic Tales export in the app. Reporting and blocking remain separate from discovery; blocking applies across your account, including Friends. Current cached discovery results are cleared after your successful block, withdrawal or review decision. Changes made by other people are checked on later reads and polls; copies already read cannot be recalled. Actual timely safety-response coverage, infrastructure retention and device acceptance remain operational requirements, not guarantees made by this notice.

ARC moderation

ARC owners can appoint moderators. Kicks, bans, role changes and report decisions record the actor, affected account, reason and time. Owners and moderators can see decisions in their ARC; only authorized ROVEBOUND staff can review history across ARCs. Reports and decisions are not public reputation scores or automatic proof of misconduct. Safety records may remain after an ARC is closed, until the affected account requests deletion. Contact contact@rovebound.ca to challenge a decision. A ban applies to that ARC and does not automatically ban someone from all of ROVEBOUND.

Upload cleanup

Photo-upload records keep account and memory identifiers, an object key, timestamps and cleanup status while processing or removal is unfinished. They contain no photo content or email address. An unsettled upload keeps account deletion queued until it can be safely reconciled; we do not mark that deletion complete just because account access has stopped.

Retention and deletion

Account data stays until you delete it or request account deletion. Settings → Privacy & safety → Delete account starts deletion inside the installed app. The staging web deletion page also works without installing the app. Authentication confirms the account you control.

Deletion disables account access immediately. Cleanup removes account identifiers, uploaded media and personal content from active storage; if cleanup cannot finish, the deletion stays queued for retry. Cleanup also removes owned ARCs and sections you last edited. Random record identifiers and a deletion timestamp remain to preserve references in shared records. Infrastructure backup/log expiry is not yet verified for release; deletion from active storage does not imply immediate erasure of provider backups.

Device-only files and backups you exported are separate; remove those from your device and backup destinations. Exported backups are not encrypted by this app. Copies saved by other people cannot be recalled. Deleting an account does not cancel store subscriptions.

Contact and choices

For access, correction, privacy concerns, abuse reports or deletion help, email contact@rovebound.ca. Do not email passwords, sign-in codes or sensitive identity documents. You can withdraw optional sharing by unpublishing content, disabling profile discovery, stopping recording or deleting your account.

Public brand: ROVEBOUND. Legal operator: Karl Manzo, operating as ROVEBOUND. Use contact@rovebound.ca for privacy, deletion and abuse requests.

Messages sent to contact@rovebound.ca pass through Cloudflare Email Routing to an inbox hosted by Google. If the contact address is unavailable, email rovebound@gmail.com.