Privacy, in plain English.

Who is responsible?

Roam Free is operated by Connor Hughes. Email [email protected] with privacy questions or requests.

When you browse

The website runs on Hetzner infrastructure. Cloudflare provides domain and network services. These services process technical information such as IP addresses, browser information, requested URLs and request times to deliver pages, maintain reliability and protect against abuse.

We do not add advertising trackers, audience analytics or session replay. Sign-in uses necessary cookies to maintain your session and protect authentication. You can browse the directory without an account.

Accounts and host listings

We store your email address, a password hash, account role and security records to provide and protect your account. Verification and password-reset links are time-limited. Providing an email and password is necessary to create an account; there is no obligation to register to browse.

Host submissions contain the venue details you supply, proposed facilities and arrangements, and evidence of authority for an existing listing. Approved business details appear publicly. Account security data, claim evidence, moderation notes and private correspondence do not. We process these details to provide the service you request and, in our legitimate interests, maintain accurate listings and prevent misuse.

Maps and location

Map tiles and place search use OpenStreetMap services. Your browser requests map tiles directly, sharing technical information such as your IP address and the map area. A place-search query is sent to the geocoding service. Host postcodes are also geocoded to place venues on the map.

The near-me control asks for browser location permission. Coordinates are used in your browser to centre and filter results; we do not maintain a location-history database. A copied search link can include its selected location, so check it before sharing. You can decline permission and search by place instead. See the OpenStreetMap Foundation privacy policy.

Reports and venue outreach

We use listing reports and the information you provide to investigate inaccuracies. Our private outreach CRM stores public business contact details, source websites, research, correspondence, review decisions and opt-outs. Sources can include a venue’s own website and public business directories. We use this information in our legitimate interests to invite suitable hosts and keep participation accurate, subject to applicable contact rules.

Research and draft preparation may use automated assistance. An operator reviews outreach and host publication decisions; we do not make solely automated decisions with legal or similarly significant effects. An outreach invitation links a submission to its conversation, but does not prove ownership or publish a listing.

When you contact us

Your email address, name if supplied, and the information in your message are used to answer your enquiry and discuss possible venue participation. You choose what to send; please avoid sensitive personal information.

Our legitimate interests are responding to enquiries, arranging accurate venue information and protecting the service. Sending an enquiry does not subscribe you to a marketing mailing list. We do not sell personal information or make automated decisions about you.

Service providers and international processing

Hetzner hosts the application and database; Cloudflare supplies network services. Encrypted recovery copies are stored on a separate server managed by Connor; the decryption key is kept separately. Resend delivers account emails and handles configured outreach delivery and replies. Our mailbox provider handles direct correspondence. OpenRouter routes selected public business research to the configured AI model provider to assist outreach; we do not send account passwords or private claim evidence for that purpose. The website server is in Finland. Network and correspondence services may process information in other countries.

See the Hetzner privacy information and Cloudflare privacy information for their processing and transfer arrangements. See also Resend’s privacy information. Contact us for details of the providers and applicable transfer safeguards used for your information.

How long information is kept

We retain account and listing records while needed to provide your account and manage the venue. We retain correspondence and supporting review records while needed to answer enquiries, manage participation or investigate disputes. We review it when that purpose ends, taking account of unresolved issues or legal obligations. If you ask not to be contacted, we may retain the minimum suppression information needed to respect that request.

Encrypted daily database recovery copies are retained for 30 days. Removed information may remain in those restricted recovery copies until they expire. Our server’s operational logs are bounded and do not intentionally include email contents or contact form data. Provider delivery and security records follow their retention arrangements. We do not maintain a separate visitor analytics database.

Your choices and rights

You can ask to access or correct your information, request deletion or restriction, and object to processing based on legitimate interests. Depending on the circumstances, a right to data portability may also apply. You can object to direct marketing at any time. Contact the email address above; these rights are subject to applicable legal conditions.

You can also complain to the Information Commissioner’s Office, the UK data protection regulator.

When the service changes

We update this notice when the service or its data handling changes. The date above identifies the current version.