Frequently asked questions

No. Your family's locations go to your family's own database, and nothing we run ever receives them. The only service we operate for the app is a small relay that wakes phones with an empty message. It never sees names, places or locations, and it keeps no record of what it sends.

The source is public, so you don't have to take our word for any of this.

It is built so that it can't be used that way. Everyone in a family sees everyone else, so there are no one-way watchers. A notification is on screen whenever location is being recorded, and it comes back if it's swiped away. If an owner changes what someone can do, that person is told. Anyone can disconnect their phone at any time, and the family sees that they did.

Our terms forbid using Roamkeep to track anyone without their knowledge.

Not once its join code has stopped working. An invite link carries two things: your family's server address and a join code. The address never changes, but on its own it only gets someone to the front door. They can't see anyone, and they can't make an account unless your family has new accounts open.

The join code is what lets someone ask to join. It stops working after 72 hours, or as soon as an owner rotates it. New families also start with Approve new members on, so even a current code only lets someone ask, and an owner decides.

If an invite has gone somewhere it shouldn't, rotate the code from the invite. Declining or removing someone in the Family tab changes the code for you, so the invite they used stops working, and deletes the account they made.

Yes, unless you're an owner too. Your family's server sends no email, so someone who forgets their password gets back in with a one-time code from an owner, which works for 15 minutes.

Because that code reaches your account, your phone is sent a notification as soon as one is made for you and again when it's used, and the app shows it too. A code also stops working if, before it's used, you leave the family or become an owner, or whoever made it stops being an owner. If you didn't ask for a code, talk to your family's owners. Owners reset their own password through the Supabase account that holds the server.

On Android, the only way to wake a phone that's asleep is Firebase Cloud Messaging. What we send through it is empty: no names, no places, not even what kind of event happened. Your phone then reads what happened from your family's database and writes the notification itself.

Supabase is a company that runs databases. Your family's Roamkeep data lives in a project on your own Supabase account, on their free plan, in the region you choose. That is what keeps it out of our hands: you hold the keys, and you can export or delete it whenever you like. The Roamkeep app sets it all up for you in about five minutes.

No. Roamkeep is for Android only. Arrive and leave alerts mean the phone has to watch for places in the background, even with the app closed, and that takes a native app for each kind of phone. Everyone who shares their location needs an Android phone.

Both are good, and both need a server that someone keeps running around the clock. Roamkeep's database is run for you by Supabase, on your own account, and the app adds what a family needs: saved places with arrive and leave alerts, a week of history, SOS, and roles for children.

Running Roamkeep on your family's own server is free, with every feature, and always will be. There are no ads and no paid features. Supabase's free plan is enough for a family. Supabase pauses free projects that nobody uses for a week, and a family using Roamkeep every day keeps it awake.

Not on your own server. Running Roamkeep on your family's own server is free, with every feature, and always will be.

One day there may be an optional paid service for families who would rather not set up a server themselves. If there is, it will have no features the free version lacks, and it will be built so that we still can't see your family's locations.

Your family's database is yours, so your data stays where it is and the app keeps working with it. The one shared piece is the relay that sends wake-ups. If it ever stopped, alerts would appear when someone next opens the app instead of straight away. Keeping that relay running is the first thing donations pay for.

It is source-available. All of the code is public, and you can read it, build it and run it for your own family. It is released under the Business Source License, which is not an open-source licence, and each version becomes Apache 2.0, which is, on a date set in the licence. We say "source-available" rather than "open source" on purpose.

That's your choice. Auto records closely while you're moving and drops to low power when you're still. Live, Balanced and Saver trade detail for battery life, and you can change mode at any time.

Sometimes. Phone location is best-effort: phones lose signal, go flat and get throttled by Android. One known case: driving past a saved place without stopping can announce "arrived" and "left" in the same minute. A fix is designed. Until then, you can choose whose alerts you get for each place.

Roamkeep is not an emergency service. In an emergency, call your local emergency number.

A member marked as a child can't pause sharing, leave the Keep or delete their own account. They can always disconnect their phone, and the family sees that they did. They can also ask the owners to delete their account, and an owner does it.

Usually not. Your family's server refuses things it should refuse, and Postgres logs each refusal as an error. The ones you can expect:

• Errors with a plain name, like signups_closed, family_exists or not_owner. Roamkeep raises these on purpose: someone tried to make an account while new accounts were closed, or to do something their role doesn't allow.
• new row violates row-level security policy, a few at a time. A phone whose member was removed keeps trying until it notices, and then stops by itself.
• A rare 23505 duplicate key … checkins_pkey. A phone sent an arrival again after the answer to the first try was lost. Nothing is duplicated.

A 23505 on every arrival means a phone is on version 4.9.2 or older, and updating the app ends it. Anything else, or anything that keeps growing, is worth reporting. Leave out your project's address.

From the app, in Settings → Leave and delete my account. The account deletion page covers children, owners and deleting everything at once.

Roamkeep is designed and run by one person, David Carabetta, who made every product and privacy decision and tests it on real phones. Much of the code was written with an AI coding assistant, working under his direction and review.

It has been tested by 12 people over several months. The bugs those tests found, and why each fix is the way it is, are written up in the code itself.

Not independently yet. The security page says exactly what has been reviewed and by whom. An independent audit is one of the things donations pay for.