Your family's data, reachable only by your family
That is Roamkeep's whole premise. This is how it holds, how to tell us if it doesn't, and how to check the app you installed.
How it's protected
- A database per family. Each family's locations live in its own Supabase project. Nothing is shared between families, and nothing passes through us.
- Row-level security. The database itself decides who can read and write each row, so a modified app gets no further than the real one. The key inside a setup link is public by design; the security rules are the boundary.
- Rules the server enforces. Owner approval of new members, what children can and can't do, and who may change sign-ups are checked by the database, not by the app.
- Notifications without content. The relay that wakes phones sends an empty message and keeps no record of it.
- Encrypted in transit. Every connection between the app and your database uses HTTPS.
- Open to inspection. The source is public. The app is minified to make it smaller, not to hide anything.
Report a vulnerability
Please don't open a public issue. Use GitHub's private vulnerability reporting, or email security@roamkeep.app. Tell us what an attacker could do, how to reproduce it, and which version you tested. Never include another person's real location data.
| Acknowledgement | within 3 working days |
|---|---|
| First assessment | within 10 working days |
| Disclosure | coordinated with you, by default within 90 days |
Roamkeep is made by one person, so these are honest targets rather than a commercial promise. If one slips, you will hear from us before it does. The full policy is in SECURITY.md.
What has been reviewed
The code and database were reviewed in September 2026, and the main findings were fixed in Roamkeep 4.9.0. They were reviewed again in October 2026, using a different AI model, and those findings were fixed in Roamkeep 4.11.1. The developer carried out both reviews with AI tools, so neither is independent.
No independent audit of the app or the database has been done yet. Paying for one is among the things donations are for, and when one is done, its report will be published here in full.
Check the app you installed
The app on Google Play is built from the public source. From Roamkeep 4.11.0, each
release on GitHub lists the SHA-256
of the app's main script, app.js, which is identical in every copy. To compare
yours, with a computer and adb:
- Find the app:
adb shell pm path com.roamkeep.app - Copy it off the phone:
adb pull <the path it printed> roamkeep.apk - Take the script out of it: it is
assets/public/app.jsinside the APK, which is a zip file. - Hash it (
sha256sum app.js, orGet-FileHash app.json Windows) and compare with the release.
Google re-signs apps it distributes, so the APK's own signature differs from a build you make yourself. The script inside it does not.