PinRoam

PinRoam privacy policy

Last updated August 11, 2026

PinRoam is a trip planner for iPhone, iPad and Mac published by Robinvanholst BV, with its first-party sharing service at pinroam.app. The app contains no third-party tracking or analytics SDK and personal data is not sold. Its core features can be used without an account. A protected public trip page may require a verified visitor account.

Data processed

  • Trip data: names, countries, dates, accommodations, locations, notes and an optional calendar identifier.
  • Shared trips: a secret collaboration code, a separate public link identifier, the selected public-sharing state, shared trip content, participant names and a random technical participant identifier per app installation.
  • Public-trip visitors: a random cookie identifier, an optionally supplied name and email address, the visited trip, coarse device and browser labels, first and last visit, visit count, photo likes and an optional notification preference explicitly enabled by the visitor.
  • Visitor account and access: email address, optional name, a technical account identifier, a temporary sign-in request, an optional Sign in with Apple link and access requests or approvals for protected trips.
  • Location: your current precise location, only after permission, for routes and nearby places.
  • Calendar: future multi-day events containing an address, only when you open Calendar import.
  • Contacts on Mac: the postal address from your own contact card, only when you choose to import it.
  • Attachments: photos and documents you select for a spot.
  • Device code: a random technical identifier per app installation used to record which shared attachments have been received.
  • Preferences: including map and POI settings.

Local storage

Trips, spots, attachments and preferences remain on your device by default. Local data remains until you delete it in the app or remove the app data. Photos are compressed as JPEG with a maximum long edge of 2560 pixels before storage and exchange.

Sharing a trip

Sharing is optional. When you share a trip, PinRoam stores the share code, shared trip content, participant names and a random technical participant identifier over a secure HTTPS connection in Robinvanholst BV's own server environment in the Netherlands and European Union. Anyone with the share code can open and modify the shared trip, so treat it as an invitation key.

If you explicitly enable public sharing, the service creates a separate public identifier that cannot be derived from the secret collaboration code. Visitors can view participant names, the trip name, schedule, spots, notes and photos you selected for publication. Photos from a linked photo album are published only when you enable that separate setting. Documents, the secret collaboration code, technical participant identifiers and Calendar identifiers are not shown. Disabling the public page makes the link unavailable and removes its durable public photo copies.

A visitor can provide a name and email address on the public page. PinRoam remembers the browser through a secure cookie containing only a random identifier; the name and email address remain on the server. For each trip, PinRoam stores a summary containing the first and last visit, visit count and coarse device and browser information. Only like counts are shown publicly; the associated name and email address are not shown to other visitors.

For a protected trip page, PinRoam can verify an email address with a one-time sign-in code that remains valid for ten minutes. The server stores only a hash of that code and a secure session cookie containing a random value. Alternatively, you can use Sign in with Apple; PinRoam then receives a technical Apple account identifier and, only when Apple supplies it, your name and email address. The trip owner can approve or deny access. An approval notification through Apple Push Notification service contains only technical identifiers and no name, email address or trip content.

Photos and documents attached to a shared trip are temporarily stored as transferred binary data in the sharing service database. The server removes the file contents as soon as all active devices confirm receipt and always within three days. Technical attachment metadata and receipt status may remain longer so a missed transfer can be retried later.

When a public-page visitor explicitly enables notifications, PinRoam stores a technical Web Push subscription for that trip. Notifications contain no trip data. If the browser does not support Web Push, the same button can instead explicitly enable a daily email digest. Around 9 p.m., PinRoam sends at most one email when new public photos have been added since subscription or the previous digest. The digest contains the trip name, number of new photos, a trip link and a direct unsubscribe link. Both subscriptions are deactivated when the visitor unsubscribes or the public link is disabled; Web Push also stops when the browser service rejects the subscription.

Shared trip data remains available to provide collaboration. You can request deletion of a shared trip or visitor account at privacy@robinvanholst.nl; privately include the share code or email from the address used for the account. Standard technical server logs may temporarily contain an IP address, timestamp and browser or app information for security, diagnostics and operations. These logs are not used for tracking or advertising.

Apple services

Map searches, directions and place information are processed by Apple MapKit. PinRoam does not persist your current location or send it to Robinvanholst BV's server. A private CloudKit record under your Apple ID can store only a trip ID and share code pair so your own Apple devices can rediscover shared trips. PinRoam can also use Apple Push Notification service and Sign in with Apple for features you choose. Apple processes this data under Apple's privacy terms.

Purpose and legal basis

Data is processed solely to provide the app features you choose: trip planning, routes, Calendar import, attachments, optional collaboration, public read-only sharing, visitor sign-in and access, visitor insights for the trip owner, photo likes and explicitly enabled trip updates. Consent is requested through Apple's system prompts or a clear action such as sharing a trip, signing in, requesting access or enabling the notification bell.

Service providers

Personal data is not sold. Data is provided only to Apple for selected system services and to the hosting provider operating the first-party sharing service. PinRoam contains no third-party tracking or analytics services. An optional advertisement on a public page is a regular external link and receives data only when you choose to open it.

Your choices and rights

You can withdraw permissions in your Apple device settings and delete local data in the app or the PinRoam cookie in your browser. Web Push and the daily email digest can be disabled through the same bell; every digest also contains a direct unsubscribe link. Contact privacy@robinvanholst.nl for access, correction, restriction or deletion of data on the sharing service. The share code or email address of a visitor account may be needed to locate the relevant data.

Controller and contact

Robinvanholst BV, Haringvliet 80, 3011 TG Rotterdam, the Netherlands, controls PinRoam and its first-party sharing service. Email privacy@robinvanholst.nl for privacy questions or use the PinRoam support page.

Changes

This policy may be updated when the app, services or legal requirements change. The latest version is always available on this page.