Sayroam Android Privacy Policy

Notice revision: android-2026-10-19.2 · Updated 19 October 2026

Sayroam is operated by Martin Schmidt, trading as MansaMusaInvst., a Swiss sole proprietorship, UID CHE-370.926.542, Speerweg 20, 8618 Oetwil am See, Switzerland. Contact gravies.11.ribbons@icloud.com for privacy, support, account deletion and safety concerns.

Sayroam lets adults meet through recorded voice messages and emoji profiles. Account opening and a first approximately 25 km-radius area are free. The Android app does not offer an identity check, collect an identity document or selfie for verification. Decorative Gold on an otherwise visible @username does not verify identity, age, safety or trust.

Where and when this applies

This notice covers the Android app, the Sayroam service it uses and related support. Public availability follows selected store territories and available service regions. The initial release excludes the EEA, United Kingdom, mainland China, Türkiye, Indonesia and Australia. Availability does not remove existing privacy rights or replace applicable regional requirements. Google sign-in and Google Play purchases are offered only after their actual configuration and testing are complete; a preview or unavailable button does not activate them. Apple sign-in is not offered by the Android app.

Information used to run the app

Who can hear or see content

Private voices are accessible to the participants while the account/contact rules permit. One initial voice request can remain pending between a pair; explicit acceptance makes the connection. The normal API hides a username before an accepted eligible connection and during blocks/restrictions. Gold does not remove that protection. A previously shared display name can remain in connection history.

Your profile voice thread starts connections-only. If you choose Public, eligible signed-in members may hear its published posts. Only eligible accepted connections may add the supplied emoji reactions. Private conversations are not copied into the profile thread. Community voices are shared with eligible members in the relevant area.

New private voices, personal profile voices and supported personal profile edits do not wait for individual human preapproval; structural/audio/account checks do not judge their meaning. Community opening voices and replies still wait for human review. Reports, blocks, removal and account restrictions remain available. The operator personally handles moderation, support and appeals. Voices are not sent to an AI moderation service in this release.

Storage, security and other recipients

Railway hosts the API and stored app data. The joinsayroam.com website and its policy pages are delivered through OpenAI Sites and Cloudflare infrastructure. The current hosting is in the United States. Voice messages and profiles are readable on the hosting service for delivery and authorised investigation; they are not end-to-end encrypted and are not stored in Apple CloudKit. The app uses HTTPS for the fixed Sayroam service, rejects redirects for API requests and does not intentionally log request bodies, passwords, location payloads or purchase tokens. Infrastructure, provider and email processing have their own records.

On the device, the sign-in session is encrypted with an Android Keystore key and kept in private app storage. Bookmarked message IDs, colour/recorder preferences and pending-purchase markers are account-scoped local preferences. Purchase-recovery markers can include an attempt ID/time and purchase-token digest, not a stored raw purchase token. Bookmarks do not copy the source recording or override a block, source removal or loss of access. Temporary recorded/downloaded audio uses private cache and is removed on discard, page changes, backgrounding, sign-out or later cleanup, as applicable. Android app backup is disabled in the app manifest. Google's diagnostic transport can queue technical events in the app's private SQLite storage and retry later. Ordinary Sayroam sign-out/account deletion does not specifically erase this separate SDK queue, and deleting the app account cannot erase telemetry Google already received. Android's app-data clearing or app removal manages remaining on-device app storage; Google's independent records follow its own controls. No device or service can guarantee erasure of a copy someone else already made.

Map detail and its providers

Android build 1.0 (1) contains a packaged offline Natural Earth atlas. The detailed map introduced in Android build 1.0 (2) uses MapLibre Native to load styles, map tiles, fonts and symbols from OpenFreeMap, operated by Hyperknot Software Kft. in Hungary. Viewing, moving or zooming this map sends your connection IP, an app-identifying request header and requests for the viewed area and zoom to the map provider or its delivery infrastructure. A viewed place is not necessarily your physical location. However, centring on your current location or an actual chosen area can reveal that area through the requested tiles. The map does not automatically read device location or send raw GPS readings, Sayroam login details, email, username, voice recordings, connection lists or your local circle overlays to OpenFreeMap. If you use the location control, the app explains its use before asking you to continue and requesting Android permission.

OpenFreeMap says its ordinary access logs omit IP addresses; error logs may include IP and requested URLs for seven days, and security-incident IP logs may remain for up to 30 days. It may use Cloudflare delivery. See OpenFreeMap's privacy policy and Cloudflare's privacy policy. Their independent records are not erased by deleting a Sayroam account. Online map detail needs internet access. MapLibre keeps a local map-resource cache which can remain after ordinary sign-out or account deletion; Android's app-data clearing or app removal manages remaining app storage. This app has no offline-area download feature, map action journal or background location tracking.

Google sign-in, payments and technical records

Policy/support links open your browser, whose own practices apply. The app includes Google Play Billing, Android Credential Manager and Google's identity library. Google's libraries can process operational sign-in and billing events and technical diagnostics. The Billing library is initialised when the main Android activity is created, before Sayroam sign-in; these SDK diagnostics do not have a separate in-app opt-out. Optional purchasing does not make every SDK event optional. Billing event information can include success/error results, operation and exception information, timing, the app/package/library version and a random billing-client session identifier. Its Google data transport can add Android version/model/manufacturer and software-build information, network type, locale/country, timezone and SIM-operator codes. These are technical records, not a claim that a unique hardware identifier, advertising ID, GPS, contacts, phone number or voice content is collected by that diagnostic transport. Google necessarily receives the network connection IP. We use these functions to operate sign-in/payments; SDK reliability and performance measurement is also analytics. Exact transmission timing and Google's independent retention are controlled by its services. Google handles Google account, identity and Play payment processes under its own terms and privacy notice. Sayroam has no advertising feature or advertising SDK. The included Google libraries still process operational diagnostics and measurements as described here.

We disclose content to the people permitted by your selected audience and connection actions, and to hosting/support providers as needed for the service. We may disclose proportionate records for a lawful request, safety response, dispute or legal obligation. We do not sell personal data or use these records for behavioural advertising.

Retention and deletion

• Account details, area access, connections, profile content and preferences normally remain while the account/content exists. Server sessions expire after 24 hours; at most ten sessions are retained per account.
• Android Google sign-in challenges expire after five minutes, encrypted unfinished username-onboarding grants after ten minutes, and ID-token replay digests after 24 hours. Expired rows are cleaned on later sign-in activity. The Android basic sign-in path stores no Google API refresh/access grant to revoke. Existing credentials obtained on another client retain that client's separate deletion/revocation handling.
• Private/community voices have no automatic recording-age expiry. Rejection hides a recording rather than immediately erasing its file. Successful account deletion removes linked records and queues affected server audio for erasure.
• You can delete your own profile voice posts individually. They become unavailable and their media is queued for erasure; limited author/retry/report records remain until the relevant account deletion. There is no individual direct-message or community-thread deletion control in this release.
• Android purchase tokens are encrypted while needed for verification/recovery. Account deletion erases the local decryptable token and account link, retaining minimal product/state/time, irreversible token digest and pseudonymous binding records against replay. These tombstones have no implemented age-based purge and are not claimed to be anonymous. Definitively rejected, never-confirmed purchase claims retain only an account/product-scoped token digest and time until account deletion, without a recoverable token. The server polls Google's authenticated revocation history and retains irreversible revoked-token digests to prevent replay, including tokens first seen in that history. Encrypted pagination/checkpoint and bounded request-time records support complete recovery without storing raw revocation tokens. Revoked-token tombstones have no implemented age-based purge. If current payment/revocation status cannot be confirmed, Google paid benefits can be temporarily unavailable while recovery is checked. Optional authenticated notification-event digests, if that transport is later configured, are pruned after 30 days when the receiver runs; pending retries require completion or operator handling. Google's independent payment history is separate.
• Closed support correspondence is deleted within 90 days and downloaded moderation/review files within 24 hours under the owner's adopted procedure. Specific legal/dispute holds are reviewed every 30 days. Service data/backups and independently retained infrastructure/provider copies are subject to the relevant provider's controls and the current published core retention notice; no unverified fixed backup-erasure deadline is promised.

Use Account → Delete account to request permanent deletion. After successful deletion, the app clears its own saved session, preferences, purchase-recovery markers and cached audio for that account. Google SDK diagnostic queues are separate, as explained above. Without the app, email gravies.11.ribbons@icloud.com with “Sayroam account deletion”; include the username if known. Do not send a password, recovery code, identity document, selfie, recording or payment-card information. We may need a proportionate secure ownership check, never a request to reveal your password or recovery code by email. Deletion can fail when the service cannot be reached or required media cleanup cannot safely be staged; do not treat an error as successful deletion. Limited safety/legal records and copies already made by another recipient may remain. Deleting an account does not automatically request a refund or transfer paid benefits to a new account.

Your choices and privacy requests

You can decline microphone/location permission, select the first area manually, change the profile audience, block/report, delete your own profile posts, remove your profile or delete the account. Declining a permission limits the feature that needs it; free account opening does not require an identity check. Android settings let you revoke microphone and location permissions.

Contact the operator to request access, correction, deletion or other applicable privacy rights, or to raise a complaint. We assess requests according to the relevant circumstances and law. You may contact your competent data-protection authority; in Switzerland this is the Federal Data Protection and Information Commissioner. Sayroam is intended for adults aged 18 and over; report suspected underage use. No username, voice, payment or provider login proves a person's age.

We will update this notice when our Android data practices change.