Privacy

• Last updated October 9th, 2026.
• In short
  • Roam Publish (roam.pub and the Roam Publish extension) is run by one person, @ejqs, from the Philippines. It isn't affiliated with Roam Research.
  • You choose what's published and who can read it. The extension sends nothing until you publish.
  • No ads, no tracking cookies, and nothing is sold.
  • Deleting something deletes it, for good.
  • Questions, or to ask about your data: [email protected] or ejqs [at] ejqs [dot] net.
• What's public
  • Each page is as public as you set it: anywhere from listed on Discover to readable only by members or people with its password.
  • Published pages include their block references and embeds, which can come from elsewhere in your graph. Check them before publishing.
  • Your username, profile bio and graph names are public when you choose to show them.
  • Feed readers can copy pages from RSS feeds you turn on, and a copy may outlive the page.
• What's collected
  • Your account: email address, name and a hashed password. Login sessions record the IP address and browser they came from.
  • Your graphs: their names, and the time zone the extension sends.
  • What you publish: the page or block text and structure the extension sends, its title, tags, byline and settings.
  • Your API keys, hashed. If you turn on the change log, your Roam append-only token, encrypted, and only ever sent to Roam.
  • Views and upvotes by signed-in people who have a graph, one per page, to count views and rank Discover. Anonymous visits aren't recorded this way.
  • Invites: the invited person's email address and who sent it.
  • Reports: what you write, an email address if you give one (or your account's, when signed in), and a one-way hash of your IP address to catch repeat reports.
  • IP addresses, briefly and only in memory, to rate-limit requests. They aren't written to the database.
  • Error and slow-request logs, without IP addresses or emails. Railway, the host, keeps its own request logs, which include IP addresses, for a limited time.
  • Cookies, all needed for the site to work, none for advertising or tracking:
    • Your login session.
    • Each password-protected page you unlock.
    • An announcement you dismissed.
    • When you last opened What's new.
  • Your browser also notes each page you've viewed while signed in, so a view is only counted once.
  • When you unlock encrypted pages, your browser keeps the password's key in its own storage for 30 days so it can decrypt them. It never leaves your browser.
• Analytics
  • The website uses Umami (Umami Cloud) for aggregate statistics: page views, referrers, browsers, devices, countries and page load speed (Core Web Vitals). It sets no cookies and doesn't track you across sites.
  • Published pages can show their view count and readers' countries, from these numbers plus signed-in readers. Countries with fewer than 3 views are grouped together. Page owners can hide view counts or turn them off.
  • The Roam extension has no analytics.
• The Roam extension
  • It sends a page or block to roam.pub only when you publish, unpublish or check it.
  • While Roam is open, about every 5 minutes, it tells roam.pub which of its status link blocks still exist (block ids only, no text). Turning off the Roam Publish block stops this.
  • It only writes the Roam Publish block into your graph, plus change log entries if you kept an append-only token.
• Why it's used
  • Your account and what you publish: to provide the service you signed up for.
  • IP addresses, reports, the moderation log and the blocklist: to keep the service safe and working, and to stop abuse.
  • Aggregate analytics: to see how the site is used and show page view counts.
  • Account emails: sent only when needed to run your account. There's no marketing email.
• Who else handles it
  • Railway hosts the website and its database, on servers in Singapore.
  • Resend sends account emails (verification, password reset, invites, moderation notices). Emails you send to roam.pub, such as a reply to one of those, are kept by Resend and read by roam.pub's admins, who may write back.
  • Umami runs the analytics above.
  • Roam Research receives the blocks roam.pub appends to your graph with your token.
  • Images, videos and embeds on published pages, such as YouTube (in its privacy-enhanced mode), Vimeo, Loom, or wherever an author's images are stored, load straight from those sites. They see your IP address and browser, under their own privacy policies.
  • Resend and Umami may handle data in other countries, including the United States.
  • Beyond these, data is only handed over when the law requires it, such as a valid court order. Where the law allows, you'll be told first.
• How long it's kept
  • Your account, graphs and pages: until you delete them. Unpublishing a page deletes it. Deleting a graph deletes its pages, including members' pages, and its API keys. Deleting your account (Settings) deletes your graphs, pages, collections, API keys and profile, and what you published into other people's graphs.
  • Login sessions: until you sign out or delete your account.
  • Invites: 7 days. The codes that prove you own a graph are stored hashed and expire too.
  • Rate-limit IP addresses: 15 minutes at most.
  • Cookies: 30 days for unlocked pages and dismissed announcements, about a year for What's new.
  • Reports, and a short log of moderation actions and account deletions: no fixed end date, to deal with repeated abuse. When you delete your account, the email address on reports you filed is replaced with a hash.
  • If a moderator had acted on your account, your graph names, usernames and a one-way hash of your email are kept after deletion, so it can't simply be re-created.
  • There are no backups, so deleted data can't be recovered.
• Security
  • Everything is sent over HTTPS.
  • Account passwords, page passwords and API keys are stored hashed, and append-only tokens encrypted.
  • The operator can access what's stored, and only uses it to run, support and moderate the service. The exception is encrypted pages, whose text and title are stored encrypted with their passwords (pages encrypted before titles were keep a readable title until they're next published). Readers' browsers decrypt them, so the server doesn't read them to show them. Pages published from extension 0.2.0 or newer are encrypted in Roam, so the server never sees their text; older ones, and pages encrypted on the website, were encrypted by the server, which saw their text then. See Encrypted pages.
  • If a data breach affects your information, you'll be told, and so will the National Privacy Commission, as the law requires.
• Your rights
  • The Philippine Data Privacy Act of 2012 applies, along with the privacy laws where you live.
  • Under them (for example, the GDPR in the EU and UK), you have the right to know how your data is used, get a copy, correct it, object to how it's used, and have it deleted.
  • You can see, change or delete everything you publish from the dashboard, and delete your account at any time.
  • For a copy of your data, or anything else, email [email protected] or ejqs [at] ejqs [dot] net.
  • You can also complain to a data protection authority: the Philippines' National Privacy Commission, or the one where you live.
• Children
  • Roam Publish isn't meant for children under 13. An account found to belong to one is deleted.
• Changes
  • When this policy changes, the date above changes and signed-in users see a notice on the site for two weeks. If a change matters, signed-up users are also told by email.
  • Every past version is in the full change history.