Privacy Policy
Who we are
Pixroam is an iOS app that sells prepaid travel eSIM data plans. It is operated by YIH-HSUAN WANG, an independent developer in Taiwan ("we", "us", "Pixroam").
This policy explains exactly what we collect, why we collect it, who we hand it to, and how to get it deleted. It covers the Pixroam iOS app and the ordering, payment and eSIM-delivery system behind it.
What we collect
Your email address. Sign in with Apple is the only way to sign in to Pixroam, so the address reaches us from Apple and never from a form in the app. If you choose "Hide My Email" at the Apple prompt, all we ever receive is Apple's private relay address ending in @privaterelay.appleid.com — we cannot see your real address, and we never ask you to supply it. A relayed address is treated exactly like any other: nothing in the app is withheld, restricted or degraded because you chose to hide your email.
Order records. For every purchase: the plan you bought, the price and currency, the time of the order, its status (pending, paid, issued, cancelled, refunded) and an order reference.
eSIM credentials. Once your eSIM is issued we store the technical details needed to install and support it: the ICCID, the SM-DP+ address, the activation code, the APN, and the installation QR code.
Usage and validity data. Data used, data remaining, and activation and expiry dates. Our eSIM supplier reports this back to us so the app can show it. We do not measure it ourselves.
Push notification token. If you allow notifications, we store the device token Apple issues for this app and the language the app is using, only so we can tell you when an eSIM is running low on data. We never use it for marketing. You can turn notifications off at any time in iOS Settings, and the token is deleted when you sign out on that device or delete your account.
App and purchase events. The app includes Meta's software development kit (SDK) so we can measure whether our ads on Facebook and Instagram lead to installs and purchases. Through it, the app tells Meta when it is installed and opened and, when you complete a purchase, the plan's identifier, the price and the currency, together with technical details such as your device model, iOS version and IP address. It never sends your email address, your eSIM details, your trip trail, your translations or anything you type. If you allow tracking when iOS asks, it also sends your device's advertising identifier, which lets Meta connect these events with your activity on its own apps. If you don't, the advertising identifier is not shared, and Meta can use the events only for aggregated ad measurement. You can change your choice at any time in iOS Settings > Privacy & Security > Tracking; nothing in Pixroam changes either way.
Support correspondence. If you email us, we keep the message so we can answer it and follow up.
Translation text. Translating happens in the Pixroam keyboard, which you can use in any app once you add it in iOS Settings and allow Full Access; it needs Full Access only to reach the network. The keyboard sends text only when it translates: automatically once it has stayed on screen for about a second, or when you tap Translate. It then sends the text before the cursor in the field you are typing in, and the language you chose, through our server to an AI translation service, and the translation comes back to you. Typing with its letter keys sends nothing. We do not store the text or the translation, and we never write them to a log. What we keep is a count of how many translations each eSIM has used, and for each request its length, its time and whether it succeeded, so we can apply the free allowance and stop abuse.
The keyboard and your sign-in. To count translations against your eSIM, the keyboard uses the sign-in you made in the app, which the app shares with it through your iPhone's keychain together with the translation language you picked. With Full Access on, the keyboard also asks our server how many translations you have left when it is shown; that request carries your sign-in, not your text. It keeps its last translation in memory only while it is running, so switching back to it shows that translation again instead of sending the same text twice.
What we do not collect
We are being blunt about this, because many apps are not:
- No ads inside the app. Pixroam shows no advertising and contains no ad networks.
- No third-party analytics or crash-tracking SDKs. The only third-party advertising SDK is Meta's, which we use to measure our own ads (see "App and purchase events" above); like most SDKs, it can also send Meta reports of its own crashes.
- No tracking of you across other companies' apps or websites unless you allow it. The app asks once, through iOS's App Tracking Transparency prompt, and it works the same if you say no.
- No location data reaches us. If you turn on the trip calendar or the map, your location is used only on your iPhone to draw your trip trail and light up your pixel map, and it is never sent to us (see "Your trip trail" and "Your pixel map" below).
- No access to your contacts, camera, microphone, calendar or health data.
- No reading of your photos. Pixroam never reads your photos. It only adds a trip postcard to your library when you choose to save one, and for that iOS gives it add-only access.
- No passwords. There are none to collect: Sign in with Apple is the only way in.
- No card numbers. See "Payments" below; they never reach us.
- No content of your internet traffic. We cannot see the sites you visit, the apps you use or the messages you send over the eSIM.
- We never sell or rent your personal data. There is no circumstance in which we would.
Your trip trail
Your trip trail stays on your iPhone. While an eSIM you bought from us is in use, the app can record where you walk, draw each day of the trip on that eSIM's calendar, and light up your pixel map. It asks for your location (and, to tell walking from riding in a vehicle, Motion & Fitness) only when you turn the trip calendar on or start the map, and you can refuse or change that in iOS Settings at any time.
The trail is stored in the app's own storage on your iPhone, protected by iOS until you first unlock the phone after it restarts, and left out of iCloud and computer backups. It is never sent to us, our servers or our service providers: we cannot see it. The app's diagnostics log on your iPhone records only counts and names for it (for example "recording started"), never a location.
You choose when it records. By default it records only from the day an eSIM comes into use until it expires, runs out of data or is cancelled, and stops outside those dates. If you choose "Record without an eSIM too" (when you start the map, or later in Map & privacy), it also records on days without a Pixroam eSIM, for example near home. That trail is kept exactly like the rest: on your iPhone only, never sent to us. You can switch back at any time, and you can pause recording, or switch to battery saver, in Trail settings.
Snap to roads is off unless you turn it on. When it is on, a few points of a day's trail and the position of each stop are sent from your iPhone to Apple Maps, so the trail can follow the streets and the stops can be named. Nothing goes to us, and Apple's privacy policy governs that step. Showing any map also loads map images from Apple for the area on screen.
Trails stay on your iPhone until you delete them. Each account's trail is kept apart: signing out deletes nothing, and another account signed in on the same iPhone can't see it. You can delete one day from its screen, or all of your account's trails from Trail settings. Deleting your account deletes that account's trails from your iPhone at the same moment, and deleting the app removes every trail. If you export a day as a GPX file, it goes only where you send it; the copy the app makes for sharing is removed when you delete that day, all trails or your account, or sign out.
Your pixel map
The Map tab shows the places you have been as a pixel map: a fog of squares, each about 25 metres across, lights up where you have walked. The app works the fog out on your iPhone from your trip trail and keeps it with the trail, in the same way: on your iPhone only, left out of iCloud and computer backups, kept apart for each account, and deleted with the trail, whether you delete one day, all trails or your account. Nothing about the places you have been goes to us.
Which countries you have visited, which country you are in, and the welcome when you arrive in a new country are worked out on your iPhone too, from a world map built into the app. That works without a connection and sends nothing to anyone.
The map names the town or district you are in only when "Snap to roads and name places" is on in Trail settings. Then the latest point of your trail is sent from your iPhone to Apple Maps to look up its name; nothing goes to us. That setting is off unless you turn it on, and while it is off the map uses only names built into the app.
Trip postcards. When you save a postcard, iOS asks you to let Pixroam add photos, which lets it add to your library but not see it. Pixroam never reads your photos, and a postcard carries no location data, whether you save it or share it.
Offline maps. The street and city layers of a country's map come in map files that the app downloads over Wi-Fi from our storage provider, Supabase, when you have a Pixroam plan for that country or open its map. That request shows Supabase your IP address and which country's map you are downloading, but never your location. The files hold no personal data. They stay on your iPhone, shared by every account on it and left out of backups, until you delete them in Map & privacy or delete the app.
Map data. The street and city maps are made from OpenStreetMap data, © OpenStreetMap contributors, used under the Open Database License (ODbL) 1.0 (see https://www.openstreetmap.org/copyright). Pixroam's offline map files are a derivative database of that data, and we offer them to anyone under the same licence at https://nkxxhmhtstjrctkjjdtp.supabase.co/storage/v1/object/public/pixel-maps/index.json. The world map comes from Natural Earth, which is in the public domain. These credits are also listed in Map & privacy.
Why we use your data
- To create and secure your account and sign you in (the email address Apple passes us, real or relayed).
- To take your order and deliver it: buy the matching profile from our supplier, issue it to you, and show the QR code and installation details in the app (email, order record, eSIM credentials).
- To show you your eSIMs and how much data and time is left (eSIM credentials, usage data).
- To alert you when an eSIM drops below 20% and below 5% of its data, if you allowed notifications (usage data, push notification token).
- To translate the text the Pixroam keyboard sends when it translates, and to count it against that eSIM's free allowance (translation text, translation counts).
- To provide support: look up your order, investigate a failed issue, answer a question.
- To process cancellations and refunds, and to keep the accounting and tax records we are legally required to keep (order records).
- To detect and prevent fraud and abuse of the service.
- To measure whether our ads on Facebook and Instagram lead to installs and purchases (app and purchase events; your device's advertising identifier only if you allowed tracking).
If you are somewhere that requires a legal basis for processing (for example under the EU or UK GDPR): we rely on performance of a contract for account, order and delivery data; on a legal obligation for accounting and tax records; and on our legitimate interest in running a secure, non-fraudulent service for security and abuse prevention. We rely on your consent, given through the iOS tracking prompt, to share your device's advertising identifier with Meta, and on our legitimate interest in measuring our own advertising for the app and purchase events sent without it.
Who we share it with
We use a small number of service providers. Each one receives only what it needs to do its job.
- Supabase — our database, authentication and backend hosting. It holds your email address, your orders and your eSIM credentials. Hosted in Sydney, Australia (ap-southeast-2). It also stores the offline map files the app downloads; that request shows it your IP address and which country's map, never your location.
- Lemon Squeezy — our payment provider and Merchant of Record. Checkout happens on a Lemon Squeezy web page outside the app. They receive your email and the order details and collect your payment details directly. We receive back only the outcome (paid, failed, refunded) and a transaction reference. We never see or store your card number.
- eSIM Access — our eSIM supplier. To issue your eSIM we send them the plan identifier and the order reference. They return the eSIM credentials, the QR code image and the usage data the app shows you. The QR code image is hosted by the supplier.
- Apple — Apple performs the sign-in and passes us your email address, which is Apple's private relay address if you chose "Hide My Email". Apple's own privacy policy governs that step. If you allow notifications, Apple's push service also delivers our data-usage alerts to your device: it receives the device token and the alert itself (which eSIM is running low). If you turn on snap to roads in the trip calendar, Apple Maps receives a few points of your trail straight from your iPhone (and, to name places on the pixel map, its latest point); we never see them.
- Anthropic — the AI service that performs the Pixroam keyboard's translations. When the keyboard translates, only that text and the language you chose are sent to Anthropic's API, and the translation is sent back. Nothing else about you goes with it: no email address, no order and no eSIM details. Anthropic processes it under its commercial terms, which do not allow it to train its models on that content.
- Meta — Meta Platforms receives the app and purchase events described above through its SDK, so we can measure our ads on Facebook and Instagram, and your device's advertising identifier only if you allowed tracking. Meta's own privacy policy governs how it processes that data.
There is no mail provider on this list, because Pixroam never sends you email. No sign-in codes, no receipts, no newsletters, nothing: your eSIM and its QR code live in the app, and Lemon Squeezy issues the payment receipt as Merchant of Record. The only exception is a reply from us if you write to our support address first.
We will also disclose data where we are legally required to, in response to a valid order or lawful request from a competent authority, or to establish, exercise or defend a legal claim. If that happens we will tell you unless the law forbids it.
That is the complete list. There is nobody else.
Where your data is stored, and cross-border transfers
Your account and order data live in a Supabase PostgreSQL database hosted in Sydney, Australia (ap-southeast-2). The backend functions that read and write it run in the same Supabase project.
Because we operate from Taiwan on an Australian-hosted database, and because our payment, eSIM, translation and ad-measurement providers operate internationally (including in the United States and the European Union), your personal data will be transferred and processed outside your own country. We only use providers that commit contractually to protecting the data they process on our behalf, and we send each of them the minimum they need.
How long we keep it
- Account data (the email address Apple gave us): until you delete your account.
- eSIM credentials: until you delete your account, or until the plan has been expired long enough that support is no longer plausible, whichever comes first.
- Order and transaction records: for as long as tax and accounting law requires (in Taiwan this is currently at least five years). After you delete your account these records are de-identified: they are no longer linked to you or your email, and only the financial facts remain.
- Support correspondence: normally up to two years, so we can pick up the thread if you write again.
- Trip trails and the pixel map's fog: only on your iPhone, until you delete them, delete your account or delete the app. We hold no copy.
- Translations: the text and the translation are never stored. The per-request records (length, time, outcome) are kept for at most 90 days, or until you delete your account if that comes first. The translation count stays with the eSIM it belongs to and is cleared when you delete your account.
- App and purchase events: we do not store them ourselves; Meta keeps them under its own retention policies.
Your rights and how to use them
You can ask us to show you the personal data we hold about you, correct it if it is wrong, delete it, or stop a particular use of it. Depending on where you live you may also have the right to receive a copy in a portable format, or to complain to your data protection authority.
Deleting your account in the app: open the Account tab and use Delete account. When you confirm, we delete your account and the personal data attached to it: your email address, your sessions, your push notification tokens, your eSIM credentials and your translation records. At the same moment the app deletes your account's trip trails and pixel map on your iPhone. What survives is a de-identified financial record of your orders (amount, currency, date, status, transaction reference) that we are required to keep for accounting, tax and refund-dispute purposes. That record can no longer be connected back to you.
Deleting your account does not cancel an eSIM you have already installed, and it does not by itself produce a refund. If you want a refund, ask for it before you delete your account. See the refund rules in our Terms of Service.
For anything else, email wilson07131@gmail.com. We will respond within 30 days. We may first need to confirm that the account is yours, so that we do not hand your data to somebody else. If you signed in with "Hide My Email" we cannot reach you at your real address, so the surest proof is to write to us from the account's relay address, or to sign in and use Delete account in the app.
Children
Pixroam is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.
Security
Access to the database is restricted by row-level security rules, so your orders and eSIM credentials are readable only by your own authenticated session and by the staff accounts that handle support. Traffic between the app, our backend and our providers is encrypted in transit with TLS. Payment credentials never touch our systems. Provider API keys exist only on the server side and are never shipped inside the app.
No system is perfect. If a breach ever affects your personal data, we will notify you and the relevant authority as the law requires.
Changes to this policy
If we change how we handle your data we will update this page and change the effective date at the top. For a change that materially affects you — a new category of data, a new recipient, a new purpose — we will also tell you in the app before it takes effect. We say "in the app" rather than "by email" because we do not email you, and because "Hide My Email" means we may have no way to reach you outside it.
Contact
Email: wilson07131@gmail.com
Operator: YIH-HSUAN WANG, an independent developer based in Taiwan.