Privacy Policy

Effective date: 6 November 2026

1. Who we are

Baidstack Pty Ltd (ABN 69 672 058 712), Sydney, Australia, runs RoamBlack and RoamList ("we", "us").

This policy covers roamblack.com and roamlist.roamblack.com. Our blog at blog.roamblack.com runs on WordPress and has its own section (section 9). Our partner sites have their own policies (section 8).

Contact for privacy questions, access and deletion: hello@roamblack.com

2. The short version

• On roamblack.com and RoamList, we have no accounts and no advertising cookies.
• We do not sell your personal information. We do not share it for advertising.
• We save a cookie only if you press Save or submit the trip brief. A plain visit sets none.
• We use your approximate location to choose what to show first. We do not store it against you.
• We log which partner link was clicked. The log holds no name, email, IP address or browser details.
• You can delete the cookie with "Clear my data". You can ask us to delete anything else we hold.

3. How we handle personal information

Personal information is information about a person who can be identified, or who could reasonably be identified.

We handle it in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). We follow them even where the Act does not strictly bind a small business.

We write this policy for visitors in Australia. If you visit from another country, you may have rights under your local law. Email us and we will help.

4. What we collect, and why

4.1 Your saved hotels and preferences (cookie)

When you press Save on a hotel, or submit the trip brief, we set a first-party cookie called rb_h. It holds the hotels you saved and the preferences you ticked. Our server reads it each time you visit, so we can show your saved hotels and adjust the picks. We set it because you asked for it.

• Only roamblack.com sets and reads it. It is not readable by scripts on the page.
• It holds no name, email or IP address. It is capped at 1 KB.
• "Clear my data" removes it. So does clearing your browser.

On roamblack.com, if you switch to the dark theme, your choice is kept on your device only, in your browser's local storage as rb_theme, and it is not sent to us.

On roamblack.com, if you use the search box in the header, the words you type are sent to roamlist.roamblack.com in the page address, to filter the list. We do not add them to your saved hotels or use them to build a profile.

We use no third-party cookies, no tracking pixels and no advertising audiences. We do not track you across other sites, so a "Do Not Track" or Global Privacy Control signal has nothing to switch off.

4.2 Your approximate location

Cloudflare, our hosting provider, tells us the country and city that your network connection appears to be in. It is an estimate. It can be wrong. A VPN changes it. We do not read the location of your device.

We use it to choose your home region, nearest airport and first picks. We also read the address you arrived on and the page you came from, to order the picks. We use these while we build the page, then we discard them. We do not store them against you.

We do store the country of your network in the click log (section 4.3), with no other detail about you.

4.3 Clicks to partner sites

When you click a button that takes you to a partner, the click goes through our server at api.roamblack.com. We save one record:

• the partner, the area, the hotel and its position on the list;
• the time;
• the channel the click came from (for example "roamlist" or "home") and which button it was (main or alternative);
• a label if the visitor is a search crawler or an AI assistant;
• whether your browser reported a real click or tap;
• the country of your network, and whether the network is a hosting or cloud provider (to tell people from automated programs); and
• a random click number.

We do not save your IP address, your browser or device details, any cookie, your name or your email in this record. We do not save your dates or number of guests either. Those travel in the partner link only.

We use the record to match partner booking reports to clicks, to see which links work, and to stop fake traffic. We keep click records for no more than 24 months.

4.4 What we pass to a partner

The link sends you to the partner's site. It carries the random click number. So the partner can show the right hotel, it also carries the hotel's name and city. If you chose dates and guests, it carries those too. The partner, or its affiliate network, then collects information about you under its own policy.

4.5 Technical data and security

Cloudflare hosts our sites and sits between your browser and us. It processes your IP address and request details to deliver pages, limit abuse and stop attacks. Cloudflare may keep request logs for a short time to run and secure the service. We use your IP address only for these purposes, and we do not store it in our database.

RoamList uses Cloudflare Web Analytics to count page views. Cloudflare states that it does this without cookies.

4.6 Photos and maps on RoamList

Some RoamList pages load files from other services. Your browser asks them directly, so they see your IP address and browser details, as any website does when you ask it for a file:

• Unsplash supplies destination photos.
• OpenFreeMap supplies map tiles when you open the map view.
• unpkg supplies the map software when you open the map view.

We send them nothing beyond what your browser sends with any request, such as the page you came from. We do not set cookies for them. Their own policies apply to what they keep.

4.7 Email you send us

If you email us, we keep your email and our reply so we can help you. We use them only for that. We delete them when we no longer need them, or when you ask.

5. Who sees your information

• Cloudflare, to host and protect our sites (section 4.5).
• Unsplash, OpenFreeMap and unpkg, when your browser loads photos or the map on RoamList (section 4.6).
• Our partners, when you click through to them (sections 4.4 and 8).
• Authorities, if the law requires.
• Anyone else only with your consent, or if the business is sold. In that case the buyer must keep to this policy.

We do not sell personal information. We do not use it for advertising. We do not let advertisers build audiences from it.

6. Overseas

Cloudflare runs a global network. Your request may be handled in a country other than Australia. Our partners are international businesses. They may handle your information overseas, in countries we cannot list in full. Their policies apply once you reach them.

7. How long we keep it

• The rb_h cookie lasts 90 days, or until you press "Clear my data" or clear your browser.
• Click records: no more than 24 months.
• Emails you send us: until we no longer need them, or until you ask us to delete them.

8. Our partners

Partners handle your booking and payment. We never see your card details. We send visitors to:

• Booking.com (through the CJ Affiliate network)
• Agoda (through the Stay22 network)
• Trip.com
• Expedia

Our page travel.roamblack.com is a booking page run with Travelpayouts. Its own privacy policy applies there.

Each partner and network has its own privacy policy and may set its own cookies when you reach its site. Please read them. Our partner list can change.

9. Our blog

blog.roamblack.com runs on WordPress. It is a separate site from roamblack.com and RoamList. It may use tools for security, search reporting and visitor statistics. These tools may set cookies, log your IP address, or count clicks on links. Section 4.1 describes our own rb_h cookie, which the blog does not set. We will keep this section current.

10. Security

We keep secrets out of our code and logs. We limit who can reach our systems. We never log passport details or card numbers. No system is perfectly safe. If a data breach is likely to cause serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC), as the law requires.

11. Your choices and rights

• Delete the cookie. Press "Clear my data" on roamblack.com. Or clear cookies in your browser.
• Access and correction. Email us. We will tell you what we hold about you and fix it if it is wrong. We reply within 30 days.
• Deletion. Email us and ask. We will delete what we hold that identifies you, unless the law says we must keep it.
• Click records and the cookie do not identify you, so we cannot look them up from your name. Deleting the cookie in your browser removes that data.
• Location. It comes from your network connection. You can use a VPN to change it.

12. Complaints

Email us first. We will reply within 30 days. If you are not happy, you can complain to the OAIC at oaic.gov.au.

13. Our sites are for adults

We do not aim our sites at children. We do not knowingly collect information from them.

14. Changes

We may update this policy. The date at the top shows the current version. If we add a new use of your information, we will change this page before we start.