Privacy Policy
Last updated 16 October 2026
This policy covers the DimeRoam iPhone app and this website. The data controller is GrowEpic Corp, a corporation registered in Wyoming, United States, at 30 N Gould St Ste R, Sheridan, WY 82801, USA. Questions and rights requests: privacy@dimeroam.com.
1. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Random device identifier generated on first launch, stored in your device keychain | To tie eSIMs to the device that bought them, before and after you sign in | Contract (Art. 6(1)(b)) |
| Account: your email address, and the identifier Apple or Google gives us when you sign in with them | An account is required to buy, so an eSIM survives a lost or replaced phone and can be restored by support | Contract (Art. 6(1)(b)) |
| Orders: plan, price, time of purchase, payment status | To deliver the plan, support you, and keep accounting records | Contract; legal obligation (Art. 6(1)(b),(c)) |
| eSIM technical identifiers: ICCID, transaction number, profile status | To issue, display and troubleshoot the eSIM | Contract (Art. 6(1)(b)) |
| Data volume used, plan expiry, activation time — reported to us by the network | To show you how much data is left | Contract (Art. 6(1)(b)) |
| Payment confirmation from Stripe: amount, currency, result, last four digits and card brand | To confirm you paid before we issue an eSIM, and to handle refunds and chargebacks | Contract; legal obligation (Art. 6(1)(b),(c)) |
| Billing name and address, where you pay with Apple Pay and approve sharing them | To answer a chargeback with what the payer actually presented, and to meet card-scheme and anti-fraud rules | Contract; legal obligation; legitimate interest (Art. 6(1)(b),(c),(f)) |
| Usage events inside the app: screens opened, destination and plan chosen, checkout started, payment result, eSIM issued and installed, support message sent — with the device identifier, never the content of your messages | To see where the app is confusing or broken, and to reconstruct what happened when a payment is disputed | Legitimate interest (Art. 6(1)(f)) |
| Crash reports: the state of the app when it stopped, the device model and OS version | To find and fix crashes | Legitimate interest (Art. 6(1)(f)) |
| Messages and screenshots you send to support | To answer you | Contract; legitimate interest (Art. 6(1)(b),(f)) |
| Server request logs (IP address, timestamp, endpoint), kept short-term | Security, abuse prevention, debugging | Legitimate interest (Art. 6(1)(f)) |
2. What we never collect
- Your browsing. We do not see, log or receive the sites you visit or the apps you use over the eSIM.
- What the ad blocker sees. The optional ad blocker (Adblock tab) is a VPN that runs only on your iPhone and carries nothing but domain-name lookups. It checks each name against a list of ad and tracker domains downloaded from us once a day, answers listed names with "no such domain", and sends every other lookup to Cloudflare's public DNS resolver (1.1.1.1), which handles it under its own privacy policy. No lookup, site name or browsing data is sent to us or stored by us; the only thing the app records is that the blocker was turned on or off.
- Your precise location. The app never asks for location permission and never reads GPS. We know which country a plan covers because you chose it. Our analytics provider derives an approximate country from the IP address of the request, as any server does.
- Card numbers. Card details go straight from your device to Stripe and never touch our servers.
- Advertising identifiers. The app contains no advertising SDK, does not use the IDFA, and never asks for App Tracking Transparency. Nothing we collect is shared with advertisers or used to follow you across other apps and sites.
- The content of your support messages, in analytics. We record that you wrote to support and how long the message was — never what it said. The message itself goes only to the support system described above.
3. Who else processes your data
| Processor | What it receives | Where |
|---|---|---|
| eSIM Access (Red Tea Mobile) | The order and the eSIM profile identifiers. It issues and operates the eSIM profile. | Singapore / Hong Kong |
| Stripe, Inc. and Stripe Payments Europe | Payment details you enter, the amount and the result. Stripe is an independent controller for fraud prevention. | United States / Ireland |
| Cloudflare, Inc. | Hosts our API and this site and processes the requests your app makes. | Global edge network |
| Apple Inc. | If you pay with Apple Pay, Apple handles the payment token and passes us the billing name and address you approve. Apple also operates the eSIM installation on your device. | United States |
| Google LLC (Firebase Analytics and Crashlytics) | The usage events and crash reports listed above, with the device identifier and an app instance identifier Google generates. Used only for our own product analytics and crash reporting; not for advertising. | United States |
Mobile network operators in the country you travel to carry the traffic itself under their own local regulation. We do not receive their traffic records beyond aggregate volume.
We do not sell personal data and we do not share it for cross-context behavioural advertising.
4. International transfers
We operate from the United States and our processors operate globally. Where personal data of people in the EEA or UK is transferred outside those areas, the transfer relies on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) concluded with the relevant processor, together with the technical measures described in this policy.
5. How long we keep it
| Record | Retention |
|---|---|
| Device identifier and the eSIMs tied to it | Until you ask us to delete it, or two years after the last eSIM expires |
| Order and payment records | Seven years, as United States accounting and tax law requires |
| Support conversations | Two years from the last message |
| Server request logs | 30 days |
| Account: email and sign-in identifier | Until you ask us to delete it, or two years after the last eSIM expires |
| Billing name and address | Seven years, with the order it belongs to |
| Usage events | 14 months |
| Crash reports | 90 days |
6. Your rights
Wherever you live, you can ask us to give you a copy of what we hold, correct it, delete it, restrict or object to processing, or send it to another provider in a portable format. If you are in the EEA or UK you also have the right to complain to your data protection authority. If you are in California, see your California rights.
Write to privacy@dimeroam.com from the device in question, or include the ICCID of one of your eSIMs so we can identify the records. We answer within 30 days and never charge for a first request.
7. Security
Traffic between the app and our servers is TLS-encrypted. Reseller and payment credentials live only on the server and are never shipped in the app. The device identifier is stored in the iOS keychain rather than in app storage. Access to production data is limited to the people who operate the service.
8. Children
DimeRoam is not directed at children under 13 (under 16 in the EEA) and we do not knowingly collect their personal data. If you believe a child has given us data, write to us and we will delete it.
9. Automated decision-making
We make no decisions about you by automated means that produce legal or similarly significant effects. Stripe applies automated fraud scoring to payments; a payment it declines can be retried or queried with us.
10. Changes
If this policy changes materially we will update the date above and show a notice in the app before the change takes effect.