Cartie
In short
1Who we are
Cartie is run by Banuel Dogayman, Harav Goren, Israel ("we"). This policy covers the Cartie app for iPhone and Android and this website. The app is currently offered in Israel.
For any privacy question: banueldogayman@gmail.com.
2What we store, and why
| What | Why |
|---|---|
| Sign in: the identifier Apple or Google gives, the email address they share, and the name given at the first sign in, if one was given. No password is stored by us. | To sign in, and to recognise the same person on every phone. |
| What is created in the app: accounts, lists and items, templates, coupons (with the code, balance, link, note and pasted message, if any), reminders, the name and character in each account, stars and looks. | This is the app itself: so a list is the same for everyone who sees it. |
| The items an account usually adds, and how many times they were added. | To suggest them again when adding items. |
| Details of a shared account: who manages it, when each person joined and last opened it, and the invite links made. | To run the account, and to show what is new since last time. |
| A notification address for the phone and the kind of phone (iPhone or Android), only after notifications are allowed. | To send list updates (section 6). |
| The app's language. | So the app and its notifications arrive in the chosen language. |
| Anonymous usage counts, apart from everything else. | To understand what works and what to improve. All the details are in section 4. |
Like any internet service, the servers briefly log technical details of each request, such as the time and the IP address, to run the service and protect it. What is written in the lists is not in these logs.
3Who sees what
What is in a shared account is visible to the people in that account, according to each list's and coupon's "Who sees": "Whole account", "Specific people" or "Only me". A list or coupon set to "Only me" stays personal. Nothing is ever shown across accounts.
Whoever sees a coupon also sees its code. Choose "Who sees" accordingly.
4Anonymous usage counts
The app counts a few fixed actions, so we know which parts work. Nothing written in the app is ever part of the count.
What is counted. A fixed list written into the app's code: opening the app; signing in (with Apple or Google) and creating an account; sending an invite and joining an account; creating a list (groceries or general); adding items (how many, and whether they were typed, picked from a suggestion, came from a template or were pasted); starting a trip, finishing it (how many items were bought, how many stars were earned, and whether the daily limit was reached) and undoing a finish; opening the closet, trying, buying and wearing a look (which look and its price in stars) and choosing a character; opening and sharing "The year in Cartie"; creating a coupon; and setting a reminder (for a list, an item or a coupon). Nothing is added to this list without an update of the app, and this policy is updated with it.
What is never counted. What is written: no names of lists, items or stores, no coupon codes and no notes. No names of people, no email address, and no identifier of a user, account, list or item. The list of actions has no place for free text. The app records no screens and counts no taps or screens on its own.
No name attached. Each install creates a random identifier on the phone. It is not a name, an email, an Apple or Google account or a Cartie user, and we have no way to connect it to a person. Each count also carries the app version, the operating system and its version, and a random session identifier; not the phone's model, language or location. The IP address is not stored, and no location is worked out from it.
Who receives it, and where. PostHog, an analytics service acting for us, on servers in the European Union (Frankfurt, Germany). The counts are kept for up to 12 months, then deleted. PostHog's privacy policy.
There is no switch yet in the app to turn the counting off. Its basis is our legitimate interest in understanding what works in the app, weighed against the fact that it is anonymous and holds nothing written. Because the counts carry only a random identifier, we cannot tell which actions belong to a given person, so they cannot be deleted one by one; they delete themselves after 12 months.
5Update checks
Updates to screens and text. Each time it opens, the app asks Expo, the service it is published through, whether a newer version of its screens and text is available. If there is one, it downloads in the background and takes effect the next time the app opens. The check sends a random identifier made on the phone (a different one from section 4), the kind of phone, the app version and the update now running; if an update failed to start, also the error message. The IP address reaches Expo, as with any internet connection. Expo is in the United States. Expo's privacy policy.
A version too old. When it opens and each time it comes back to the front, the app asks Cartie's server for the lowest version that still works and the latest one. Every request to the server carries the version number and the kind of phone. When the version is too old, the app asks for an update; when a newer one exists, a note appears. "Update" opens the app's page in the store, only on a tap. The app does not ask Apple or Google itself.
None of these checks sends anything written in the app.
6Notifications
- Reminders for a list, an item, and a coupon before it expires, at the chosen time. They are scheduled on the phone itself.
- List updates ("Get updates" on a list): when someone else adds items, and when a trip ends. The server sends them through Expo's notification service, which passes them to Apple or Google, and from there to the phone. For this it gives them the phone's notification address and the notification's text.
What the lock screen shows. Cartie's notifications show what was written: the list's name, the names of the items added and the name of whoever added them, or a coupon's store and when it expires. Anyone who can see the lock screen sees them. A coupon's code never appears in a notification. Notification previews can be hidden in the phone's settings.
Notifications are optional: they can be declined, updates and reminders can be turned off in the app, or Cartie's notifications can be turned off in the phone's settings.
7The copy kept on the phone
So the app opens fast and works without a connection, the phone keeps a copy of what was last loaded: lists and items, templates, reminders and coupons, codes included. Each copy is kept for up to 30 days from when it was last loaded.
- Signing out and deleting the user remove the whole copy from the phone.
- Leaving an account, or losing access to one, removes that account's copy.
- A coupon that is deleted or no longer shared is removed from the copy, with its code.
The sign in is kept in the phone's secure storage. A backup of the phone (iCloud, Google, or a computer) may include the copy. That backup is made and kept by Apple or Google under their terms, and we have no access to it.
8Phone permissions
- Notifications: the only permission the app asks for, and only after a tap.
- What was copied: the app reads it only on a tap: "Paste" in a new coupon, and "I have an invite link" at sign in and when switching accounts. The phone may ask before it hands it over.
- The phone's share sheet: to send an invite link, a list or "The year in Cartie", only on a tap.
The app does not ask for location, contacts, camera, microphone, photos or calendar.
9Links that leave the app
- A coupon's link opens in the browser. Only web links (http or https) are kept.
- Sharing: an invite link, a list or "The year in Cartie" go to the app chosen in the share sheet, such as WhatsApp.
- Email to support: "Contact us" in Settings opens a new email with the app version, the phone's model and the language, which can be seen and changed before sending.
- The store: "Update" opens the app's page in the App Store or Google Play.
- The phone's settings, to turn notifications on, and these documents, which open in the browser.
From the moment of leaving, the other service's policy applies. The app does not know what happens there.
10Test versions, and diagnostics from Apple and Google
For a test version installed through TestFlight, Apple may share crash reports with us, and feedback if it is sent, including any attached screenshot, under TestFlight's terms. Crash report sharing can be turned off in the phone's settings, under Privacy & Security, then Analytics & Improvements. Feedback sent through Google Play on a test version is under Google's terms.
Separately, where the phone is set to share data with app developers, Apple or Google may give us aggregated, anonymous crash and performance statistics. We add no code to collect them.
11Who helps us
- Supabase: Cartie's database, sign in and server, on servers in Frankfurt, Germany.
- Apple and Google: the sign in itself, and delivering notifications to the phone. At sign in they give Cartie an identifier and an email, and they do not see the lists.
- Expo: passes list updates to Apple and Google, and publishes the app's updates (section 5).
- PostHog: the counts in section 4, on servers in the European Union.
- Cloudflare: hosts this website (section 18).
None of them receives what is written in the lists for any purpose of its own.
Their policies: Supabase, Apple, Google, Expo, PostHog, Cloudflare.
12Data that leaves Israel
The database and the counts are kept in the European Union, whose data protection law Israel recognises. Expo, Apple and Google are in the United States: sign in, notifications (their text included) and the update check pass through them.
13No advertising, no tracking
We do not sell data or share it for advertising. The app has no ads and no advertising or install attribution tools, does not use the phone's advertising identifier, and does not track anyone across apps or websites. That is why, on an iPhone, it never asks for permission to track: there is no tracking to ask about.
14How long
- Data is kept for as long as the user exists. Deleting the user in the app deletes it at once (how to delete). A deletion asked for by email is done within a week.
- In shared lists that other people keep using, the items stay with them, without the name of whoever added them.
- We keep no backups of the database, so a deletion is final.
- The anonymous counts are kept for up to 12 months. The copy on the phone is kept for up to 30 days (section 7).
15Your rights
You can ask to see the data, correct it or delete it by writing to banueldogayman@gmail.com. We reply within 30 days. Most of this can be done right in the app: see and change everything created, change the name and character, leave an account, and delete the user.
You can also complain to the Privacy Protection Authority at Israel's Ministry of Justice.
16Children
Cartie is for people aged 13 and over. Anyone under 13 may not use it, and anyone under 18 needs a parent's or guardian's permission (terms of use). We do not knowingly collect data about children under 13. If we learn that a user is under 13, we delete the user and their data. You can email us about it.
17Security
- All data travels encrypted between the phone and the server, and the servers are in Frankfurt.
- Only Cartie's server reaches the database, and it checks on every request who may see what.
- A person removed from an account loses access to its coupons and reminders at once, and to its lists within 10 minutes at most.
- While the app is in the background, a coupon's screen is covered so its code does not show in the app switcher's picture. Always on an iPhone; on Android, as far as the phone allows.
- The copy on the phone is protected by the phone's lock. We recommend locking the phone with a passcode, fingerprint or face: anyone who can open the phone can open Cartie too.
18This website
This site is hosted on Cloudflare Pages. It sets no cookies of its own and runs no analytics. Cloudflare receives the browser's request, including the IP address, to serve the page. The font loads from Google Fonts, so the browser also contacts Google.
19Changes to this policy
When a change affects what is stored or who sees what, it will appear here with a new date before it takes effect. Earlier versions are available on request.
20Contact
Banuel Dogayman
Harav Goren, Israel
banueldogayman@gmail.com