Carry Privacy Policy

In short

• Your tasks, lists, notes and files are yours. We do not read them except where we have to in order to run the service or fix a fault, we do not use them to train anything, and we do not sell or rent any of your data to anyone, ever.
• We collect what we need to run an account, sync your data between your devices, send the notifications you ask for, and find out why the app crashed.
• Diagnostics are off until you turn them on. Crash and performance reporting is opt-in on every platform, and you can withdraw it at any time.
• We use no advertising networks and no third-party analytics. There is no Google Analytics, no Firebase Analytics, no Sentry, no Mixpanel, no advertising SDK and no tracking pixel in Carry, on any platform. Our crash and diagnostic code is our own. Two Google components are in the mobile app and neither of them is analytics: one delivers your notifications, and one reads QR codes on your device. Section 4 says exactly what each receives.
• Carry sets no cookies. Nothing to consent to, nothing to dismiss.
• You can get a copy of your data and delete your account permanently, from inside the app, at any time. Section 6 says exactly what the in-app export contains, and how to get anything it does not.

1. What we collect, and why

1.1 Your account

If you sign in with Apple and choose to hide your email, Apple gives us a relay address. That works normally and we never see your real address.

1.2 Your sessions and devices

To keep you signed in and to let you see and end your own sessions, each signed-in session records: a hashed session token, when it expires, your IP address, your browser or app’s user-agent, a device name, the app version, and which kind of client it is.

We keep your IP address because it is how an account owner — and we — can tell a session apart from an intruder’s. It is not used to build a location profile, and it is not shared with anyone for advertising or analytics.

1.3 What you put into Carry

Everything you create in Carry and sync: tasks (including their text, dates, completion state and who you have assigned them to), lists, notes, bookmarks, scheduling options, and your settings.

We treat this as yours and as private. Carry is a place people write down whatever is on their mind, which means a task list can contain health details, financial details, or anything else. We do not ask you to tell us about those things, we do not analyse the content of your tasks or notes, and we do not use them to train machine-learning models. Our people access the content of your account only when it is genuinely necessary to run the service or to investigate a fault — usually one you have reported — and administrative access is logged.

1.4 Files you attach

When you attach a file to a task or a note, we store the file itself plus its name, type and size, and a thumbnail if it is an image. Attachments are up to 50 MB each.

Files are held in private storage on our own server. They are not publicly addressable: every upload and download goes through a signed link that expires after 15 minutes and is issued only to you.

1.5 Sharing, and people you invite

When you share a list or a note, we record which resource is shared, who owns it, who the members are and what they can do, and when each invitation was sent and answered.

If you invite somebody who does not have a Carry account, we store the email address you gave us so the invitation can be claimed when they sign up, and we send them one email saying that you — by the name on your profile — have invited them to collaborate. We do not add them to any list, we do not email them again about it, and if they never sign up the invitation simply sits unclaimed.

If you are the person who received such an email: you are a data subject too, and every right in section 6 is yours. If you want the address removed and no account created, write to hello@percuno.com and we will delete it.

When you search for someone to share with, Carry matches on name and username. It does not reveal other users’ email addresses — that is deliberate.

Carry also remembers which contacts you have hidden from your sharing picker, so they stay hidden.

1.6 Subscriptions

If you subscribe, the payment is taken by Apple or Google, not by us. We never see your card details. We receive and store the store’s purchase record: which platform, which product, the store’s transaction identifier, the status, and the current billing period, so we know what your account is entitled to.

1.7 Notifications

If you turn on notifications, we store a push token for each device, the platform, and a device name, so the right reminder reaches the right device.

1.8 Calendar, only if you connect it

Google Calendar is off unless you turn it on. If you connect it, we store the access and refresh tokens Google gives us, encrypted, and nothing else. Disconnecting it in Carry deletes them. We never get your Google password.

1.9 Diagnostics — crashes, errors and how the app performs

This is the part most privacy policies are vague about, so here is exactly what it is.

If you turn diagnostics on, Carry sends us first-party diagnostic events. There is no third-party crash or analytics service involved — the data goes to our server and nowhere else. Each event carries:

• what happened: an event, measurement, crash, error, performance sample or counter, with a name and timestamp;
• for a crash or an error: the stack trace and recent breadcrumbs — a short trail of what the app was doing beforehand;
• which install and which session it came from, as random identifiers;
• your app version and build, your operating system and version, device model, and language setting;
• for server-side errors: which request failed, the error, the stack trace and the user-agent.

It is linked to your account, because an anonymous crash report cannot tell us whose sync is broken when you write in to say your sync is broken.

On phones and tablets there is a little more of it, and it is still ours. The mobile app watches for the three things a crash report usually misses: a native crash (the kind that takes the whole app down), the app freezing, and the app running out of memory. When one happens it records the technical details on your device, keeps them there until the app next runs, and then sends them with the rest of the diagnostics. File paths are stripped out of crash traces before they are sent, because the path to a file you attached can contain its name and we do not need that to fix a crash. No third-party crash service is involved in any of this — the code is ours and the data goes to our server.

We use it for one thing: making Carry work. Finding crashes, fixing sync faults, seeing whether a release made things worse. It is not used for advertising, it is not sold, it is not shared with an analytics company, and it does not feed any profile of you.

Diagnostics are off until you turn them on. We do not collect them unless you have said yes. You can withdraw that at any time in Carry’s settings; withdrawing it stops collection immediately and deletes anything still waiting to be sent from your device. Nothing else in Carry stops working if you say no. And if you are using an older version of the app that has not yet learned to ask, our server refuses its diagnostics anyway.

1.10 Feedback you send us

If you use the feedback form, we store what you wrote, the category, a rating if you gave one, any screenshots you attach, and some context about your app and device so we can reproduce the problem. We keep it while we are dealing with it and for a period afterwards, in case the same issue comes back.

1.11 What the phone and tablet apps ask permission for, and what stays on your device

The mobile apps ask for four permissions and nothing else. You can refuse any of them and still use Carry; you lose only the feature attached to the one you refused.

QR code scanning happens on your device. The scanner is a Google component — Google’s ML Kit barcode scanner, bundled into the app rather than called over the network. Your camera image is never uploaded: Google’s own terms state that for these on-device APIs “processing of the input data (e.g. images, video, text) fully happens on-device, and ML Kit does not send that data and the resultant outputs to Google servers”. What Google does receive is technical metrics about how that scanner performed — Google’s terms describe this as “metrics about the performance and utilization of the APIs in your app”, used to maintain and debug the component. It contains nothing you scanned and nothing from your account. We are telling you about it because Google’s terms require us to, and because we would rather you heard it from us.

What the mobile apps do not ask for and do not use: no location, no microphone, no contacts, no calendar on the device, no health data, no advertising identifier. The apps do not ask you for permission to track you across other companies’ apps and websites, because we do not do that and have nothing to ask for.

1.12 What we do not do

• We do not use cookies. Carry stores a sign-in token and a couple of interface preferences in your browser’s local storage, which is what keeps you signed in and your panel widths where you left them. It is not used for tracking and it is not shared.
• We do not use advertising networks, ad identifiers, tracking pixels or third-party analytics.
• The Carry website loads nothing from anyone else’s server — no third-party fonts, scripts or embeds — so reading these pages, the home page at carry.today, or the web app itself tells no other company that you did.
• We do not sell, rent or trade your personal data. There is no circumstance in which we would.
• We do not use your content to train machine-learning models.
• We do not make any decision about you by automated means that has a legal or similarly significant effect on you.

2. Why we are allowed to process it

Where we rely on consent, you can withdraw it at any time, and withdrawing it does not affect anything we did lawfully before you withdrew it.

3. How long we keep it

When you delete your account, deletion is permanent and immediate. It is not a deactivation and there is no recovery window. Where a record has to survive for someone else’s sake — for example a fault report that is also part of another user’s shared list history — we sever it from you rather than keep it against your name.

We may keep a minimal record of a deletion where the law requires it, or where we need it to defend a legal claim.

4. Who else is involved

We use a small number of providers to run Carry. They act on our instructions, they get only what they need, and none of them may use your data for their own purposes.

File storage is our own software on our own server — it is not a third-party storage service, and your files are not held by anyone in the table above other than our hosting provider. It runs on the same machine in Germany as the rest of Carry.

We will also disclose personal data where we are legally required to, by a valid order from a competent authority, or where it is necessary to establish or defend a legal claim. If Carry is ever sold or transferred, your data may move with it, and we will tell you before that happens.

5. Where your data goes, and how it is protected on the way

Percuno FZE is in the United Arab Emirates. Our server is in Falkenstein, Germany — and so are the database and the file storage, because they are the same machine. Some of the providers in section 4 are in the United States or operate globally. So your personal data is transferred across borders: out of the UAE where we are, and for some providers out of Germany where your data is stored.

If you are in the EU or the EEA, the practical effect is better than that sounds: your account, the content you create, and the files you attach are stored inside the EEA, under the GDPR, and not transferred out of it for storage. What does leave is narrower — the providers in section 4, each doing one job: routing traffic, delivering a notification, sending one email, verifying a sign-in.

This is required to be stated up front under Article 13(2) of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), together with the purposes of processing and who your data is shared with. Those are in sections 1, 2 and 4.

How those transfers are protected:

• Our hosting is in Germany, a country with comprehensive data-protection legislation of its own — the GDPR and the Bundesdatenschutzgesetz — which is the basis contemplated by Article 22 of the PDPL.
• For providers outside such a country, we rely on contractual commitments that bind them to the protections in the PDPL, as contemplated by Article 23. Each of the providers in section 4 is a major provider with published data-processing terms.
• Everything is encrypted in transit. Calendar tokens are additionally encrypted at rest.

Where the GDPR or the UK GDPR applies to a transfer out of the EEA or the UK, we rely on the European Commission’s and the UK’s Standard Contractual Clauses, or on an adequacy decision where one covers the provider.

6. Your rights

Whoever and wherever you are, you can ask us to:

• tell you what we hold about you — the categories of your personal data we process, what we use it for, who we share it with and whether that is inside or outside the UAE, how long we keep it, how to correct or erase it, how your data is protected when it crosses a border, what we would do if it were breached, and how to complain;
• give you a copy — or just use Export in the app, which gives you your profile, settings, tasks, lists and scheduling options as a JSON file, immediately and without asking us;
• correct anything wrong — most of it you can edit yourself in the app;
• delete your account and everything in it — Delete account in the app does this permanently, or write to us;
• restrict or stop particular processing — including turning diagnostics off, which you can do yourself in settings;
• object to processing we carry out on the basis of our legitimate interests;
• withdraw consent you have given, at any time.

If you are in the European Union or the United Kingdom, you also have the right to data portability in a structured, machine-readable format — the in-app Export covers the part of your data listed above, and anything it does not yet cover we will send you in the same format on request, which is the one email in the paragraph below, the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects (we make no such decisions), and the right to lodge a complaint with your national supervisory authority. You do not have to come to us first, though we would rather you did and we would rather fix it.

How to exercise any of this: email hello@percuno.com. We do not charge for it. We will answer within 30 days, and sooner where we can. If we need to confirm you are who you say you are, we will ask — and we will ask for the least we can get away with.

If you are not happy with how we have handled it, tell us first and we will try to put it right. You can also complain to the UAE Data Office. If you are in the EU or the UK, you can complain to your own national data protection authority instead.

In a narrow set of cases the PDPL allows us to decline a request for information — if it is unrelated or excessively repetitive, if it would conflict with a judicial process or investigation, if it would damage information security, or if it would expose someone else’s personal data. If we ever decline, we will tell you which of those applies and why.

7. Keeping it safe

• Everything travels over encrypted connections.
• Passwords are stored only as one-way hashes.
• Files are in private storage, reachable only through signed links that expire after 15 minutes.
• Google Calendar tokens are encrypted at rest with a separate key.
• Session tokens are stored hashed, rotate on use, and can be revoked family-wide if one is replayed.
• On phones and tablets, your sign-in token is held in the device’s own secure store — the iOS Keychain or the Android Keystore — not in ordinary app storage.
• Crash reports have file paths stripped out of them before they leave your device, so the name of a file you attached does not travel with a crash.
• Administrative access to accounts is restricted and logged, and account deletion cannot be triggered from an administrative session.
• Our origin server only accepts traffic through Cloudflare.

No service is perfectly secure, and we would rather say so than imply otherwise. If there is ever a breach of your personal data that threatens its privacy, confidentiality or security, we will report it to the UAE Data Office and tell you, without undue delay and in any event as required by the PDPL and its Executive Regulations. Where the GDPR or the UK GDPR applies we will also notify the relevant supervisory authority within the time it requires, and within 72 hours where that Regulation requires it.

8. Children

Carry is not for children. You must be at least 16 to have a Carry account. We do not knowingly collect personal data from anyone under 16, and if we find out we have, we delete it. If you are a parent or guardian and believe your child has an account, write to hello@percuno.com and we will remove it.

9. Changes to this policy

If we change this policy we will change the date at the top. If a change materially affects your rights or how we use your data, we will tell you in the app or by email before it takes effect — we will not make a material change quietly.

10. Who we are

Percuno FZE — a Limited Liability Establishment
Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
Licence 4432265.01 · Certificate of Incorporation 4432265 · Share capital AED 50,000
hello@percuno.com

Percuno FZE is the data controller for Carry. We have not appointed a Data Protection Officer: on our current scale and processing, Article 10 of the PDPL does not require one. Questions about your data go to hello@percuno.com and reach a person who can act on them.