Privacy
What you enter in Carry stays on your device — except the trips you share and the destination of a trip for which Carry shows the weather. No account, no sign-in, no ads, and nothing that counts what you do in the app.
This page describes which data the Carry app (iPhone and Android) sends where and how long it stays there.
What stays on the device
Trips, travelers, packing lists, expenses, activities and attachments lie on the device: the trip data in a database, your settings and the people of your household in the app’s own store next to it, the attached files in Carry’s own folder.
The Carry server does not get to see private trips — if Carry shows the weather at a trip’s destination, only its destination coordinates and dates (see “Destination and weather”). There is no sign-in with which anyone could retrieve them — us included.
Carry includes no advertising or analytics components. The only third-party components are the platform’s notification services (see “Notifications”) and the purchase handling by Apple or Google (see “Carry Plus”).
Shared trips
If you share a trip (“Invite”), it lies on the Carry server in full and readable: name, destination and dates, the names of the travelers, packing lists, expenses with amounts and splits, activities with places, websites and notes. Not sent: private attachments, your household, packing profiles, nicknames and your own items in the catalog.
“Invite” hands a link and a code to the share sheet. A code is valid for 7 days, is stored on the server only as a non-reversible key and can be revoked; whoever has already joined stays. Every device that has joined with a code can see the trip; a packing list that someone does not share is seen only by the devices responsible for that person.
Instead of an account, the device signs in with a random identifier that the app keeps in a file. The server knows only a non-reversible hash of it, plus the day of sign-in and of the last connection — no name, no device model, no address.
Deleting a shared trip on your device means leaving it; for the others it remains. The server does not delete shared trips. Once no device holds a trip any longer — a device that has not connected for 13 months no longer counts —, it removes names and all freely typed text and keeps only numbers and items from the bundled catalog, without reference to persons.
The server does not store your IP address; for abuse limits it counts it only as a non-reversible key, for at most one day. The server logs contain no IP addresses and no content of your trips. The server is located in a data center in the EU.
Shared attachments
Photos and files you attach to an activity or expense are stored by Carry in its own folder on the device. An attachment is uploaded only if you explicitly share it in a shared trip.
A shared attachment (photo as JPEG, PNG or HEIC, or PDF, at most 10 MB) is stored with its file name and size on the Carry server in the EU, and every member of the trip can download it. The server does not process the file and creates no preview.
The server deletes a shared attachment at the latest 30 days after the upload and at the latest 14 days after the end of the trip — whichever comes first. If someone deletes the attachment, the file is removed from the server immediately. The copies on the devices are not affected.
Destination and weather
If you give a shared trip its destination via the place search, the app sends your search text and the app’s language to the Carry server. The server asks Apple Maps (Apple Inc.) and returns the suggestions to the app. Apple receives from the Carry server only the search text and the language — no device identifier, not your device’s IP address, no trip. The server keeps the same search for 24 hours, without the search text in plain form and without reference to a device.
The chosen place (its name and coordinates) belongs to the shared trip and lies with it on the Carry server (see “Shared trips”).
For the weather card the Carry server asks Apple Weather (WeatherKit, Apple Inc.) for the forecast for the places of trips that are running or start within the next ten days — with the coordinates rounded to about one kilometer, every three hours, without names, without trip and without device. The forecast is stored per place on the server; seven days after no trip needs it any longer, it is deleted. Your app fetches it only from the Carry server, never from Apple. For trip days more than ten days away, the server asks Apple Weather for the weather on the same days in the past five years and shows typical weather from it — again only with the rounded coordinates; the average per place and calendar day is kept for one year, without reference to a trip or device.
Carry also shows the weather at the destination of a trip you do not share. For this, the app sends the destination’s coordinates and the trip dates to the Carry server — no trip name and no other content of the trip; for signing in only the random device identifier (see “Shared trips”). The server keeps the place, rounded to about one kilometer, and the dates without reference to a device so that the forecast stays current, and deletes both once the trip is over or nobody has asked for seven days. Apple Weather receives, as above, only the rounded coordinates. If notifications are on, the server additionally stores, for weather notifications about a trip you do not share, the device identifier, the place, the dates and the trip name (only for the notification title) — until one day after the trip ends.
Processing by Apple in the USA cannot be ruled out. The weather data comes from Apple Weather; its data sources are listed at https://weatherkit.apple.com/legal-attribution.html.
Notifications
If you turn on notifications in Carry, your device receives an identifier for notifications (push token) from the operating system’s notification service — on the iPhone from the Apple Push Notification service (Apple Inc.), on Android from Firebase Cloud Messaging (Google). Carry sends this token together with the selected language to the Carry server and stores it there as long as notifications are on; turning them off deletes it.
When something happens in a shared trip that concerns you (a new expense you are part of, a new member, a change of the trip’s name, destination or dates, something you are to bring), the Carry server sends a notification to your device via Apple or Google. Apple and Google receive the push token, the time, the kind of event and random identifiers of the trip, the members and, where applicable, the expense or item, on the iPhone additionally a generic text — no names, no amounts, no trip names and no other content of your trip. The app then fetches names and amounts itself from the Carry server and shows them. Weather notifications (rain, UV, thunderstorms, heat, cold, snow at the destination of a trip that starts soon or is running) take the same route; Apple or Google additionally see the weekdays and the weather values, no place or trip name.
On Android, the app registers with Firebase for this (Firebase installation ID); Firebase Analytics is not included. A transfer to the USA cannot be ruled out. The Carry server only counts how many notifications were sent per month and platform.
Reminders
Your device schedules the reminder on the evening before departure itself. Title and text are created on the device and never leave it.
The title holds the name of the trip, the text the destination and the number of items still to pack. That is readable on the lock screen without anyone unlocking your device. If you don’t want that, hide previews in the phone’s settings.
Exchange rates
For expenses in a foreign currency the app needs exchange rates; a rate set from the European Central Bank comes bundled for that, and whatever has been fetched once Carry stores alongside it on the device.
Carry asks the Carry server for a rate when one is missing or out of date in the existing set, and fetches rates in advance so they are already there on the road. Such a request contains a currency pair and a period — when looking up a single expense that is its day, when prefetching always the last 90 days up to today, and if a trip lies further back, its period as well. No amounts, no names, no travelers, no device identifier, no account.
Anyone who saw these requests would know on what day the app was used and which currencies it calculates with — and for a trip further in the past, when that trip was. Not where to, not with whom, not how much — and no name is attached anywhere. As with every request on the internet, the server sees the IP address of your connection.
Support
If you write to us via the support page, exactly this information goes along: the topic you chose, your email address, your text, the app’s version and build, your device model, the operating system version and the language in which you read Carry. We need the address for the answer, and the technical details because a “crashes” can’t be answered without them. Nothing from your trips goes along — no names, no amounts, no places, no device identifier.
Once sent, this information goes to the Carry server, which immediately forwards it by email to support@carryapp.de and does not store it on the server. Only if forwarding fails does the request wait there for at most 24 hours for the next attempt; after that it is deleted. The app remembers your address on the device so you don’t have to type it again next time.
No ads, no usage analytics
There’s no advertising component in Carry, no analytics tool and no crash reporter. The app doesn’t count which page you open and doesn’t report anywhere that you use it.
Only shared trips are evaluated: how often items from the catalog occur, with which quantity rule and whether they end up in the bag — as totals without trip, names or device. Items typed by users count only once they appear in at least 20 trips. In addition, the server counts per month how many notifications were sent and how many attachments were shared.
When you pass something on yourself
These places send content out — and each of them only when you tap it:
The share icon in the file preview hands the open file on.
“Directions” opens a map service with the location you entered for the activity. That location goes to the map service; their privacy policy applies there, not this one.
The website you entered for an activity opens in the browser when tapped. The external site thereby learns when you visit it and sees the IP address of your connection; for this Carry opens web addresses only and nothing else.
Delete
“Delete” hides things inside Carry: a deleted trip, a deleted expense, a deleted item disappears from all lists — the record itself stays in the database on your device. With an attachment, however, the file is really removed from the device.
Everything on the device is gone for good when you delete the app. Shared trips remain for the other members and on the server (see “Shared trips”).
Backups
If you back up your device — on the iPhone to iCloud or to a computer, on Android via the device backup —, Carry’s data is part of that backup. That is the backup of your device, not a feature of Carry.
Carry Plus
Apple handles the purchase in the App Store, Google via Google Play. Carry never gets to see your payment details; the app only asks the system whether the purchase exists.
“Restore purchases” may ask for your Apple or Google account. That is Apple’s or Google’s sign-in, not Carry’s — the app gets to see none of it, neither address nor password, only the answer at the end as to whether the purchase exists.
Controller and contact
Controller: Alexander Kampmeier, Adresse folgt.
Privacy questions: support@carryapp.de.