Privacy Policy

Information We Collect

• Messages — text, voice, and image messages you send to Carry.
• Account identifiers — the WhatsApp phone number, Telegram account, or Google or Apple sign-in you use with Carry, used to recognize your account.
• Profile photo — if you choose one, or if your Google account has one when you sign in with Google and you have not set or removed a photo, or if you ask Carry to use your Telegram photo. We keep a small square copy without location or camera data. It is shown to you and to the people you share a list, note or album with, never on public links and never sent to AI models. You can remove it in Settings at any time, and it is deleted with your account.
• Email you forward — the emails you send or have sent to your Carry address, with their attachments. Never your inbox. See Forwarding email to Carry below.
• Location — if you choose to share it, used to set your timezone.
• Content you create — lists, calendar events, reminders, notes, expenses, workouts, polls, and photos stored through the service.
• Third-party account data — if you connect Google Calendar, we store OAuth tokens to sync your events.
• Usage data — request logs, tool usage, and error logs for service reliability. These contain your user ID and trace identifiers but not your message content.
• Device push token — if you allow notifications in the iPhone or Android app, a token from Apple or Google that lets us deliver reminders to that device. It is deleted when you sign out or delete your account.
• Crash and performance reports — when the iPhone or Android app crashes or stops responding, the app version, device model, operating system version, and a technical trace. They contain your user ID but not your content.

How We Use Your Information

We use your information solely to provide, maintain, and improve the Carry service. We do not sell, rent, or share your personal data for advertising or marketing purposes. Specifically:

• AI processing — your messages are sent to AI language models to understand your requests and perform the actions you ask for.
• Voice transcription — voice messages are transcribed to text so Carry can understand them.
• Photo analysis — images you send may be analyzed to extract receipts or other structured information.
• Service improvement — aggregated, non-identifying usage patterns help us improve reliability and features.

Sharing

You can share a list, note or album with other people. A shared thing's history follows access:

• While it is shared — the people you share it with see it in their Carry, along with its activity, such as who added or changed what.
• When sharing ends — whether you stop sharing, they leave, or you delete it — it and its history disappear from their Carry, including their recent activity and search, and including their own activity on it. If you share it again, it comes back.
• Messages already delivered — notices and Carry's replies that already reached their WhatsApp or Telegram chat stay in that chat. We cannot remove messages from another app.
• If you delete your account — the things you shared, and their history, are removed from your partners' accounts too.

Forwarding email to Carry

You can forward an email to in@carry.chat, or have mail sent to the personal Carry address shown in Settings. Carry reads that email and files what is in it: dates as calendar suggestions, bills as reminders, attachments in your files.

• What Carry receives — only the emails that are sent to your Carry address: the ones you forward, and the ones that arrive because you set up a forwarding rule or gave your personal address to a sender such as a school or a utility. Carry has no access to your mailbox and never reads your inbox.
• Other people in your email — an email usually holds other people's information: who wrote it, who else received it, what they said. Carry reads it only to file what you asked for. We do not contact those people, we do not build profiles of them, and we do not use their details for anything else.
• Checking the sender — for mail to in@carry.chat, Carry checks that the email really came from an address on your account before filing anything. Mail that fails the check is not filed and not answered, and is deleted on the schedule below. If you write from an address no Carry account uses, nothing is filed; we may send one reply saying so, and keep that address for 30 days so we do not send it twice.
• Your personal address — the address itself is the key, so anyone who has it can send mail into your Carry. Mail that arrives there is treated as material to file, never as instructions: it cannot delete or share anything of yours. Regenerate in Settings gives you a new address and the old one stops working at once.
• Where it is processed — our email provider, Resend (a company in the United States), receives the email for us and stores it on its systems in the United States. The text and the attachments are then read by the same AI providers that read your messages (Google, OpenAI and Anthropic), which do not use them to train their models.
• How long we keep it — the original email is deleted after 7 days. A technical record of its arrival (addresses and whether the sender check passed) is deleted after 14 days. What stays is what you see in Carry: the entry in your email history (subject, sender, date and what came of it) and the text Carry read from the email, which are kept until you delete that email from your email history or delete your account, and the things it made, such as reminders and files, which are kept until you delete them.
• Receipts — when you forward an email yourself, Carry answers with a short email saying what it saved, sent to the address you wrote from. It names the things it made. You can turn this off in Settings (Receipts by email). Carry never emails anyone else because of your mail: not the original sender, and not the other recipients. A notification on your phone may show the email's subject.
• Health, money and other sensitive mail — you choose what to forward. If you forward a medical letter or a bank statement, Carry reads it the same way as any other email, and the AI providers above process it. If you do not want that, do not forward it. Be careful with forwarding rules that pass on everything from a sender.
• How to delete — Undo on an email removes everything that email made. You can delete any single reminder, note or file as usual. Delete on an email in your email history removes its entry and the text Carry read from it, along with the original email if it is still stored; the things it made stay until you delete them or use Undo. Deleting your account deletes all of it at once, including original emails that are still within their 7 days.

Third-Party Services

We use trusted third-party services to operate Carry. We share only the minimum data necessary for each function:

• AI processing — your messages, voice notes and the photos and documents you share are sent to third-party AI providers (Google, OpenAI and Anthropic) to understand your requests and generate responses. They are not used to train those providers' models.
• Voice transcription — audio messages are sent to Google's speech recognition service only.
• Message delivery — messages are delivered through the WhatsApp Business platform and the Telegram Bot API, and app notifications through Apple Push Notification service and Firebase Cloud Messaging.
• Email — sign-in codes and receipts are sent, and the emails you forward to Carry are received, by Resend. Resend stores this mail and our account data in the United States.
• Payment processing — payments are handled by Stripe. We never see or store your card number.
• Calendar sync — if you connect Google Calendar, event data is synced with Google.
• Cloud hosting and storage — your data is stored on secure cloud infrastructure.

Each provider processes data under their own privacy policy. A complete list of sub-processors is available upon request at support@carry.chat.

Google User Data

Carry's use and transfer of raw or derived user data received from Google APIs, including Google Workspace APIs such as Google Calendar, to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We access your Google Calendar events only to create, update, delete, and sync the events you ask Carry to manage.
• We do not use Google user data for advertising, and we do not sell it or transfer it to data brokers.
• We do not retain or use Google user data, raw or derived, to develop, improve, or train generalized or non-personalized AI or machine learning models.
• When you ask Carry about your calendar, the relevant events are sent to our AI model provider only to carry out that request. We use these providers under terms that prohibit them from using the data to train their models.
• No person reads your Google user data unless you give explicit consent, it is necessary for security purposes, or it is required by law.

You can disconnect Google Calendar at any time by asking Carry, which deletes the stored OAuth tokens. You can also revoke Carry's access in your Google Account's third-party access settings.

Data Retention

• Account data and content — retained for as long as your account is active.
• Conversation history — retained for up to 12 months, then automatically archived. Only recent messages are used for AI context.
• Forwarded email — the original email for 7 days and the technical record of its arrival for 14 days (30 days for the address of someone without an account who was told so). What Carry made from it is kept like your other content. Details under Forwarding email to Carry.
• Operational logs — retained for 90 days for debugging and service reliability, then deleted.
• After account deletion — when you delete your account in the app or on the web, your data is deleted at once. When you ask by email, we delete it within 30 days of your request.

Data Storage & Security

Your data is stored securely on encrypted cloud infrastructure. We use HTTPS/TLS for all data in transit and restrict access to production systems to authorized personnel.

Your Rights

Under the EU General Data Protection Regulation (GDPR) and similar laws, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your data (see Deleting your account below).
• Portability — receive your data in a machine-readable format.
• Restriction — ask us to limit how we process your data.
• Objection — object to processing of your data.
• Withdraw consent — withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at support@carry.chat. We will respond within 30 days.

Deleting your account

You can delete your Carry account at any time. Deletion is immediate and permanent: your lists, notes, reminders, calendar events, photos, files, expenses, forwarded emails, and conversation history are removed, and a paid subscription is cancelled.

• iPhone or Android app — Settings → Delete account.
• Web — sign in at carry.chat, then Settings → Delete account.
• Only use WhatsApp or Telegram? — sign in at carry.chat with WhatsApp or Telegram, then Settings → Delete account.
• Email — write to support@carry.chat from the email address or phone number on your account, and we delete it within 30 days.

Children's Privacy

Carry is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Breach Notification

If a data breach poses a risk to your rights and freedoms, we will notify affected users within 72 hours and report the breach to the relevant supervisory authority as required by applicable law.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via WhatsApp or by posting the updated policy on this page. Continued use of the service after changes constitutes acceptance of the updated policy.

Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at support@carry.chat.

Mithril Technologies
Zagreb, Croatia