Privacy Policy

Last updated · 11 September 2026

The short version: we collect only what Cara needs to work. What you share is seen by the partners and groups you choose and by nobody else. The free plan shows ads from Google, and you decide whether they can be personalised. Cara Plus has no ads. You can delete everything yourself, in the app, instantly.

1. Who we are

Cara is operated by Cara App Limited (“we”, “us”), a company registered in Northern Ireland (company number NI742229) and the data controller for your information. Contact: support@trycara.app. Our registered office is in section 11.

2. What we collect

Account. Email address, first name, username, password (stored as a hash by our authentication service) and an optional profile photo.
Your routines. Routine and task names, schedules, durations, completion history, the notes and photos you attach to a completed routine, and the goals you pick during onboarding.
Between people. Who you are partnered with, invites, nudges and cheers, comments, the groups you belong to, group messages, and any report or block you make.
Settings and device. Your timezone (so reminders arrive at the right local time), notification preferences, a push notification token for your device, your plan (free or Cara Plus) and its expiry, and whether you asked for news by email.
Focus (Cara Plus). The apps and categories you choose to lock are held on your device by Apple’s Screen Time framework. We never receive that list.
Advertising (free plan). Google’s Mobile Ads software collects a device identifier (the advertising identifier only if you allow tracking when iOS asks), which ads you saw and tapped, how you use the app, and crash and performance data. See section 4.
Website waitlist. If you join the waitlist on trycara.app, your email address. That’s all; if you invite a friend, you forward the link yourself and we never see their details.

We do not collect your contacts, your location or health data. A routine called “Morning run” is text you typed, and we do not infer anything from it.

3. How we use it

To run Cara: sync your routines, show your day to the partners and groups you choose, and deliver reminders, nudges and cheers.
To send the partner heads-up when a shared routine is missed, only if you have left that switch on (Settings → Notifications), and the evening and weekly summaries you can turn off in the same place.
To manage your plan: the free plan, the free trial and a Cara Plus subscription.
To show ads on the free plan.
To keep Cara safe: to look at anything that is reported and act on it.
To send you occasional news about Cara by email, only if you ticked the box when you created your account or turned it on in Settings. Turn it off there at any time, or with the link in any such email. Sign-in codes and messages from your partners are not marketing and arrive either way.
To respond when you contact support.
To run the waitlist: to invite you to test Cara and tell you when it launches. You can ask us to remove your address at any time by emailing support@trycara.app.

Legal bases under the UK GDPR and the Data Protection Act 2018 (and the EU GDPR where it applies to users in the EU): performing our contract with you (running the app), legitimate interests (service messages, security, moderation, and non-personalised ads on the free plan), and consent (notifications, personalised ads, news by email, and joining the testing waitlist).

4. Who sees your data

Your partners see your name, username and photo, the routines you share with them, whether you completed them, and the notes and photos on those completions. They can comment and cheer. A routine set to Everyone is shown to all your partners; one set to Partners only to the partners on that routine. Ending a partnership ends that visibility.
Your groups see your name and photo, the group’s routines and whether you kept them, what you post in the group, and the notes and photos on a group routine you have shared. Leaving a group ends that visibility.
Our moderators see something only when it is reported: the reported note, comment, message, photo or profile, and who reported it.
Service providers process data on our instructions: Hetzner (our servers in Germany, with encrypted backups in Finland), Resend (the sign-in codes we email you), Expo (push notification delivery), Apple (payments; we never see your card details) and Cloudflare (this website).
Google, on the free plan only, shows the ads and collects the data in section 2 for its own advertising purposes. If you say yes when iOS asks about tracking, and to Google’s own consent form where it applies, the ads are personalised. If you say no, Cara works exactly the same and the ads are not personalised. Google’s policy: policies.google.com/technologies/ads. Cara Plus shows no ads and sends Google nothing.
No one else. We do not sell data, and we use no analytics service beyond the ad measurement above.

5. How long we keep it

For as long as you have an account. Deleting your account (Settings → Delete account) immediately and permanently removes your profile, routines, completion history, notes, photos, partnerships, group memberships, nudges, comments, messages and push tokens. There is no soft-delete or retention window. Our encrypted nightly backups are kept for 30 days and then deleted, so a deleted account is gone from them within 30 days too. A report we have received is kept only for as long as we need it to act.

6. Your rights

Under UK data protection law (and EU law where it applies to you) you can:

Access and portability. Ask us for a copy of your data.
Rectification. Correct your name, username and photo in the app.
Erasure. Delete your account in the app, no request needed.
Object or restrict. Contact us about any processing you are unhappy with. You can withdraw consent to personalised ads at any time in iOS Settings → Privacy & Security → Tracking, or remove ads altogether with Cara Plus.
Complain. To the ICO (ico.org.uk) or your local supervisory authority.

7. Security

Data is encrypted in transit and backups are encrypted at rest. Access is controlled with row-level security, so each account can only read what it is entitled to, and completion photos are served only to the people allowed to see that routine. Passwords are hashed; we never see them.

8. International transfers

Your data is stored in the EU (Germany, with backups in Finland). Some providers process data outside the UK and EEA: Expo and Google in the United States, and Apple where it operates. Where they do, transfers are covered by the UK’s adequacy decisions, standard contractual clauses or equivalent safeguards.

9. Children

Cara isn’t directed at children under 13, and we don’t knowingly collect their data. If you believe a child under 13 has an account, contact us and we’ll remove it.

10. Changes

If we make material changes to this policy, we’ll notify you in the app or by email before they take effect.

11. Contact

Cara is operated by Cara App Limited (company number NI742229), registered office 32 Brandon Parade, Belfast, BT4 1JH. Contact us at support@trycara.app.