Privacy Policy

Last updated · 13 July 2026

The short version: we collect only what Cara needs to work, your data is shared with the partner you choose and no one else, we don’t run ads or sell data, and you can delete everything yourself, in the app, instantly.

1. Who we are

Cara is operated by [OPERATOR] (“we”, “us”), the data controller for your information. Contact: support@trycara.app.

2. What we collect

Account — email address, first name, username, password (stored as a hash by our authentication provider), and an optional profile photo.
Your routines — routine and task names, schedules, durations, completion history, and the goals you pick during onboarding.
Partnerships — who you’re partnered with, invites you create, nudges sent and received.
Settings & device — your timezone (so reminders arrive at the right local time), notification preferences, a push-notification token for your device, and your trial/subscription state.

We do not collect your contacts, location, health data, or advertising identifiers, and we don’t track you across other apps or sites.

3. How we use it

To run Cara: sync your routines, show your day to your chosen partner, deliver reminders and nudges.
To send the partner heads-up when a shared routine is missed — only if you’ve left that switch on (Settings → Notifications).
To manage your free trial and subscription.
To respond when you contact support.

Legal bases under UK/EU GDPR: performing our contract with you (running the app), legitimate interests (service messages, security), and consent (notifications — managed through your device settings and in-app switches).

4. Who sees your data

Your partner — sees your name, username, photo, shared routines and their completion status, and (if enabled) missed-routine alerts. Ending a partnership ends that visibility.
Service providers — Supabase (database, authentication and file hosting), Expo (push-notification delivery), and Apple (payments; we never see your card details). They process data on our instructions.
No one else. We don’t sell data, share it with advertisers, or use third-party analytics.

5. How long we keep it

For as long as you have an account. Deleting your account (Settings → Delete account) immediately and permanently removes your profile, routines, completion history, partnerships, nudges, invites and push tokens. There is no soft-delete or retention window.

6. Your rights

Under UK/EU data protection law you can:

Access & portability — ask us for a copy of your data;
Rectification — correct your name, username and photo in the app;
Erasure — delete your account in the app, no request needed;
Object or restrict — contact us about any processing you’re unhappy with;
Complain — to the ICO (ico.org.uk) or your local supervisory authority.

7. Security

Data is encrypted in transit, access is controlled with row-level security (each account can only read what it’s entitled to), and passwords are hashed — we never see them.

8. International transfers

Our providers may process data outside the UK/EEA. Where they do, transfers are covered by standard contractual clauses or equivalent safeguards.

9. Children

Cara isn’t directed at children under 13, and we don’t knowingly collect their data. If you believe a child under 13 has an account, contact us and we’ll remove it.

10. Changes

If we make material changes to this policy, we’ll notify you in the app or by email before they take effect.

11. Contact

support@trycara.app · [OPERATOR], [ADDRESS]