Privacy Policy

Last updated: 22 October 2026

Karot is a small app for two people who miss each other. You connect with someone by sharing a code. Either of you can tap to say you thought of the other; the tap lights their screen and their widget. A tap can carry one thing more — a drawing, a few words, a short recording, a photograph or one of Karot's signs, which then stays in the book the two of you share. You can send letters, typed or spoken, that arrive on a day you choose. Each of you sees the other's city, their local time, and, if they added it, the day and month of their birthday.

There is no feed, no advertising, no follower count, and Karot never shows anyone how many times they were thought of.

This page says exactly what Karot stores, who else sees it, and how long it lasts. Where something is uncomfortable, it is written down here rather than left out.

Karot is run by Davit Vardanyan, an individual. You can reach us at hello@karot.love. This policy is governed by the law of the Republic of Armenia.

The short version

• Karot has no sign-up. Your account is made quietly when you first save your profile. It never has a password, and it has no email address unless you choose to keep it with one.
• If you choose, you can keep your account with Apple, Google or an email address, so that a new phone can open it. Nothing asks for this when you first open Karot, and an account you never keep works exactly as before. If you keep it, we store the address and the sign-in you chose, and nothing else from it; the mail that carries your code is sent by Resend.
• An account you never kept cannot be recovered. If you delete the app without deleting your account first, the account stays on our servers and nobody — including us — can reach it again. A kept account can be opened again on another phone, which is also why deleting the app does not delete it.
• What we store: your chosen name, photo or mark, city and language, and the day and month of your birthday if you add it; your connections; every tap, with its time; what you leave with a tap — a drawing, a few words, a recording, a photograph or a sign — which is kept in the book you share with that person until you delete it as its sender, the connection ends or either of you deletes your account (either of you can hide it from your own book, and the other is never told; something sent from a version of Karot before 1.1 is still deleted about a day later unless you both keep it); your letters, their text and any recording; the day you set for seeing one of your people, with the few words beside it; your notification settings and your phone's push address; and the last time you had Karot open on your screen, which our server keeps to itself.
• Your profile photo sits at a public web address. Anyone who has the link can open it without an account. This is deliberate, and it is explained below.
• Notifications carry a person's name to Google (on Android) or Apple (on iPhone). They never carry the text of a letter or of anything left with a tap, a recording, a drawing or a photograph — only which kind of thing came with the tap, and an id for it. When it is a drawing, a sign or a photograph, your phone then fetches it from our server itself and shows it in the notification — on a locked phone too, if your phone shows notification contents there. Settings → Notifications → Pictures in notifications turns that off.
• If you buy Karot Plus or Karot Family, you pay Google Play or Apple, never us. We keep the store's record of the subscription against your account — never your card, your name or your address.
• We do not sell anything about you. There is no advertising and no crash-reporting service. There is anonymous counting — which screens are opened and which of the things the app can do are ever used, never what you write and never anything about the person you are connected to — and you can turn it off in Settings → About Karot.
• If you write to us from inside the app, what you wrote is kept against your account with no expiry, and nothing — including you — can read it back.
• The servers are in Frankfurt, Germany.

Your account: no sign-up, and a way to keep it

The first time you save your profile, the app asks our authentication service for an anonymous account (older versions of the app asked the first time Karot opened). It sends an empty request: no email address, no phone number, no password, no name. What comes back is a random account id (a uuid) and a token, which the app keeps on your phone.

Until you keep your account, that token is the whole of it. There is nothing else to prove ownership with.

“Anonymous” here means you never have to sign in. It does not mean we do not know who you are: the name you choose, your photo, your city, your coordinates, your time zone, your language and, if you add it, your birthday are all stored against that same account id, and the id itself is given to each person you connect with.

Three consequences for an account you have not kept, all of them real:

• Deleting the app is not deleting your account. Nothing on our side expires an inactive account. Your profile, connections and letters stay in the database, and the other person keeps seeing you. If you want to leave, delete the account from inside the app first (Settings → About Karot → Delete account), then uninstall. This is true of a kept account too — and a kept one can still be opened again, on any phone.
• We cannot restore an account you have not kept. There is no email or phone number to match you to a row, and no way to check that a row is yours.
• The app can lose an account by itself. If the authentication service refuses the stored token as already used, it revokes the whole session, and because the session is the account, the app quietly starts a new one. When that happens the old account's token is kept on your phone under a separate key, indefinitely, so that in principle we could still reach that account with your help. Nothing in the app reads it back today. If this happens to you, write to us before uninstalling. A kept account is never lost this way: the phone is signed out instead, and continuing the way you kept it opens it again.

Our authentication service keeps records of its own. It counts anonymous sign-ins per IP address per hour, to stop abuse. For each phone your account is open on, it keeps the IP address and the user-agent string from which that phone last renewed its session — replaced at each renewal, and deleted when that session ends or your account is deleted. And it keeps an audit log in our own database: each sign-up, sign-in, renewal of a session and sign-out, and each change to the account, with its time, your account id and the IP address it came from — for a kept account also its address, and at a sign-in with Google the name Google sent. That log is deleted after thirty days, whoever it names; deleting your account does not remove your entries any sooner. We will not tell you we never see your IP address, because that would not be true.

Keeping your account for a new phone

You can choose to keep your account, so that a new phone can open it, with your people, your days and your letters. It is optional and free, and nothing asks for it when you first open Karot. A few days after you connect with somebody, Karot offers it once, on Home; it is also in Settings, as the last row under “Your people”, once you have somebody to keep. Keeping adds one way of signing in to the account you already have: the account id stays the same, and nothing is copied or moved.

There are three ways, and the app shows only those that are switched on: Sign in with Apple (on iPhone), Google (on iPhone and Android), or an email address, confirmed with an eight-digit code we send to it, which works for ten minutes. There is no password, and none can ever be set: our server refuses one outright. Later, on that same row — which then says how your account is kept, “Kept with Apple” for example — you can add another way, or change the address.

What is stored when you keep your account, by our authentication service, against your account id:

• With an email address: the address, and when it was confirmed. While a code is waiting, the address it went to and a one-way hash of the code are stored with it. If you ask for a code and never type it, the address stays recorded as unconfirmed — it opens nothing — until you confirm it, try another address, or delete the account.
• With Apple: the identifier Apple gives us for your Apple Account (other developers are given a different one), and the email address Apple passes on — your own, or, if you chose to hide it, a relay address at privaterelay.appleid.com that Apple forwards to you. Karot asks Apple for the email address only, never your name. We also keep a token Apple issues to Karot for your account, so that deleting your account can tell Apple (see “Deleting your account”).
• With Google: the identifier Google gives your Google account, its email address, and whether Google has verified it. A Google sign-in also carries your name and profile picture — on iPhone, Google's page says that Karot will see them. Our server removes both before they are stored with your account; the name can still be in the audit log (above) for its thirty days, and in the phone's sign-in for up to an hour (see “What Karot keeps on your phone”).
• Whichever way: which ways your account is kept with, when it was last signed in to, and the language your app is in, so that the mail with your code is written in it. The language is stored when you ask for a code or keep your account, and again whenever you change it while your account is kept.

Nobody you are connected to sees how you kept your account, or whether you did. Use your own Apple Account, Google account or address: whoever controls it can open your Karot.

Whether an address keeps a Karot can be found out. Typed into “I already use Karot”, an address that keeps nothing is answered “Nothing is kept with this address”, and one that keeps a Karot is sent a code to open it; keeping a Karot with an address that already keeps another says that the address cannot keep this one. So anyone who types your address into Karot can learn that it keeps a Karot — but not whom it holds, or anything in it. Every code that can open an account by email is mailed to that account's own address, so an attempt to open yours arrives in your inbox, and nothing opens without the code.

More than one phone. Any phone where you continue the way you kept your account opens your Karot and is told when your people think of you. A kept account stays signed in on each phone until you sign it out. In Settings, on the row under “Your people” that says how your account is kept, Sign out of this phone removes this phone's push address and widget key from our server first, then ends its sign-in; Sign out other phones does the same for every other phone at once — a phone you lost, for example. One gap we would rather state: a phone signed out that way keeps the access it already had for up to an hour. If Karot is opened on it within that hour, it registers itself again; it is signed out when it next renews its sign-in, but that registration can go on receiving your notifications until our clean-up removes installs that have been silent for 180 days. If that may have happened, choose Sign out other phones once more.

A kept account is never swapped for a new one behind your back. When a phone's sign-in ends — you signed it out, another phone signed it out, or the account was deleted — that phone shows nobody, its widget goes dark, and it offers to continue the way you kept the account. Nothing is deleted by it.

What Karot stores about you

Your profile

• The name you chose. Between 1 and 40 characters. It is what your people see if they have not given you a name of their own.
• Your photo, if you add one. The file, and the path to it.
• Your mark, if you chose one in Settings instead of a photo: which of six small night scenes it is (a cup, a house, a tree, a lamp, a kite or a bird). With neither, your initials are drawn in its place.
• Your city — its id in our list, its display name, its country code, its time zone, and that city's coordinates.
• Your birthday, if you add it in Settings: the month and the day, never the year. Setup never asks for it, and Settings can remove it. On the day, each person you are connected to is told about it in their own morning — unless they have paused you — and a small cake sits beside your name on their phone. There is no switch for that reminder other than not giving the date.
• Your language, one of the seventeen Karot ships in.
• When the profile was created and last changed.
• The last time you had Karot open on your screen, to within about two minutes. No app can read it — not theirs, and not yours; it is explained below, because of everything on this list it is the one that could say when you are awake.
• When your time zone last changed. It is kept only so that a zone set in the last day does not count towards “You are both up” (below). No app can read it.

Karot never asks for your location and contains no location code at all, on either phone. It cannot know where you are. Your city is one of a list of 627 that ships inside the app, and the app sends that city's own centre coordinates — the same numbers for everyone who picks that city. The app sends that city's time zone with it. Our server does not check the one against the other: it accepts whatever time zone the app sends.

What the app does read is your phone's time-zone setting — not where the phone is, only what its clock is set to, which needs no permission. It uses it to suggest your city, and it also follows it: when that setting changes, say after a flight, the next time you open Karot it moves your city to one in the new zone by itself, and your people see the new city and the new hour. It does this only when the zone changes (a city you corrected within the same zone is left alone), and never when the new zone has no city in the list. So a trip across time zones is something your people will see.

The last time you had Karot open. Karot keeps one time for this, overwritten each time and never kept as a history, and written at most once every two minutes — and only while Karot is open on your screen. It exists for one line only: “You are both up”. While you are looking at Karot, the page of someone you are connected to shows that line when the two of you live in different time zones, each of you has kept the same time zone for at least a day, it is between midnight and five in the morning for one of you, both of you have had Karot open on your screen in this quarter of an hour or the one before it, and they have not marked themselves asleep. Our server works that out and sends each app a yes or a no. The time itself is never sent to anybody, and the line is never a notification.

But a yes or a no that changes is information too, and we would rather say what it gives away. During the hours when that line can appear, someone you are connected to who keeps Karot open and keeps looking can tell when you opened Karot, and roughly when you stopped — to the quarter of an hour, because the line only ever turns off as a quarter of the clock begins (on the hour, a quarter past, half past or a quarter to), never at the minute you put your phone down. Someone could also choose a city where it is night for them to see this during your day; a time zone only counts once it has been theirs for a day, so they could move that window at most once a day.

Only Karot open on your screen counts. The app also refreshes by itself — when a notification reaches your phone, when it makes a notification's picture, and, on Android, about every fifteen minutes while a Karot widget is on your home screen — and the widget and the iPhone's notification extension fetch from our server on their own (a watch only gets your phone's copy); none of those touches this time, so none of them can make you look awake. A version of Karot from before this rule never writes it at all, so for someone who has not updated, the line does not appear. The time is read by our server's own functions and by nothing else: not by the people you are connected to, and not by your own app.

Your settings

Your quiet hours (the window when alerts are held rather than rung) and whether you want the morning reminder when you have not thought of someone for five days (on unless you turn it off). We only create this row once you change one of them or send yourself a test notification; before that, the server simply applies a default window of 22:00 to 07:00 without storing anything. Note that the row is created whole, so turning the reminder off also records a 22:00–07:00 quiet window you did not choose. It still has a place for simple mode, a setting older versions of the app had; the current app never sets it.

The row also holds the time you last asked for a test notification, which is how we limit that to one every fifteen seconds.

Two small records sit beside it, so that a reminder is never sent twice. For the quiet-heart reminder, one row per person: when you were last reminded, and about which connection — overwritten each time, never more than once a week, and kept until your account is deleted. For birthdays, a note of who was reminded about whom on which day, deleted about a week later.

Quiet hours are read in your city's time zone, so together they are a fairly direct statement of when you sleep. Nobody else can read them — not even the person you are connected to — but we hold them and act on them, because the server is what decides when a phone rings.

Your connections

When two people connect, we store one row: an id, the two account ids (the inviter first, the person who accepted second), when it began, and, if it ends, when it ended.

Alongside it, each of you has a private row about the other: the name you gave them, the light colour you chose, and two flags — paused, hidden from recaps — plus the order they appear in. The other person can never read their half of this, at any time. That is the point of a silent pause.

Invites

An invite is an eight-character code, who made it, and the name that person gives the person they are inviting (“Emma”). Once someone uses it, the row also records who accepted, when, and which connection it became. (Karot used to ask, as well, which of ten relations — “Mom”, “Brother”, “Friend” … — somebody is to you. It no longer asks, keeps none, and has erased the ones chosen before.)

Two honest notes. That name is written about a person before that person has an account; whoever holds the unused code is shown it — together with the inviter's name, photo or mark — before deciding whether to accept, and on acceptance it becomes the inviter's private name for them. And the code is a bearer token: anyone holding an unexpired, unused code can pair with whoever made it. Only the person who made the invite can read the row itself.

We also keep a count of wrong codes — your account id and a timestamp, nothing else — so that ten wrong codes in an hour or thirty in a day stop every further attempt. Without that, a script could guess its way into a stranger's family. Those rows sit in a part of the database with no read access for anyone: not the app, not your partner, not our own server functions. They are deleted after a day.

Taps

Every tap is a row: who sent it, on which connection, the exact moment it reached us, whether it was a good morning, a good night or a birthday wish, and — this is the part worth being plain about — the sender's own local date and wall-clock time when they tapped, kept in the zone they were in then and never rewritten if they later move city.

Over months that is a fine-grained record of when you get up and when you go to bed, and the labels name those moments outright. Read together with the exact timestamp, it also shows which time zone you were in on each day, so a year of history is also a record of when you travelled. All of it is shown to exactly one person: the one you connected with.

A few smaller truths: a bare tap within two seconds of your last one is merged into it, and a later evening tap takes the “good night” label off an earlier one. When two taps cross — each sent before the other could arrive — the two rows are linked, and both of you are shown that you thought of each other at the same moment. And there is a brake: more than sixty taps and moments to one person within ten minutes are refused.

About counting. Karot shows no tally anywhere. No screen totals your taps, no screen ranks who cared more, and the history the app receives contains booleans, labels and times rather than sums. But the server keeps every individual tap with its timestamp, and sends each one to the app, so the list can be counted by hand. The true sentence is: we never show you a count, and we never rank anyone by one — not that the taps are not there. There is one exception, described under notifications.

This paragraph is about tallies of taps, shown to you or to the other person. It is a different thing from the anonymous counting of how the app is used, which is described under “Google Analytics for Firebase, for counting” below. Neither one counts the other.

What you leave with a tap

A tap can carry one thing more — Karot calls it a moment. It is a row of its own, tied to that tap: who left it, on which connection, when, and what kind it is, with its contents:

• A few words: the text, up to 280 characters.
• A drawing: the lines as points on a grid, the light colour of each line, the shape of the paper, and the rhythm of your hand — how long each line took and the pause before it — so that it can draw itself again, stroke by stroke, the first time they open it.
• Your voice: a recording of up to sixty seconds, and its length.
• A photograph: the picture, as the app sends it — a JPEG no wider or taller than 1,024 pixels — and which of the four looks you chose for it.
• A sign: which of Karot's twelve it was, by name. Its words are drawn on the reader's phone, in the reader's language.
• A birthday card, left with a birthday wish: which of Karot's cards it is, and the few words and the recording you put in it, if any.

Recordings and photographs sit in private storage, described below with the photos. Also stored: when the person you left it for first opened it — their app uses it to stop showing it as new, and our server never sends it to you — and, for each of you, whether you hid it from your own book, and when.

What you leave each other is kept. A moment sent from version 1.1 of the app or later is kept from the moment it is sent, with no expiry, in the book the two of you share — the same moment, on both phones — until whoever sent it deletes it, the connection ends, or either of you deletes your account. For a day it is also in the thread between you, with the newest things you have left each other; something of theirs you have not opened stays there for up to three days. Leaving the thread deletes nothing: it is still in your book. A newer moment never replaces an older one. A moment sent to several of your people at once is a moment of its own for each of them, exactly as if it had been sent to each alone; its recording or photograph is stored once, and stays for as long as any of their moments still points at it.

From an older version, a moment still lasts a day. A moment sent from a version of Karot before 1.1 keeps the promise that version made: twenty-four hours after it was sent nobody can open it any more, and our hourly clean-up deletes it within the hour after that; its recording or photograph goes about ten minutes later. It stays only if both of you asked to keep it, which only a version before 1.1 can ask: either of you can, the other can see that you asked — not when — and until both of you have, you can withdraw your own vote. So between a phone on 1.1 and one on an older version, what the older one sends can no longer be kept by both, and it fades. A moment left with a birthday wish, and every birthday card, is kept from the start, whichever version sent it. Nothing that already faded comes back, and a moment sent from 1.1 to someone who has not updated yet reaches them already kept.

Hiding. Either of you can hide any moment — one you sent or one you received — from your own book. It then leaves your book, your thread, your Home and your widget, and your “On this day” and “Their voices”. It is not deleted: the other person keeps it exactly as before, is never told, and nothing they can see changes. We store that you hid it, and when, where no app can read it but yours, and yours only as the list of what you hid (“Hidden from your book”, at the back of the book), from which you can put it back. Hiding takes a moment off your shelves; it does not lock it — your own app can still open it and fetch its recording or photograph if asked to. On a version before 1.1, the person whose birthday it was can still let a birthday wish or a card go, which deletes it for both of you; from 1.1 they hide it instead.

Deleting. Whoever sent a moment can delete it, whatever its age and whatever its kind — a birthday card too. It is deleted for both of you at once, from our database and so from both books, both threads and both Homes; the other person is not told, and sees no trace of it. Its recording or photograph is queued for removal at once and is gone within about ten minutes, unless the same file still belongs to a moment you sent to someone else at the same time. The tap it came with stays: the day still shows that you thought of them. The person you sent it to cannot delete it: they can hide it, or end the connection, which deletes everything between you (see “When a connection ends”). The one exception is a version before 1.1, on which the person whose birthday it was can still let a birthday wish or a card go, and that deletes it for both of you — from your book too.

Things about moments we would rather state than have you discover:

• Kept lasts as long as the connection. Ending the connection deletes every moment between you — your whole book together, birthday cards and wishes too — for both of you, and so does either of you deleting your account. For the person who received a recording or a photograph, that is the only way to take it off our servers: hiding leaves it there. Its file goes with it, unless its sender also sent it to someone else at the same time: then the file stays for as long as that other person’s moment does.
• A delete cannot reach a copy that has left. A drawing or a photograph the other person saved to their photos or shared, a notification already showing it, the copy on their widget until it next refreshes, and a signed link already issued — which works until its hour is up or the file is gone, whichever comes first — are beyond it.
• A moment can be on show. The newest thing someone left you appears on your home-screen widget while it is in your thread, marked with a small dot until you open it — for up to three days while it waits: a small picture of a drawing, a photograph or a sign, the first words of a note, the length of a recording, with the edge of another card behind it when there is more than one. Put the widget where you are comfortable.
• A moment can show in its notification. When what someone leaves you is a drawing, a sign or a photograph, the notification that announces it shows it: expand the notification and a drawing draws itself again and a sign plays, while the banner and the Lock Screen show the finished picture; a photograph shows in its look. A note and a recording stay words. The notification itself carries only which moment it is; your phone fetches the picture from our server when it arrives (see “Google and Apple, for notifications”), and fetching it is not opening it — it is never reported to anyone. Whether it shows on a locked phone is your phone's own setting: Android shows notification contents on the Lock Screen unless the phone is set to hide sensitive content; an iPhone shows them once it has recognised you, unless Show Previews says otherwise. What you leave someone shows on their phone by their settings, not yours. A tap that does not ring — quiet hours, sleep, a pause — has no picture, and neither does any notification other than a tap's. Settings → Notifications → Pictures in notifications turns it off; it is on until you do.
• A copy can leave Karot. Either of you can save a drawing or a photograph to your phone's photos, or share it to another app. Nobody is told, and that copy is beyond anything hiding, deleting, unpairing or deleting an account can reach.

Your status

If you mark yourself sleeping or free, we keep one row: which of the two, when you set it, when it runs out, and when “free” last notified your people (so that switching it off and on cannot ring them repeatedly).

There is only ever one such row per person — a new status overwrites the old one — so there is no history of statuses you have set. Turning your status off does not delete the row; it only marks it as already run out, and it is deleted about a day later. The people you are connected to can read it only while it is live: once it has run out or you have turned it off, only your own app can. So if their app happens to be open and refreshing at the moment you switch “sleeping” off, it sees the status go; afterwards, nothing lets it look up when that was. When “free” last rang your people is not readable by any app, yours included.

“Sleeping” never notifies anyone; it tells our server to hold alerts back from you, the same way quiet hours do. “Free” is the one that rings your people, at most once every thirty minutes.

Letters

A letter is its text (up to 5,000 characters), or a recording (up to three minutes), or both; the day you chose for it; the exact moment it is due, which is 09:00 in the recipient's time zone; the moment it actually landed; the moment it was opened; the moment it was cancelled, if it was; and when it was written. We also keep, server-side only, a note of whether the arrival notification was sent.

A letter can instead be one to open when the time comes (“Open when…”). Then we also keep which moment it is for — one of Karot's own by name, such as “when you miss me”, or a few words of your own, up to 60 characters — which the reader sees on the sealed envelope, and which the notification of its arrival never names. It reaches them the next morning at 09:00 their time and waits, sealed, until they choose to open it; opening it tells the writer, as for every letter.

If you choose to let them know a letter is on its way, the server also picks a number from one to three, at random, which is never shown to anyone: on that many mornings before the day, from nine in their time, their app is told that a letter from you is coming — never the day, and never what is in it.

If the recipient's city changes before a letter arrives, the letter is re-timed: it keeps the calendar day the sender chose and is re-anchored to 09:00 in the new zone. A letter someone else wrote can therefore arrive at a different moment because you moved.

Three things about letters that we would rather state than have you discover:

• Opening a letter tells the sender. There is no way to turn this off, and it is not an oversight. On the server, reading a letter and opening it are the same act: the text and the recording are released only by the action that stamps the receipt. The app never shows a sender “not opened yet”, but the moment you open a letter the time is recorded and sent to them.
• Cancelling a letter does not delete it. Taking a letter back means the recipient will never see it, and it removes the recording. The text stays in the database, and you still see it in your own sent list. Cancelling is only possible before the letter arrives.
• A delivered voice letter cannot be taken back at all. You cannot cancel it, you cannot delete the recording, you cannot overwrite it, and unpairing does not remove it. The person who received it keeps it for as long as both accounts exist.

The day you will see each other

Either of two connected people can set the day they will see each other (“Until we meet”). We keep one row for the two of you: the date, the few words written beside it if any (up to 40 characters), who set it and when. Both of you see it, in the app and on your widgets, until the day has passed. Either of you can remove it at any time; otherwise it is deleted a couple of days after the day, and no later than the night after the connection ends or either of you deletes your account. It is never sent in a notification.

Your devices

For each install: which platform it is, the app version, its language, when the app last registered it with our server, when a notification was last sent to it, when its widget — or, on iPhone, its notification extension — last fetched from our server, and the address your phone can be reached at for notifications — a Firebase registration token on Android, or the raw APNs device token on iPhone, plus a second token for the iOS 26 home-screen widget.

We also store a keyed hash of the widget's own credential (never the credential itself, which is shown once and kept on your phone). No app client can read that hash, not even yours.

At most ten installs are kept per account; an eleventh registration drops the least recently used one. If Google or Apple tells us an address is dead while sending to it, we clear that address at once. Nothing checks an address in advance, so a dead one is forgotten on the next notification sent to it, not the moment it dies. Signing a phone out of a kept account removes its install from our server first (see “More than one phone”).

One awkward mechanic: a push address identifies a device, not a person. When your phone registers its address, the server clears that same address from any other device row holding it — including a row belonging to a different Karot account on the same phone. Nothing about that pairing is stored, but the comparison does cross account boundaries, so we cannot claim that two accounts on one phone are invisible to us.

Your plan

Which plan you are on — free, Karot Plus or Karot Family — when it runs out, and where it came from: a store, a place in somebody's Karot Family, or a plan we gave by hand.

If you buy a plan, you buy it in Google Play or the App Store, and our server keeps a record of the subscription: which store, whether it was a test purchase, the store's own id for it (Google Play's purchase token, Apple's original transaction id), the plan billed now and any change set for its next renewal, whether it is active, when it renews or ends, whether it will renew, and the account id the purchase carried; every change our server found in it, with the store's own answer as it arrived — which includes the price and the country of the store you bought in, but not your answers to Google Play's question about why you cancelled, which our server drops before it keeps the rest; and every Karot account that has owned it, from when, how it came to each (bought on it, first reported from its phone, restored to it or handed back to it), and what told our server (the app, the store's own notification or our daily check). No card number, name, email or postal address: the stores never pass them to us. How the store and our server talk about it is under “What leaves Karot”.

Karot Family is shared by its buyer's choice, one person at a time. Whoever holds Karot Family chooses up to five of the people they are connected to, to share it with; being connected to them gives nothing by itself. If you give places, we keep who you gave each one to, whether you chose them or an invitation carried the place, when, and when and how it ended — you stopped sharing, they left, or one of you ended the connection — for as long as the place lasts and, once it has ended, until a year has passed since you gave it: a place given in the last 30 days, and every person given one in the last year, still count towards the places your Family can give. If you let an invitation carry a place, the invitation notes it until it is used or runs out. A place given in a Karot Family bought in a store is also noted against that subscription — who was given it, and when, but not by whom — for a year from the day it was given, so that the places one subscription can give do not start again when it moves to another account; that note stays with the subscription even if its buyer deletes their account.

If somebody gives you a place, your app is told who shares their plan with you, by the name you have given them, and the date their plan runs out — not how they paid, and not who else they share it with. Whoever gives you a place is told nothing about you but what they already see: not whether you pay for a plan of your own, and not whether somebody else has given you a place too.

What you write to us

Settings → “Tell us what you think” sends one message to us. We keep what you wrote, which of the three kinds you chose (an idea, something's wrong, something else), your account id, and three facts about the phone — which platform, which version of the app, which language — because a report without them cannot be acted on. The screen says so in words before anything is sent.

Three things about it we would rather state than have you discover:

• It is a box, not a conversation. Nothing can read it back — not the screen, not any signed-in app, and not you, the person who wrote it. We read it where we keep it, and we cannot answer you inside the app.
• It has no expiry. Almost everything else with a schedule is on this page under “How long things last”; this is not. What you write stays against your account id until you delete your account, and goes with everything else when you do.
• It carries nobody else — no connection, no name, no tap, no letter. But it cannot take somebody's name out of a sentence you typed, so please do not put one in.

Five messages a day, and between 4 and 2,000 characters.

What the other person can see

While a connection is active, the person you are connected to can see:

• your display name, your photo or mark, your city and country, your time zone and local time, your city's coordinates;
• the day and month of your birthday, if you added it;
• every tap between you, in both directions, with its time, its local time and its label, and when two of them crossed;
• everything you leave with a tap, kept in your book together — less anything you deleted, and anything sent from a version before 1.1 that faded — and, on a version before 1.1, whether you asked to keep something (not when);
• “You are both up”, while it is true: a yes or a no, never a time;
• your current status, live;
• the letters you sent them (their text and recording once they open them), with the times they were written, due, delivered and opened;
• the times they opened your letters — and you see when they opened yours;
• if you give them a place in your Karot Family, that you share it with them, and when your plan runs out.

They cannot see: your quiet hours, whether you are inside them right now, your settings, your devices or push addresses, the name you gave them, your light colour, or whether you have paused them or hidden them from recaps. Those are yours alone, and they stay hidden from the other person permanently. Nor are they ever sent your language, when your profile was created or last changed, the last time you had Karot open, when you opened what they left you, what you hid from your own book, or which plan you are on — unless you share your Karot Family with them. Nor whether you kept your account, how, or with which address.

One exception worth knowing: pausing someone hides their alerts from you, but it does not hide your status from them. Only ending the connection does that.

What leaves Karot

Three companies receive something from us, and one of them, Resend, only for an account that is kept. Nothing else does — Supabase, which runs the servers everything already sits on, is described further down rather than here. Google is named in five of the six sections below, because it receives five unrelated things through unrelated pieces of its software. The first five sections are things our server or the website hands over, or that happen in Apple's or Google's own sign-in or purchase window; the last is the only one the app on your phone sends by itself, and the only thing on this page you can switch off.

Google and Apple, for notifications

To make a phone ring, we hand the notification to Google's Firebase Cloud Messaging (Android) or Apple's push service (iPhone). What we send them is:

• the device's push address;
• the name shown for the sender — which is the name you gave that person if you gave them one, otherwise the name they gave themselves;
• the ready-made sentence, in your phone's language: “Mom just thought of you”, “Good night from Nina”, “A letter from Mom has arrived”, “Mom thought of you 3 times while you slept”, “Mom has a birthday today”, “Happy birthday from Mom”, “Mom has not seen your light in a while”, “You and Mom thought of each other at the same moment”;
• when the two of you live in different time zones and nothing came with the tap, the sender's local time, and in most languages their city: “It's 9:40 PM in Dubai.”;
• when something came with the tap, which kind it was, in words — “A drawing came with it.”, “A few words came with it.”, “A sign came with it.” — and never the thing itself;
• when something came with the tap, that kind again as a field of its own, and the id of that moment, so that your phone can fetch it itself; on the morning’s line about taps held while you slept, the id of the first thing they left you that you have not opened yet, so that pressing it opens that thing; and, for the device check's test notification, a flag telling the phone to draw the heart the app carries;
• the id of your connection with that person, the id and exact time of the tap or letter, and, for a morning, night or birthday tap, which of those it was, and when two taps crossed, the id of the other.

The name travels twice: once inside the sentence, and once as a field of its own. It is in clear text.

So a push provider can see that a tap or a letter reached you, from whom, at what second, and under what name you keep that person — even though our own server is in the EU. The connection id is stable, so over time they could see which two accounts push to each other and how often. That is a relationship, without content.

We never send the text of a letter or its recording, and never what was left with a tap — not a note's words, not which sign, not a drawing, a photograph or a recording. When a drawing, a sign or a photograph came with a tap, the notification names it only by its id, and your phone fetches the picture from our server itself — on Android through your signed-in app, on iPhone through the widget's key (see “What Karot keeps on your phone”), and a photograph through a signed link that expires after an hour — so the picture never passes through Google or Apple. The letter notification says only that a letter from a given person has arrived. The test notification from the device-check screen carries no name at all.

Silenced taps still travel. When a tap must not ring — because you are in quiet hours, marked asleep, or have paused that person — we still send your phone a silent message so the widget can catch up. It carries no name and no sentence, but it does carry the connection id, the tap's id, its time and its label, and, when something came with it, which kind and that moment's id. The provider learns that a tap happened even when you chose not to be told.

We ask Google and Apple to hold an undelivered message and then drop it: four hours for a tap, twelve hours for a summary of taps held overnight or for a birthday or quiet-heart reminder, two days for a letter, five minutes for a test, and for “free now” only as long as that window lasts. The iOS silent refresh is sent with “deliver now or never”. What those companies log about having handled a message is theirs, not ours, and we have no copy: there is no delivery log anywhere in our database.

On Android there is one more thing, which is Google's code rather than ours: the Firebase library registers your install with Google and reports its own delivery telemetry to Google, independently of anything Karot asks for. It starts doing this when the app process starts, before you have connected to anyone. On iPhone, notifications go straight to Apple and no Google library takes any part in them — but a Google library is in the iPhone app: the measurement one described below.

Apple and Google, if you keep your account with them

Only if you keep your account with Apple or Google, or open it with one of them on another phone. Signing in happens in Apple's or Google's own window — Apple's sheet on iPhone; Google's own sheet on Android, and Google's page in the phone's browser on iPhone and on Android phones without Google Play services — so that company sees that you are signing in to Karot, as it does for any app. Karot sends them nothing about you: not your name in Karot, not your people, nothing you wrote. Our servers then talk to them for two things:

• Apple. Right after you keep or open your account with Apple, your phone passes our server a one-time code Apple gave it, and our server exchanges it with Apple for a token. That token is kept for one purpose: when your account is deleted, our server sends it back to Apple to revoke it, which removes Karot from your Apple Account's apps that use Sign in with Apple. If Apple hides your address, our mail to you (the codes) passes through Apple's relay, which forwards it.
• Google. When Google's page is used, our authentication service exchanges the one-time code Google returns for your sign-in, with our own key, and Google answers with your sign-in (the identifier, the address, and the name and picture described above). On Android, Google's own sheet hands your phone that sign-in directly.

Resend, for the mail with your code

Only for an account that is kept, or is being kept. Every mail our authentication service sends — a code to keep your account with an address, to open it on a phone or to change its address, and the rare notice that carries no code — goes to that address through Resend, which delivers it. Resend receives the address, the subject line (for a code, the eight-digit code itself) and the mail: a few lines in your language, and nothing to click. Nothing else about you, and nothing about the people you are connected to. The mail comes from no-reply@karot.love, where nobody reads replies; the address to write to is at the end of this page.

Resend works for us as a service provider and receives nothing for its own purposes. The mail is sent from Resend's region in Ireland, but Resend stores what it keeps in the United States: each mail — to whom, its subject line, its words and whether it was delivered — for thirty days, after which it is deleted.

Google Play and Apple, for your plan

Only if you buy Karot Plus or Karot Family. You buy it in Google Play's or Apple's own purchase window, and you pay Google or Apple, never us: we never see your card, your name, your email or your address, and nothing about how you paid. Google and Apple keep their own record of the purchase, under their own privacy policies — it is your dealing with the store, as it is for any app you pay for.

What Karot adds to the purchase is your account's random id, as the store's own account token (Google Play's “obfuscated account id”, Apple's “app account token”), so that the store's record says which Karot account the subscription is for. Our server then asks the store's own server — Google's Play Developer API, Apple's App Store Server API — about that purchase: whether it is active, which plan, and when it renews or ends. It asks again whenever the store notifies us that one of our subscriptions changed (Google's notices come through its Cloud Pub/Sub service, Apple's straight to our server), and now and then on its own, to catch what a notice missed. It confirms each Google Play purchase back to Google, and if a subscription moves to another of your accounts — a restore after reinstalling, or a plan handed back — it tells Apple the new account id. No billing service and no other company stands between Karot and the store.

Firebase Hosting, for the website

karot.love is static files served by Google. The site sets no cookies, loads no fonts, runs no analytics and makes no third-party requests of any kind.

Invite links are of the form https://karot.love/j/CODE. The code is in the address, so Google's hosting logs record it, along with the IP address and browser of anyone who opens an invite link in a browser, on Google's retention schedule. The code is a bearer credential, so its presence in a log is a real exposure. It is narrowed rather than removed: eight characters from a 31-character alphabet, single use, expiring seven days after it is made, with wrong guesses limited. We ask browsers not to pass the address on as a referrer and not to index those pages.

The link also travels through whatever messenger you use to share it.

Google Analytics for Firebase, for counting

The app counts what people do with it, so that we can tell which parts of it are used and which are not. It runs on both Android and iPhone, and the events go from your phone straight to Google — our own server never sees them. It is the only thing on this page you can switch off: Settings → About Karot, directly under the list of things Karot promises never to do.

What is sent is a closed list, and it is the shape of the code that keeps it closed rather than a promise: every event is one of a fixed set of names the app itself holds, and its only details are values chosen from fixed sets. There is no field anywhere in it that takes something you typed.

• Which screen you are looking at, by one of twenty-six names the app publishes for its own screens — home, letters, settings_about. Not the letter, not the person, not the address of the screen.
• That something was done, by name: a tap was sent (and whether from the app, a widget or a watch), a letter was sent or opened, a moment was sent, opened or kept, an invite was made, two people paired (by code or by scanning), a calling app was opened (which one), an avatar mark was chosen (which), setup was finished, the screen of the paid plans was shown, a plan was bought, a message was sent to us (which of the three kinds), a language was chosen (which). And about keeping an account: that the offer to keep it was shown, and which of its two answers was chosen; which way — Apple, Google or email, never the address — an account was kept, opened or started with, or found nothing; that a phone moved to a kept account, or kept its own instead; and that a phone was signed out, or signed the other phones out.
• How many people you are connected to, as a range — “0”, “1”, “2”, “3–5”, “6 or more”. A range and never the number, so that it cannot pick out a household.
• What Google's library adds by itself: an app-instance id that it generates and keeps on your phone, and the standard fields it reports with every event — your device model, its operating system version, the app version, the language and the country.

What is never sent: your account id, your name or anybody's name, your city, your photo, a letter, a note, a drawing, a recording, a connection id, a phone number, an email address or anything from a sign-in — or anything at all about the person you are connected to. Google stamps each event with the moment it arrives, as any such service does, but nothing in the event says what the moment was about. They never agreed to any of this, and the rule that holds everywhere else in Karot holds here.

There is no advertising identifier in it. On Android the app removes the advertising-id permission that Google's library would otherwise add to it, and switches off that library's collection of both the advertising id and the Android device id; on iPhone it switches off the identifier-for-vendor, which is the equivalent. There are no adverts anywhere in Karot and nothing here feeds any, and there is no tracking-permission prompt because there is nothing to ask about.

The switch is not a filter in front of a collector that goes on collecting. Turning counting off is passed to Google's library itself, which stops gathering and deletes the app-instance id it was using; nothing is held back to be sent later. The library also starts switched off at every launch and is switched on a moment later only if you have not turned it off — so a phone restored from a backup, which carries your answer but not the library's own state, cannot count anything before your answer has been read.

Where the servers are

Everything Karot stores lives in one Supabase project in Frankfurt, Germany (eu-central-1): the database, the authentication service — with the address and the sign-in an account is kept with, and Apple's token for it — the file storage for photos and recordings — yours, and those left with a tap — and the small server functions that send notifications, deliver letters and tell Apple when an account kept with Apple is deleted. Supabase runs that infrastructure for us and can access what is on it.

Traffic between your phone and that project is encrypted. What leaves it, leaves only to the recipients named above.

Photos, and why they are readable by anyone with the link

Your profile photo is stored in a public bucket. A request to its address returns the file with no sign-in and no permission check.

This is deliberate. The home-screen widget holds no session, and neither does a notification image, so the photo has to be fetchable by address alone. What protects it is that the address is a secret: the file's name is your account id followed by 32 random characters. Nobody can list the bucket, so the address cannot be discovered — only shared, forwarded or logged.

The consequences we should say out loud:

• Anyone who ever holds the address — a person you later unpaired from, anyone they forwarded it to, any service that fetched it — can keep opening the photo. Unpairing does not revoke it.
• Their phone also keeps a downloaded copy for the widget, which nothing we delete can reach.
• The photo stays reachable for roughly ten minutes after you delete your account, because file deletion happens outside the database transaction.
• A person you are connected with can list your photo folder, and would see older photos of yours still waiting to be deleted.

Do not put anything in your profile photo that you would mind being seen by someone who got the link.

Voice recordings are the opposite, and genuinely protected. They live in a private bucket. Nothing in it can be fetched by address alone: playback goes through a signed link that the app asks the server for and that expires after an hour. A recipient can get such a link only after the letter has arrived, has not been withdrawn, and has been opened — and before opening, their app does not even hold the file's name to ask about. The sender can always play back their own recording.

What you leave with a tap is private too. Its recordings and photographs sit in two more private buckets, fetched the same way, through signed links that expire after an hour. There is no opening to wait for: either of you can get a link to a moment's file while the moment is alive — for as long as it is kept, which from 1.1 is until its sender deletes it or the connection ends; from a version before 1.1, its day, or for good once you both keep it. Hiding a moment does not stop your own app from asking. Your widget — and, on iPhone, the notification extension — gets the same kind of one-hour link, through the widget's key, for a photograph someone left you.

One limit: a signed link, once issued, cannot be recalled. If one were copied out of the app it would keep working for the rest of its hour, whatever happened in the meantime — unless the file itself had been deleted by then.

What Karot keeps on your phone

The app stores a small number of things locally, in ordinary app storage. They are inside the app's private sandbox, so no other app can read them, but they are not encrypted by Karot itself. The one exception is a kept account's session on iPhone, which is in the Keychain (below).

• Your session token. For an account you never kept, this is the account: there is no password, and whoever holds this token is you. For a kept account it is how this phone stays signed in, and with it the phone keeps the address and the ways the account is kept with. After you keep or open your account with Google, and until the phone next renews its sign-in — at most an hour — the token can also carry the name and the link to the profile picture Google sent; nothing in the app reads them, and the renewed token no longer has them. There is no password in either case, and none can be set.
• After a sign-out, a note that lets the app say “Welcome back”: the account id, the ways it was kept with, the address with most of it hidden, and a one-way hash of the account id and the address together, so that the app can tell whether an address typed again is the same one. No token.
• About keeping: which ways our server offers at the moment, and when the app last asked; the language a kept account's mail was last set to; and whether the offer to keep has been shown, and until when it waits.
• A previous session of an account you never kept, in the one case where the authentication service declares your token permanently dead. Nothing ever removes it. Deleting your account does not remove it. Only deleting the app does.
• The server's id for this install, so we recognise the install when its push address changes.
• The widget's credential. The home-screen widget has no session, so it carries a per-device key instead. With it, and without any sign-in, the widget can send a tap as you and fetch your whole home view — the other person's name, photo path, city, coordinates, local time, status, birthday and your last taps, whether a letter is on its way, and what they last left you, with a one-hour link to its photograph. A new key is issued every time the app registers, so a key copied off a phone stops working the next time the app is opened. On iPhone the notification extension uses the same key, without any sign-in, to fetch that same home view when a notification is about a drawing, a sign or a photograph.
• Display preferences: theme, text size, how people are drawn, chosen language, whether setup was finished, whether notifications show pictures — and your answer to the counting switch.
• The ask for a rating: whether it has been shown and answered, and until when it waits. Nothing about it is sent anywhere; what you do in the store's own rating sheet is between you and the store.
• The book's one-time card: whether the card that says everything you leave each other now stays in your book is still to be shown — decided once, the first time 1.1 opens. Nothing about it is sent anywhere.
• Google's measurement id, while counting is on: the app-instance id its library generates and keeps, and on Android an installation id alongside it. It is the only identifier in this list you can delete yourself — turning counting off in Settings → About Karot tells the library to drop it.
• Phone numbers you save for “Call now” — someone else's number, and which app to call it with. These never reach our server. They are removed when the connection ends and when you delete your account. Pressing Call hands the number to the app you chose.
• A pending invite code, if you opened an invite link before finishing setup, so it is not lost. It is erased when it is used, or ignored and erased after seven days.
• On Android only: three yes/no marks about the notification prompt — that it was shown, that it was refused, and that the system seems to have refused without showing a dialog. No timestamps, no counts.
• The widget's snapshot: for each connected person, the name you use for them, their colour, their city, their time zone, the times of the last taps in each direction, their status, their birthday, whether a letter from them is on its way, and whether you paused them — plus a small copy of their photo as a file on your phone, and of the newest thing they left you in your thread, with whether one or two more lie behind it: a picture of a drawing, a photograph or a sign, a note's first words, a recording's length. A paired watch with Karot on it gets the same snapshot, without the widget's credential. The widget cannot reach the network reliably, so everything it draws has to already be on disk. The photo copies are deleted at the next refresh once a person is gone; the snapshot itself is replaced rather than cleared.
• Notification pictures. On Android, the picture a notification shows — a still (PNG, or JPEG for a photograph) and, from Android 12, a moving one (GIF) — is a file in the app's private storage, handed to the system's notification display one file at a time; it is deleted three days and two hours after it was made (a day, in a version before 1.1), or ten minutes after its notification is gone, checked each time Karot makes another notification picture. To make it, a few of the notification's own fields — the sender's name among them, and the ids of the connection, the tap and the moment — are handed to Android's job scheduler on the phone, which keeps its record of the finished job for about a day. On iPhone, the still and, for a drawing or a sign, the drawing's lines or the sign's name sit in the storage the app shares with its widget and notification extensions; they are removed once 74 hours old (48, in a version before 1.1), the next time a picture notification arrives. Either phone's system keeps its own copy of a notification's picture while the notification stays in the shade or in Notification Center.
• Temporary files while you record or play a voice letter, deleted as soon as they are read. A recording interrupted by a crash can leave a fragment in the cache folder.
• Downloaded photos — profile photos, and photographs left with a tap — in the app's image cache. Nothing clears this when a moment is hidden, is deleted or fades, when you unpair or when you delete your account; the system reclaims it over time.
• On iPhone only: a mark that the app has been installed before, so that the first launch after a new install can clear the iPhone's Keychain of anything an earlier install left there.

Backups differ between the two platforms, and we will not pretend otherwise. On Android, only the display preferences are included in cloud backup and phone-to-phone transfer; the session token, the note after a sign-out, the widget key, the device id, saved phone numbers, the widget data and notification pictures are deliberately excluded. On iPhone there is no such split for the rest of it: it sits in the app's standard preferences, which an iCloud or computer backup includes and a restore can carry to a new phone — and for an account you never kept, that copy of the session is its only way back. A kept account's session is different: it is kept in the iPhone's Keychain, for this device only, which no backup carries to another phone; a phone restored from a backup opens on “Welcome back” instead, and you continue the way you kept your account. (Should the Keychain ever refuse to store it, the app keeps the session in its ordinary storage rather than lose it.) The notification pictures and the widget's copies sit in the storage the app shares with its widget and extensions, which a backup does not exclude either.

How long things last

Some data has a schedule. Most does not.

Deleted on a schedule (housekeeping runs every hour; file deletion every ten minutes):

Kept with no expiry, until the account is deleted: your profile — with your birthday, and the last time you had Karot open, one time overwritten — your settings, the note of your last quiet-heart reminder, your entitlement, the address and the sign-ins your account is kept with, and Apple's token for it, your connections — including ended ones — and both sides' private notes about each other, every letter, delivered or withdrawn, with its text, and anything you sent us through “Tell us what you think”. A withdrawn letter keeps its text even though nobody can read it again. Every moment sent from 1.1 — and, from an older version, the ones you both kept and the birthday wishes and cards — has no expiry either, and neither has the note of what you hid; but a moment goes when its sender deletes it, and all of them go when the connection ends.

Taps are the exception in the other direction: they are deleted the moment either person ends the connection, and everything left with them goes with them — your whole book together.

One failure we should admit: file deletion is retried ten times and then given up on, with no alarm. If our storage kept refusing a particular file, that file could outlive the row that pointed at it. So: files are normally gone within about ten minutes — not always.

Our database is backed up by our hosting provider on its own schedule, so deleted rows can persist in backups for a period after they are gone from the live database.

When a connection ends

Either of you can end it, and the other is not told.

What happens: every tap between you is deleted, for both of you — the whole shared history, the calendar, the recaps — and every moment with them — your whole book together: drawings, words, recordings, photographs, signs and birthday cards, whenever they were sent, and the notes of what either of you hid; their recordings and photographs are queued for removal at once and follow within about ten minutes, except a file its sender also sent to someone else at the same time, which stays for as long as that other person’s moment does. Letters still on their way in either direction are cancelled and their recordings removed. Held alerts are dropped. If one of you had given the other a place in a Karot Family, the place ends, and connecting again does not bring it back.

What does not happen: the record that the two of you were connected, from this date to that date, stays on our server indefinitely, along with both sides' private notes — the name each of you gave the other, the colour, the flags. Neither of you can read any of it any more; it is retained and reachable by nobody but the database. Letters that already arrived stay with whoever received them, with their recordings. Unpairing does not unsend.

Deleting your account

Settings → About Karot → Delete account.

That runs one command on our server: it deletes your account row. Everything attached to it goes in the same transaction — your profile, your photo record, your settings, your devices and push addresses, your session and its tokens, the ways your account was kept with — the address, and Apple's or Google's identifier — your connections and both sides' private notes, the places you gave in a Karot Family and any you were given, every tap in either direction, every moment either of you left — your whole book with each of your people, and what you hid from it — every held alert, every letter you sent or received, and everything you sent us through “Tell us what you think”. One row survives with your id erased from it: an invite someone else made and you accepted, which belongs to them and is deleted within thirty days anyway. If you kept your account with Apple, Apple's token for it is set aside, with nothing left to say whose it was, only until Apple confirms it is revoked (see “How long things last”).

Your photo, your voice letters and the recordings and photographs of moments live outside the database. They are queued for removal before your account row goes — everything in your own folders, whether or not it was ever sent, the recordings of letters you received, and the recordings and photographs of every moment between you and the people you are connected to, in either direction — and removed within about ten minutes, except a file somebody also sent to someone else at the same time, which stays for as long as that other person’s moment does.

Deleting your account does not cancel a subscription you bought. It belongs to the store, which goes on billing it until you cancel it there; before deleting, the app says so and offers the store's own page. The subscription's record loses your account as its owner: if it came to your account from another one, it goes back to that one; otherwise it waits with no owner, and is deleted 60 days after it ends.

Deleting your account also removes things from the other person's app. A letter exists in one place only, so the letters you sent them disappear from their copy too — including ones already delivered, opened and kept. So do the taps between you, every moment either of you left the other — your whole book together — and the recordings of voice letters you received from them. They are not asked, and not warned.

If your account was kept, every other phone signed in to it is signed out the next time it renews its sign-in, and continuing there the way you kept it says that the account may have been deleted. If you kept it with Apple, our server then tells Apple, which removes Karot from your Apple Account's apps that use Sign in with Apple — normally within ten minutes. Should our server never have received Apple's token for your account, an iPhone asks Apple once more just before deleting; on Android, the app tells you how to remove Karot there yourself: on an iPhone, Settings → your name → Sign in with Apple → Karot → Delete. Deleting your account does not tell Google: if you kept it with Google, Karot stays among the apps connected to your Google Account until you remove it in your Google Account's settings. Resend's copies of the mails it delivered to you stay for their thirty days, and your entries in our authentication service's audit log for theirs (see “Your account”).

If you no longer have the app

For a kept account, the quickest way is still the app: on any phone, open Karot, choose “I already use Karot”, continue the way you kept your account, then Settings → About Karot → Delete account.

If you cannot do that, and your account is kept with an email address — including the one Apple or Google passed on to us — you can ask us to delete it: write to hello@karot.love and name that address. We will not act on a message because it says it comes from that address; anyone can make a message say that. Instead we write first to the address you named, quoting a short phrase, and we delete the account only when a reply to that mail quotes the phrase back. Whether or not anything is kept with that address, our answer to you is the same. The account is then deleted exactly as the app deletes it, with everything described above. If Apple hides your address, the app on an iPhone is the surer way: our mail reaches a hidden address only through Apple's relay, which may not pass it.

An account you never kept has no address to match: none of our tables holds an email address, phone number or username for it. If you write to us, we have no way to find out which row is yours, and no way to check that it is yours; acting on such a request would mean deleting somebody on an unverifiable claim. So for an account you never kept: delete it from the phone that holds it, before you delete the app. If the app has lost the session and the delete button no longer reaches your old account, write to us before uninstalling — the app keeps the old token on the phone, and with it we may still be able to help.

What Karot does not do

• No advertising, and nothing about you is sold or shared for advertising.
• No crash-reporting service, and no telemetry beyond the anonymous counting described above — which you can switch off, which never carries anything you wrote, and which never says anything about the person you are connected to. The app's own logs are written to the device's console and sent nowhere.
• No advertising identifier, no tracking across apps or websites, and no tracking-permission prompt — there is nothing to ask about.
• No location, on either platform. There is no location permission in the app and no location code in it.
• No address book. Karot never reads your contacts. A phone number you save for calling is typed by you and stays on your phone.
• No profiling, no scoring, no streaks, and no count of anything shown to you or to the person you are connected to.

Permissions the app does ask for: notifications, at the end of first-time setup, with “Not now” as an equal answer; the microphone, the first time you press record; the camera and photo library, when you choose a profile photo or a photograph to leave with a tap; and, the first time you press Save on a picture, permission to add it to your photos — on iPhone that is add-only, so Karot can put a picture in and can never see one; Android 10 and later need no permission for it, and Android 8 and 9 ask for storage. A picture you save or share is a copy that has left Karot: it lives in your photos or in the app you chose, nothing about it is sent to us or to the other person, and hiding, deleting, fading or unpairing never touches it. On Android the installed app also carries five permissions added automatically by the notification and background-work libraries — none of them prompts you and none grants access to your content. On both platforms the app declares that it may ask the system whether WhatsApp, Viber or Telegram are installed (to offer “Call now”) and, on Android, which phone-maker battery settings screen exists. It can only ask whether such an app exists; it cannot read anything from it. On Android the app also declares the system's own notification display, so that it can hand it a notification's picture.

Children

Karot is not meant for children under 13, and where local law sets a higher minimum age for using a service like this without a parent, that age applies. There is no age check in the app: nothing asks for an account when it first opens, and keeping one asks for a way to sign in, never an age. We do not knowingly keep data from a child below that age. If you believe a child has an account, write to us at hello@karot.love — but please read the section above on deleting an account: one that was never kept cannot be identified from an email alone.

Your rights

Under the law of the Republic of Armenia and, where it applies, the EU General Data Protection Regulation, you have rights over the data described here: to know what is held, to correct it, to have it deleted, to object to some uses of it, and to complain to a data protection authority.

How this works in practice for an app with no sign-up:

• Seeing your data. Nearly all of it is on screen in the app: your profile, your settings, your connections, your history (your book, with what you hid at its back), your letters, and, if you kept your account, how and with which address (in Settings, on the row under “Your people” that says how it is kept, with the address partly hidden). Some is not shown anywhere — the wrong-code counter, the flags our notification service uses, the timestamps of held alerts, the last time you had Karot open, when someone opened a moment you left, the notes that a reminder was sent, what you sent through “Tell us what you think” (which nothing in the app can read back, not even for its author), Apple's token for a kept account, the audit log of your sign-ins, and the operational records our hosting and authentication providers keep.
• Correcting it. Your name, photo or mark, city, birthday, language, quiet hours and the private names, colours and flags you set for other people can all be changed in the app at any time, and so can the address your account is kept with (that same row → Use a different email). A tap cannot be edited, and a letter's text cannot be changed once written (it can be withdrawn before it arrives). Nor can a moment be edited, but whoever sent it can delete it, and either of you can hide it from your own book.
• Deleting it. In the app (see “Deleting your account”): everything attached to your account goes at once, and what is kept apart from it — the audit log of your sign-ins, Resend's copies of your mail, our hosting provider's backups — goes on the schedules given above. A kept account can also be deleted on a written request.
• From outside the app. If you no longer have the app and your account was never kept, we have no way to identify you, so we cannot act on a request by email — not because we would refuse, but because we would be guessing at whose data to touch. A kept account can be found by the address it is kept with. Write to us anyway if something has gone wrong; we will tell you honestly what is possible.

We use your data to run the things you asked for: your profile and city, your connections, taps, what you leave with them, letters, birthdays, presence and quiet hours, notification delivery, your plan, and, if you chose to keep your account, the sign-in you chose and the mail that carries your code. We also use a small amount of it to keep the service from being abused: the wrong-code counter, limits on how many letters and invites you can create in a day, a fifteen-second pause between test notifications and a thirty-minute pause between “free now” alerts, and limits on how many sign-in codes can be sent and tried. We do not rely on your consent for any of this, and the permission prompts your phone shows are device permissions, not a legal basis. The counting described above is the one thing here that runs nothing you asked for, and the switch in Settings → About Karot is how you answer about it.

Changes to this policy

If what Karot does changes, this page changes with it, and the date at the top changes too. We will not quietly broaden what is collected and leave the old words standing. Where a change is significant — a new recipient of your data, a new kind of data, a shorter or longer retention — we will say so in the app before or when it takes effect. A change that concerns only something you choose to use, and nobody else's data, is written here from the day it arrives, before anything is collected from you for it.

Getting in touch

Write to hello@karot.love. Karot is run by Davit Vardanyan, an individual, and this policy is governed by the law of the Republic of Armenia. If you are in the EU or the UK and you think we have handled your data badly, you can also complain to your national data protection authority.

The app's “Tell us what you think” reaches us but cannot carry an answer back. For anything that needs one — a question, a request about your data — this address is the only channel, and it is read by a person.