Privacy Policy

Last updated: September 22, 2026

This policy explains how we handle information through cartily.co and the Cartily Home Screen web app. For privacy questions or requests, contact support@cartily.co.

Information you provide

• Account information: your sign-in email and/or verified phone number, display name, account settings, follows, favorites, hidden shops and notification choices.
• Seller information: shop name, maker or team name, story, product information, photos, categories, hours, public contact details, links, pickup information you enter and the updates you post to your followers.
• Support and safety information: messages you send us, profile claims, information supplied to establish authority to manage a shop, reports and related decisions.

We may also obtain basic business information from publicly available business pages to create an identified unclaimed profile. That does not mean the business supplied or approved the profile. A business representative can ask us to correct or remove it.

Information recorded when you use Cartily

Our systems and hosting providers process technical information needed to serve and protect the app, such as IP addresses, request times, browser or device information and error records. Sign-in requests record an IP address and timestamps to limit abuse. Reports may also include the submitting IP address.

We store sign-in verification records, sessions and account activity needed to provide the service. Sign-in codes expire after 10 minutes; a browser session can last up to 30 days unless ended earlier. These are credential-validity periods, not promises that every related log record is deleted at that moment.

Cartily records basic shop interaction counts, including page opens, QR-attributed opens and directions taps. Some display settings and local counters stay in your browser. Counts do not prove a purchase or a physical visit.

If you enable phone notifications, we store the browser-provided push subscription and delivery keys needed to reach that device, together with your shop and notification preferences. We also record notification jobs and delivery attempts. A push-service acceptance does not establish that you saw the notification. Signing out on a device removes its subscription.

Public information and pickup locations

A published profile’s business name, descriptions, photos, hours, selected contact details and links are visible to visitors. Your account’s sign-in email and phone number are not automatically published as contact details. Add only the contact details you want customers to use.

Sellers choose how an exact pickup location is displayed: an area without the exact address, an address shown while open, or an always-public address. An exact location saved to an account can remain stored even when the public view hides it. Removing an address from a profile does not remove screenshots, messages or copies another service already holds.

When a seller requests an address lookup, the typed address is sent to OpenStreetMap’s Nominatim service to find possible locations. This happens before the seller chooses whether to publish the location. Opening a directions link sends the destination to the selected mapping service.

We re-encode uploaded shop images to remove embedded metadata before publishing them. A photo can still reveal a location, face or other personal information in the picture itself. Public profiles and image links can be copied, shared or indexed by search services.

Your follow and favorite lists are not published as a public buyer profile. Shops can see aggregate follower counts. Operators and providers with relevant responsibilities can process account information to run and support the service.

How we use information

We use information to provide accounts and shop pages, keep availability current, save preferences, display relevant updates, handle ownership claims and corrections, respond to support requests, investigate abuse and maintain the service. We also use operational information to understand and improve how Cartily works.

Sign-in emails and verification texts are for account access. If you choose phone sign-in, Twilio Verify processes your number to send and check a one-time code. We keep short-lived verification records and a keyed digest of the requesting IP address to limit abuse. Signing in or following a shop does not by itself enroll you in promotional email, text messages or phone notifications. You can choose available in-app and phone updates for individual shops. Cartily does not send promotional or shop-opening SMS, or shop-opening email. See Notifications and Choices for controls and device requirements.

Providers and other disclosures

Providers process information required for their part of the service. Our current infrastructure includes Vercel for hosting and image storage, Neon for the database, Resend for sign-in email, Twilio Verify for phone sign-in when enabled, Namecheap Private Email for the support mailbox, and OpenStreetMap Nominatim for requested address lookups. Public image requests, email delivery and website requests also involve the relevant network and email providers.

Phone notifications are routed through the push service used by your browser or operating system, such as Apple, Google or Mozilla. We send the information needed to deliver the notification using Web Push. Notification text can appear on your lock screen according to your device settings.

We share public profile content as part of publishing it and share information when you choose an external link or service. We may disclose information to comply with a valid legal requirement or to address fraud, security incidents and threats to people or the service. If the operation of Cartily changes hands, information may transfer with the service subject to appropriate notice and applicable requirements.

We do not sell your personal information or disclose it to third parties for their own targeted advertising. Seller contact details you choose to publish remain public. Providers’ processing and linked services are distinct from making an account email into a public directory contact.

Cookies and information on your device

Cartily uses a first-party session cookie to keep you signed in. Browser storage holds a recent app snapshot, settings and some local activity. The snapshot may include account-specific information while you are signed in, so use care on a shared device and sign out when finished.

A service worker stores app files to help the Home Screen app load. It does not make live information current while you are offline. You can clear Cartily’s cookies and site data in your browser; doing so may sign you out and remove locally saved settings. Uninstalling the Home Screen app is not the same as deleting your account.

Retention and account deletion

We retain account and shop information to provide the service while the account is active. Retention of technical, claim, report and support records depends on their purpose, security needs and legal obligations. Backup retention also depends on the providers’ configured recovery systems.

You can request account deletion in account settings or contact support. Deletion removes the account and its owned shop profiles from the active app, together with linked account records. Stored images are removed separately; the deletion response may identify images whose removal has not yet completed. Contact support if cleanup remains incomplete.

Some security, moderation or support records and backup copies may remain after active account deletion when necessary for their stated purposes or legal requirements. Public copies held by other people, search engines or external services are outside Cartily’s account-deletion controls.

Your choices and requests

You can edit public profile information, change location visibility, manage follows and notification settings, hide shops, sign out or delete your account using the available controls. Business representatives can request correction or removal of an unclaimed profile.

Email support for help accessing, correcting, obtaining a copy of or deleting your information. We may need to verify your authority before providing information or changing an account. Depending on where you live, additional privacy rights may apply; we will handle applicable requests under the relevant requirements. Please do not email passwords or sign-in codes.

Children

Cartily is a general-audience service and is not directed to children under 13. Children under 13 must not create an account or submit personal information. If you believe a child has provided personal information, contact support so we can investigate and take appropriate action.

Security and changes

We use technical and organizational measures intended to protect information, but no service can promise absolute security. Please contact us if you suspect an account or privacy problem.

We will update this policy when our practices change and provide appropriate notice of material changes. Where a new use requires consent, we will ask for it. Contact support@cartily.co with questions.