Privacy Policy

1. Information we collect

• Account info. Your email and password (stored hashed) when you sign up. If you sign in with Google, we receive your name, email, and profile photo.
• App data you create. Ride plans, voted time options, venue selections, guests you invite, and any photos or video clips you attach to a ride.
• Google Contacts (only if you connect them). Read-only access to your contacts so you can autocomplete invitees. We query contacts on demand and do not store them on our servers.
• Google Calendar (only if you connect it). Read-only access to event titles and times so we can flag conflicts while you pick a ride time, plus write access to add the locked ride to your calendar.

2. How we use information

• Operate the service (sign-in, sending invites, recording votes, locking rides).
• Send transactional emails — account confirmation, ride invites, bill reminders.
• Diagnose bugs and improve the product.

We do not sell your data. We do not show ads.

3. Google user data — Limited Use

Carnival Ride's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Contacts and Calendar data solely to provide the user-facing features described in section 1.
• We do not transfer the data except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition.
• We do not use the data for advertising.
• We do not allow humans to read the data unless we have your affirmative consent, it is necessary for security, to comply with law, or the data has been aggregated and anonymized.

4. Storage and retention

• Account and ride data are stored in our database hosted by Supabase (United States).
• The application is hosted by Vercel.
• We keep your data while your account is active. You can delete your account at any time by emailing us — this removes your account record and all associated rides.

5. Sharing

We share data only with:

• Service providers strictly required to run the app — Supabase (database + auth), Vercel (hosting), Resend (transactional email), Google (authentication and connected scopes).
• People you explicitly invite to a ride. They see the ride details you chose to share with them.
• Authorities when legally required.

6. Your rights

• Access or correct your account data via the app.
• Delete your account by emailing octaviopr89@gmail.com.
• Revoke Google access at any time at myaccount.google.com/permissions.

7. Children

Carnival Ride is not intended for children under 13. Do not use the app if you are under 13.

8. Changes to this policy

If this policy changes, we will post the new version on this page and update the effective date above.

9. Contact

Questions? Email octaviopr89@gmail.com.