Privacy Policy

Last updated October 3, 2026

Data stored on your device

So Carta works offline and remembers your preferences, it stores on your iPhone:

• Kept passages, your own deck names, and which passages they hold
• Passed passages, deck progress, and category order
• Reading and display preferences: canvas, typeface, text size, sound, haptics, widgets, and notification times
• A cache of literary content and a built-in starter library
• Your purchase-unlock status
• Content reports waiting to be resent

Your library uses Apple SwiftData. Sign-in tokens are kept in Apple Keychain. Widget content is shared only with Carta’s own widget extension through an App Group.

Optional account and cloud backup

You can use Carta without an account. If you sign in with Apple or with email and password, Carta uses Supabase to store your user ID, email address, and optional nickname or name. It also stores your Kept passages, your decks, the passages you save or pass (so For You and your decks stay in step across devices), and any content reports you send.

This data is used for sign-in, backup, syncing between devices, personalizing For You, and reviewing content. If you use Apple’s Hide My Email, Carta receives only Apple’s relay address.

Reading insights

When Share Reading Insights is on (Settings → Preferences; on by default), Carta sends usage events to its own database. These cover:

• Deck opens and how long decks take to load
• Swipe, keep, undo, and report actions, with the passage ID and time spent on the card
• Reader, export, canvas, typeface, sound, widget, and notification choices
• Paywall views and purchase outcomes
• Sign-in, sign-out, and account-deletion outcomes
• Session start and end

Events are tied to a random install ID that resets when you delete the app and, when you are signed in, to your account. They never include your search text, report details, or deck names. They are used only to improve Carta, are never shared with advertisers or data brokers, and are deleted with your account. Turning the setting off stops collection immediately and discards events that haven’t been sent.

Purchases

Apple processes all purchases through the App Store. Carta never receives your payment details. It receives verified purchase results from Apple and stores only which palettes are unlocked, so they work offline and in widgets.

Notifications, sound, and exports

• Morning and evening passages are scheduled on your device, only after you turn them on. Carta does not use remote push notifications.
• Soundscapes are bundled with the app. Carta never uses the microphone.
• Card images and PDF booklets are made on your device. If you save a card to Photos, Carta asks for permission to add that image only; it never reads your existing photos. Anything you share goes only where you choose to send it.

Carta does not request access to your camera, contacts, location, or microphone, and does not ask to track you.

Content reports

You can report an inaccurate, misattributed, or inappropriate passage. A report contains the passage ID, the reason, and any details you add. If you are signed in, it is linked to your account. Please don’t include sensitive personal information in report details.

Retention and deletion

You can remove Kept passages and decks in the app at any time. To delete your account, go to Settings → Account & Cloud Backup → Initiate Account & Data Deletion. This removes your account and its Kept passages, decks, reading history, reading insights, and linked reports from Carta’s servers, and clears your library from that device. Deleting the app removes everything else stored on your iPhone. Apple keeps its own purchase records under its own policies.

Service providers

• Supabase provides sign-in, the database, and sync.
• Apple provides App Store distribution, purchases, Sign in with Apple, notifications, and widgets.

Carta connects to these services over encrypted connections.

Children

Carta is for a general audience and is not directed to children under 13. It does not knowingly collect personal information from children under 13.

Changes to this policy

When this policy changes, the date at the top of this page will change too.

Contact

For privacy questions, email support@otoniel.dev.