Who holds your information
Carafolio is published by Provenance Folio, Inc., a company incorporated in the State of Delaware, United States. Where this notice says we, it means that company.
Write to us at sbeerling@carafolio.com. A person reads that address.
If you apply and never open an account
There are two lists, and the form you see depends on which is open. While founding places remain, an application is for one of them. Once they are filled, the same form puts you on the opening list instead: nobody on it is being chosen, and we write to it once, when Carafolio opens to everyone, and not otherwise.
The form asks for your name, your email address, the city you live in, and the last place you loved in your own words, and it stores where you came from — a referring page or campaign tag. The form may also ask two optional questions: Who usually travels with you?, answered by choosing any of on my own, with friends, with a partner, or with family across generations; and Who sent you to us?, answered in your own words.
Two of those answers are unstructured writing, and people put more of themselves in them than they intend to. We treat them as the most personal things on the form. The answer to Who sent you to us? names somebody else, who has not been asked and may not know you have applied; we keep it so that we can thank or credit them, show it only to the person who reads applications, and use it for nothing else. Everything you send is stored in our database, sent once by email to the person who reads applications, and used for nothing but considering your application. None of your answers is sent to our analytics provider — when an application is recorded, our analytics receive the city alone, attached to no person.
If you are invited, your application stays with your account. If you are not, we keep it for twelve months from the day it arrived and then delete it; an address on the opening list is kept until we have written to it, and then for the same period. If you would rather we did not hold yours, write to us at any time and we will remove it.
If you join a volume’s waitlist
A bound volume can have a waitlist, reached from its flyer at an address like carafolio.com/w/ followed by a short name. If you join, we store your first and last name, your email address, the volume it is for, and the date you joined. We ask for nothing else, and you do not need an account.
It is kept for news of that volume. We will write to you when ordering opens, with the link, and the volume’s author may also write to you about it. The address is kept against that one volume: it is not added to any other waitlist, not joined to an account, and not used for anything else. Our analytics record that somebody joined, never your name or address.
The volume’s author can see it. The author sees how many are waiting, and can open the list of names and addresses or download it to write to you with their own email; each time they open or download it, we record that they did. Our terms forbid an author from passing the list on. No other reader of the page or the volume can see who has joined. We never share your address with anyone else and we never sell it. It is stored with Supabase, and email we send goes through Resend, both as listed below.
You can leave at any time. Every email we send carries a one-tap way off the list, which deletes your address, and the author is required to tell you how to be removed in anything they send. You can also write to us and we will remove it. If the volume is deleted, every address on its waitlist is deleted with it.
Your account
You sign in with an email address, with Apple, or with Google. Authentication is handled by Supabase; when you use Apple or Google they tell us the address associated with that sign-in, and we hold no password of yours.
Your profile holds your name, that address, an optional portrait, your pronoun, your editorial role, the tier your account is on, and the cities you keep. Carafolio does not hold your phone number.
The cities you keep are chosen from a published list of the world’s cities, and each is stored as a reference to that city and its centre — never your street or your house. We use them to centre the map and to order what you see. Change or remove a city in Settings and the reference changes or goes with it.
Your device’s location is different, and it never leaves your device. If you let Carafolio use it, the Folio fetches where your own places are and your device works out which are nearest; the map shows where you are in the same way. Your position is not sent to our server, not saved to your account or anywhere in our database, and never received by our analytics. You can withdraw the permission at any time in your phone’s or browser’s settings.
Your address book
In Settings you can keep postal addresses — your own, and those of people you may one day send a volume to. Each holds a recipient’s name, a label you choose, the street address, city, region, postal code and country. Only you can read them. They are kept for sending printed volumes, and nothing is sent anywhere yet: when ordering opens, we will say here who receives an address and why before any does. Delete an address in Settings and it is gone; closing your account deletes all of them.
Complimentary access
Where an account holds a tier it has not paid for, we record that alongside it: which tier, on what basis, who granted it, and the date it ends, if it ends. Members of our friends-and-family test who chose to take part keep their access for the length of the beta, and members of the beta test receive one volume without charge. Other complimentary Curator access ends on 31 December 2026. From then the account continues on Freemium, and everything in it is kept — every place, circle, trip, photograph and volume. Freemium keeps eight places in each circle or trip you founded; where one already holds more, those places stay, and only a new addition is refused. A grant that ends is marked as ended rather than erased, so the record of what an account held, and when, stays accurate.
We may also grant access to an email address before it has an account. We then hold that address, the access and its end date, and nothing else, until the address signs up or we remove it.
Notifications on your iPhone
If you turn on notifications in the iPhone app, we keep the token Apple gives us for reaching that device, and the device’s time zone, so that nothing arrives between nine in the evening and eight in the morning where you are. A notification says what kind of thing is waiting and how many — an invitation, a plan in the morning — and never carries a name, an address or your own words. Apple delivers it. Turning notifications off in Settings, or signing out of the app, removes the token.
We also record, against each volume you bind, the short list of accounts entitled to order a printed copy of it. It holds account identifiers and nothing else — no names, no addresses, no payment details — and it is never revised.
What you keep
The places you keep, whether you have been, when you went, the plans you make, the circles you belong to, the volumes you compose, and the notes you write.
The notes matter most, and there are many kinds — on a place, on a visit, on a share, on who told you about somewhere, a curator's note in a volume. They are your prose. We do not read them for any purpose other than running the product, we do not use them to advertise, and we do not sell them.
Where you go can imply things you never wrote down. We do not draw those inferences. We do not group members by the kinds of places they keep, and nothing we build reads a list of places as a description of a person.
Photographs
Every upload path strips EXIF metadata, including GPS coordinates, before the file is stored. The original files that predated that were deleted on 18 August 2026. A photograph you upload does not carry the location it was taken at.
Photographs are held in cloud storage under addresses that cannot be guessed. We are moving them to storage where each request is checked individually, and this notice will say so once that is done rather than before.
A screenshot is never stored. When you add a place from a screenshot, the image is reduced on your device, sent once to be read, and discarded. It is not kept with the place, it is not shown to anyone, and it does not mark the place as visited.
When you upload a photograph of an identifiable person, you are telling us you have their permission. If you appear in a photograph on Carafolio and you did not agree to it, write to us. You do not need an account, and you do not need the member's permission to ask.
People you share with or invite
When you share a place, you can choose a Carafolio member, type an email address, or, in the iPhone app, search your phone’s contacts. When you invite someone to a circle or trip, you choose a member or type an address. Your contacts are searched on your phone and are never uploaded; we receive only the email address of the person you choose.
We store that address with the share or invitation, so that we can send it and so that the person can accept it. We use it for nothing else, and we do not add it to any mailing list. Our analytics never receive it.
If you received a share or an invitation and would like your address removed, write to sbeerling@carafolio.com. You do not need an account to ask, and we will remove it.
Who else receives your information
We do not sell your information and we do not share it for advertising. These are the services that run Carafolio.
| Service | What reaches them | Where |
|---|---|---|
| Supabase | The database, sign-in, and stored files | United States |
| Vercel | Requests to the site, including IP address, in server logs | United States |
| Resend | Email we send and email forwarded in | United States |
| PostHog | Product analytics, as described below | United States |
| Place searches and coordinates | Google's infrastructure | |
| Anthropic | Text sent for composition and parsing, and a screenshot you choose to have read | United States |
| CARTO | Requests for the map tiles your device draws. The tiles asked for show roughly which area is being looked at, including the area around an upcoming trip, which your device fetches in advance. No name, account or position is sent with them. | CARTO’s infrastructure |
| Geocodio | A place’s address and city in the United States or Canada, sent to find where it stands on the map — including an address you type on a place | United States |
| OpenStreetMap (Nominatim) | Elsewhere in the world, a place’s name and address, including one you type, sent for the same purpose; and the words of a place search when Google finds nothing. Never your own address or your position. | The OpenStreetMap Foundation’s infrastructure |
| Apple | Distributes the iPhone app, handles Sign in with Apple if you use it, and delivers notifications to the iPhone app if you turn them on | Apple’s infrastructure |
The services that run Carafolio for us hold information on our instructions, and none is permitted to use it for its own purposes. Two on this list are different. Apple distributes the app under its own terms, and what it learns from your download or your Apple sign-in is governed by its own privacy policy. OpenStreetMap’s lookup service is a public service we use under its published usage policy, not under a contract with us; what we send it is a place, never a person. Place information shown in Carafolio comes from Google Maps Platform, governed by Google's privacy policy at policies.google.com/privacy.
Carafolio runs in the United States. If you use it from elsewhere, your information is transferred there.
How the product is used
We use PostHog to understand which parts of Carafolio are used, and we have configured it conservatively.
- No session recording. We do not replay your screen.
- No blind capture. Clicks and typing are not recorded automatically; every event we collect is one a developer wrote by hand.
- No profile for visitors. If you read the public page and never sign in, no person record is created for you.
- You are a user id, never an email.
- Nothing kept on your device. No analytics cookie, and nothing in browser storage. The identifier lives in the page and is gone when you close the tab.
- Never your prose. Note text, application text and companion names are forbidden as event properties, and that is enforced in code rather than by convention.
Error reports. When something in Carafolio fails, PostHog may also receive a report of the failure: what broke, on which kind of screen, and the page’s address reduced to its pattern, so that no record or search of yours is in it. Reports pass through the same filter as everything else above. They carry no prose of yours, no email address, and no message text from our own servers.
If we change one of these, we will tell account holders before it takes effect, not after.
Where composition happens
Some of what Carafolio writes is drafted by a language model — the narrative in a bound volume, the practical pages of a city, the answers in Ask, and the parsing of a forwarded flight confirmation.
We send Anthropic the text the task needs and no more. We do not send your address or your name as part of the prompt, and the output is a draft you edit and own rather than something published on your behalf. Your content is not used to train models.
Reading a screenshot is the one exception to sending text alone. If you choose to add a place from a screenshot, we send Anthropic that image so it can find the place's name, address and website, and we say so on the screen before you choose it. Nothing it read is kept unless you keep the place, and then only the place's website, which we use to look up its address for you to confirm. Whatever else the screenshot shows — a message, a notification, a name — is sent with it, which is why the screen suggests cropping it out first. A screenshot of Google Maps is not read.
Nothing here decides anything about you. No automated process determines whether you are admitted, what you are charged, or what you may do.
Forwarded travel email
You can forward a flight confirmation to a Carafolio address so the itinerary becomes a trip. When that happens we receive the whole message — written by an airline or an agent, not by you — which typically carries a passenger name, a booking reference, and the flights. The message body is stored privately, read by an automated parser, and purged thirty days after it arrives, whether or not the trip was saved.
Your rights
Depending on where you live you may have the right to ask for a copy of what we hold, to correct it, to have it erased, to restrict or object to what we do with it, and to receive it in a portable form.
You can export what you kept, and close your account, yourself — both are in Settings. For anything else, including erasure beyond what closing does, write to sbeerling@carafolio.com. A person reads it, and we do not refuse.
Closing your account removes your sign-in, your email address and your profile, and removes the circles and trips nobody else was in, together with the photographs in them.
What you contributed to a circle or trip you shared with other people stays with them, because it is part of their record as much as yours: the places you added, the notes and photographs you left there, and any volume bound from it, including one you bound yourself. It stays without your full name. Notes you wrote read as a former member's, and where a volume records who bound it, or who was in it, it keeps your first name and initial. A printed copy already in somebody's hands is beyond our reach.
We keep this on the basis of the other members' legitimate interest in their own record. If you want any of it erased entirely — a volume, a photograph, a note — write to us, before or after you close, and we will weigh that request and tell you what we did.
Children
Carafolio is not for children. Accounts are by invitation, and we do not knowingly hold information about anyone under 18. If you believe a child has an account, write to us and we will close it.
Changes
If we change this notice we will change the date below. Where a change is material we will tell account holders by email before it takes effect.