Privacy

The short version

Carry On is operated by Chase Allbright in South Carolina, United States. This notice applies globally and explains how we handle information when you use Carry On.

Information we collect

Clerk handles account creation and authentication information, including the email address and other details you provide to Clerk. Clerk uses essential authentication cookies so that you can sign in and stay signed in. Carry On does not store account passwords.

Carry On stores an opaque Clerk user ID and the trip data you create, including a trip title and travel dates, itinerary items and notes, access policy, membership, version, and timestamps.

Our providers may process request and security logs, such as IP address, browser, device, and request details. We also collect support and privacy communications that you send to us.

How we use information

We use information to provide, secure, maintain, and improve Carry On; authenticate accounts; save and share trips according to their access policy; respond to requests; and comply with legal obligations.

Analytics

Carry On currently uses aggregate server-side trip metrics to understand service activity. There is no client-side analytics SDK today.

If we introduce future analytics, it may be first- or third-party and may process account-linked page and feature activity, device and browser information, referral information, and approximate IP-derived location data. It may use a pseudonymous account identifier, cookies, or similar storage across sessions. We will provide consent or controls where required. Carry On will not intentionally send trip titles, notes, or itinerary text to external analytics tools. Adding a new provider or a materially different use requires an update to this notice.

Email communications

Clerk currently sends authentication and verification email, including sign-in codes. Carry On does not currently operate an email delivery program separate from Clerk. If we introduce one, we may send necessary account, security, and service messages, including policy notices. We may separately offer optional product or marketing email; each marketing email will include an unsubscribe method. Opting out of marketing email does not stop necessary messages.

Trip privacy and sharing

Private is the default: only the owner can access a private trip. Specific-user invitations are not currently available. Owners may instead choose a link-view policy for anyone with the link to view, or a link-edit policy for anyone with the link to view and edit. Link recipients can forward links, and noindex is not access control.

Some older trips have no owner. The first signed-in person who opens one of those legacy trip links may claim that trip and become its owner.

Service providers and disclosures

We use Clerk for authentication, Vercel to host Carry On, and Neon for the database. They process information on our behalf to provide their services. We may also disclose information when legally required, to protect Carry On and its users, or in connection with a merger, acquisition, financing, or sale of assets; these are not routine disclosures of trip content.

Sales and targeted advertising

Carry On does not currently sell personal information or use it for cross-context behavioral advertising. If that practice materially changes, we will update this notice and provide any choice required by applicable law.

Retention, security, and deletion

Trips remain stored until they are manually or administratively deleted; there is no automatic retention period and no self-serve trip deletion. Deleting your Clerk account does not automatically delete trips. Provider backups, security logs, and records retained for legal reasons may remain after an active trip record is deleted.

We use reasonable administrative and technical safeguards, but no online service can guarantee perfect security. Do not put passport numbers, payment details, booking references, or other highly sensitive information in a trip.

Your choices and rights

You can request access, correction, or deletion of your personal information, and make requests available under local statutes, by contacting privacy@carryon.travel.

International processing

Information may be processed in the United States and other locations where our providers operate.

Children

You must be at least 13 to use Carry On. If you are below the age of majority where you live, you need permission from a parent or guardian.

Changes

We may update this notice as our practices change. We will post the updated version here and revise the date above when a change is made.

Contact

For privacy questions or requests, contact privacy@carryon.travel.