Privacy Policy

Last updated: 23 August 2026

Carpy is built to know as little about you as possible. Free designs are computed entirely in your browser and never leave it. Premium exports are generated on our server: your design's settings are sent over, used to produce the file, and discarded — we keep no copy of your designs. This page explains the little we do handle. The service is operated by Carpy ("we"), reachable at hello@carpy.io.

1. What we store

• No account: nothing. You can design and export boxes without ever signing in.
• With an account: your e-mail address and your subscription status (whether you're Premium, which plan, and billing bookkeeping like the subscription ID from our payment provider). That is the entire database row.
• On your device: material presets and app preferences you save are stored in your own browser's local storage — they stay on your machine and never reach our servers.

2. Who processes it for us

• Supabase hosts our accounts database and handles the passwordless e-mail sign-in links.
• Lemon Squeezy is our merchant of record: they run the checkout, process your payment, handle taxes and send receipts. Your card details go to them, never to Carpy. Their own privacy policy applies to the checkout.
• Our website host serves the app files. We run no ads, no tracking pixels and no third-party analytics.

3. E-mail we send

Sign-in links when you ask for them, receipts and billing notices via Lemon Squeezy, and replies when you write to us. When you become a Premium member you agree that we may also use your account e-mail to keep you informed: changes to Carpy itself (new features, important fixes), changes to these terms or this policy, and occasional news about what we're building. Every news e-mail carries a one-click unsubscribe; service and legal notices are part of running your account and continue for as long as it exists. We never sell or share your address, and there is no other marketing.

4. How long we keep it

Your account row exists for as long as your account does. If you delete your account (or ask us to), the row is removed — and because that's all we store, there is nothing else to remove. Payment records held by Lemon Squeezy are kept by them as required by tax law.

5. Your rights

You can ask us at any time to show you the data we hold about you (it will be a short e-mail), correct it, export it, or delete it. If you're in the EU/EEA or UK, these are your GDPR rights — access, rectification, erasure, portability, and the right to complain to your local data-protection authority. Write to hello@carpy.io and we'll sort it out quickly.

6. Cookies and local storage

We use browser storage for what the app needs to function: keeping you signed in, remembering your presets and preferences, and saving your current box design so it is still there when you come back. Designs stay in your browser and are never sent to our servers. No advertising or cross-site tracking cookies.

7. Changes

If we ever change what we collect — for example, adding privacy-friendly usage counters — we'll update this page and note it in the app before the change applies.