Privacy Policy for Carolado

Last updated: 11 November 2026

This privacy policy applies to the Carolado app for iPhone and Android, to its use with CarPlay and Android Auto, to the web version of Carolado and to the website carolado.com. It explains which personal data we process, why, on what legal basis and for how long. Your rights are listed at the end.

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

KernelHost GmbH
Registered office: Krottenbachstraße 277, 1190 Vienna, Austria
Mailing address: Schußwallgasse 5/9, 1050 Vienna, Austria
Email: info@kernelhost.com
Phone: +43 650 8209883
Company register: FN 646015 y, Commercial Court of Vienna

For all questions about data protection and for your rights under section 9, contact us at info@kernelhost.com or by post at the mailing address.

2. Summary

• You can use Carolado without an account. We then only know you by a random device ID. Our servers store only a check value derived from it, from which the ID cannot be recovered.
• We process all data on servers owned by KernelHost GmbH in a data centre in Frankfurt am Main, Germany.
• Carolado shows no profile-based advertising, sells no data and contains no analytics, advertising or crash reporting services of other companies. We do not set cookies.
• We process your location when you plan routes, navigate, report, vote or share it with friends.
• The app only sends trip points for traffic conditions, the traffic forecast and your trust score if you have explicitly answered “Yes” once. They carry no name, only a random device ID (pseudonymous). We cut off the start and end of every trip and keep the data only briefly. You can withdraw your consent at any time in the settings (section 3.4).
• For live traffic, our server sends the course of your planned route to TomTom, without your device ID and without your IP address.
• To prevent abuse, we check contributions automatically and keep a trust score per device or account. This is profiling (section 3.6).
• The apps use services from Apple or Google to prove that the genuine app is running on a genuine device (section 3.6).
• You buy Premium through the App Store or Google Play. We do not receive your payment details (section 3.14).
• IP addresses only appear in error and security messages of our web server. We delete these after 14 days at most (section 3.20).
• You can delete all data about your device or account yourself in the app (section 7).

3. What data we process and why

3.1 Random device ID

When you first start Carolado, it creates a random ID of 32 characters. It contains no information about you or your device. We do not use advertising IDs or serial numbers. The app sends the ID with requests to our servers.

Our servers never store the ID in plain text. They use a secret key to calculate a check value (HMAC) from it and store only that. We use the check value to link reports, votes, trust, Premium, friends and your account to your device. We also use it to limit the number of requests.

On the iPhone, the ID is stored in the keychain. It stays on this device and is not transferred to other devices with backups. On Android, it is stored in the app settings and excluded from the device backup. In the web version, it is stored in your browser’s storage. After “Delete my data”, “Delete account” and “Sign out”, the app creates a new ID.

Legal basis: Art. 6(1)(b) GDPR (providing the functions you use) and Art. 6(1)(f) GDPR (legitimate interest in protection against abuse and overload).

3.2 Map, search and routes

For Carolado to work, the app sends the following requests to our servers:

• Map tiles for the area you are viewing.
• Reports, map suggestions and speed cameras for the map area and along your route. The server only learns coarse cells of 0.25 degrees.
• Search requests with the text you entered, the language and, if you have allowed location access, your location so that nearby results come first.
• Route requests with start, destination, stops and your route options (for example avoiding tolls, motorways or ferries). In truck mode, the details of your vehicle are added.
• Requests for speed limits with the course of the route or your most recent location points.
• About every 2 kilometres or 5 minutes, a request with your location so that the server can determine the country. This decides whether speed cameras, average speed checks and police reports may be shown. This request contains no device ID.
• Requests for opening hours of search results and for the Latin spelling of street names.

Routing and search receive your device ID only for request limits (section 3.6). We use these requests only to answer them and do not store them. For technical logs, see section 3.20.

Legal basis: Art. 6(1)(b) GDPR.

3.3 Location when reporting and voting

Reporting. When you report something (police where permitted, accident, traffic jam, hazard, roadworks or closure), the app sends the type of report, your current location and its accuracy. If you are driving, your direction of travel is added, as well as whether the report concerns the opposite carriageway. The iPhone and Android apps also send whether your operating system marks the location as simulated. The server stores the report with location, direction, country, time, expiry time and the check value of your device ID.

Other users see the report on the map and are warned on their route. They do not see your name or your device ID.

Reporting by voice. You can also speak a report. In the iPhone and Android apps, the operating system recognises speech on the device only; if that is not possible, the apps do not offer voice input. In the web version, your browser handles speech recognition: depending on the browser, its maker (for example Google for Chrome, Apple for Safari) processes the recording on its servers under its own privacy terms. We receive neither the recording nor the recognised text, only the report chosen from it, just as with tapping. The microphone is only active while the app is visibly listening.

Voting. For “Still there?”, the app sends your answer, your location and its accuracy. The server uses this to check whether you are nearby. It stores the vote, its time, its weight and the check value of your device ID, not your location.

Expiry. Every report expires on its own; without confirmation after 30 minutes to 24 hours depending on the type. Confirmations extend it, at most to 4 hours (police, traffic jam), 5 hours (accident), 12 hours (hazard), 7 days (closure) or 30 days (roadworks). We delete the report and all its votes 24 hours after it expires or ends. You can delete your own reports earlier.

Legal basis: Art. 6(1)(b) GDPR for the community function, Art. 6(1)(f) GDPR for the checks in section 3.6.

3.4 Trip points, only with your consent

Your choice. The apps and the web version ask you once whether you want to contribute trips, with the answers “Yes” and “No”. Only after a “Yes” does the app send trip points to our server during navigation. If you say “No”, it sends none, and you can still use Carolado to navigate. You can change your decision at any time in the settings under “Privacy” with the “Contribute trips” switch. Withdrawal takes effect from that moment; processing up to then remains lawful.

What is sent. While you navigate, the app records a trip point about every 5 seconds and sends the points in batches about once a minute. A trip point consists of time, location, accuracy, speed and direction of travel, plus a random trip ID that is newly created for each navigation and whether the location is simulated. Trip points carry no name. Our server links them only through the check value of your random device ID; they are therefore pseudonymous, not anonymous. In the built-in simulation, the app sends no trip points.

What we use them for:

• Traffic conditions and traffic forecast: From many trips, we calculate travel times per road segment, day of the week and quarter of an hour, and so recognise where traffic slows down.
• Trust: The server measures distance and driving time itself. A day with at least 10 minutes of real driving counts as a driving day and lets your trust score grow in small, limited steps.
• Drive-by check: A confirmation only counts fully if the server saw you near the report shortly before.

How we keep the data small:

• The raw points of a trip are only held in a buffer in memory. They are attached to a key calculated from device and trip ID; the points themselves carry no device ID. We remove evaluated points continuously and all others no later than 30 minutes after the last batch. When you end navigation, we evaluate the rest and delete the buffer for this trip.
• We never evaluate the first and last 500 metres of a trip. This keeps places such as your home and workplace out.
• We discard points that are older than 15 minutes or less accurate than 50 metres, as well as simulated points.
• For the drive-by check, the server keeps at most 60 locations per device (at most one every 20 seconds) for 20 minutes.
• Per device, we keep daily values (minutes and kilometres driven, whether a driving day was reached) for at most 2 days. Only your trust score is kept permanently.
• For traffic conditions and the traffic forecast, we only store totals per road segment and quarter of an hour (number of trips and travel time values), without any link to a device, account or individual trip. We only show a time slot once at least 3 trips are available. The weight of old values decreases every week. We delete values older than 150 weeks and road segments that nobody has driven for 3 years.

Without consent, your trust does not grow through trips, and your confirmations of reports count only half, because we cannot check the drive-by. All other functions stay the same.

Legal basis: your consent under Art. 6(1)(a) GDPR, and for recording and reading the location on your device also under § 165(3) of the Austrian Telecommunications Act 2021 (in Germany § 25(1) TDDDG).

3.5 Track around reported closures

If you have switched on “Contribute trips” and you report or confirm a closure, the app sends your track around the spot: up to 900 metres before it (the app keeps this only in memory) and up to 8 kilometres, 12 minutes or 1,200 points after it. If you drove less than 300 metres after the report, it sends nothing. From at least two matching tracks of different devices, Carolado learns a detour that helps other drivers.

We store the track with the check value of your device ID for at most 24 hours. It is deleted earlier if the report is deleted or you use “Delete my data”. The resulting detour has no link to you and is valid for at most 24 hours after the last matching trip. Without consent, you can report closures in the same way, just without a track.

Legal basis: your consent under Art. 6(1)(a) GDPR and § 165(3) TKG 2021 (in Germany § 25(1) TDDDG), as in section 3.4.

3.6 Abuse protection, device attestation, trust score and profiling

Carolado depends on reliable reports. So that bots, faked locations and mass reports cannot cause harm, we check contributions automatically:

• Request limits: We count requests per device and per network in fixed time windows. For the network, we calculate a check value (HMAC) from your IP address, for IPv6 for the whole /64 block. We do not store the IP address itself for this. The counters expire with their time window, after about one day at the latest.
• Plausibility: The server remembers the location of your last report or vote for 6 hours. If two actions are impossibly far apart, it rejects the second one.
• Drive-by: see section 3.4.
• Simulated locations: We store reports with a simulated location so that only you can see them. We discard simulated votes and trip points.
• Device attestation (apps only): So that copies and scripts cannot pose as Carolado, the app proves that it is running unmodified on a genuine device. On the iPhone, it uses Apple’s App Attest service to create a key that never leaves the device and has Apple certify it; our server checks the certificate and stores the public key, a counter, the result and the time with the check value of your device ID. On Android, the app requests an integrity verdict from Google Play (Play Integrity); our server has Google decrypt it, checks it and stores only the result with the time, not the verdict. The app then receives a device token valid for 24 hours, which it sends with requests to our servers. We use the result to detect abuse and may use it to limit functions such as reporting, accounts, Premium or downloads for devices without valid attestation. Devices without these services and the web version use Carolado without attestation. Apple and Google process information about the app and device under their own terms.
• Trust score: For every device or account, we keep a score from 0 to 100 with the levels “blocked”, “on probation”, “active”, “experienced” and “trusted”. It depends on confirmed and refuted reports, accepted and rejected map suggestions, driving days measured by the server (only with consent, section 3.4), how often you report and how often the same devices confirm each other. Without an account, you can reach the “active” level at most.
• Effect: The trust score determines how much your votes count, whether your reports appear confirmed to others and trigger an announcement, and whether you may review map suggestions. Anyone who submits a very large number of reports in a short time is muted for 24 hours: their reports then appear unconfirmed until the first confirmation. If they are refuted, trust decreases. Reports from blocked devices are only visible to the device itself.
• Display: Your profile shows your score from the previous day. We do not publish the exact calculation so that it cannot be deliberately circumvented.

This assessment is profiling within the meaning of Art. 4(4) GDPR. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting traffic information against manipulation, protecting other users against false warnings and protecting our services against overload and copies. The key and token of the device attestation on your device are strictly necessary for the secure operation of the service you use (§ 165(3) TKG 2021; in Germany § 25(2) no. 2 TDDDG).

The trust score only affects the community functions. Navigation, search and live traffic do not depend on it. We do not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Whether an account is terminated is decided by a human.

You can object to the assessment (Art. 21 GDPR). We will review your objection. Because abuse protection is the foundation of the community functions, it usually prevails. You then cannot use reporting and voting, but navigation and search remain available. How we inform you about restrictions under the Digital Services Act is described in our Terms of Use.

3.7 Map suggestions, flags and hidden users

Map suggestions. If you suggest a speed camera, a speed limit, a restriction or another map error, we store the type, the value, an optional text (at most 140 characters), the location, the direction, the road concerned and the check value of your device ID. Other users from a certain trust level see open suggestions without your name and vote on them. Open suggestions expire after 30 days. We delete rejected, expired, withdrawn or hidden suggestions 180 days after the decision, and votes on decided suggestions after 90 days. Accepted suggestions become part of our map data and remain; after “Delete my data” they no longer have any link to you. We provide speed cameras and speed limits from the community as part of our map data under the Open Database License (ODbL), without any link to devices or persons.

Flags. If you flag a report or suggestion (wrong, offensive, spam), we store the reason, the contribution, the check value of its author and the check value of your device ID for 365 days. Our moderation only sees a list of contribution, reason, count and time.

Hiding. If you hide an author, we remember this for 180 days. It only affects your device.

Legal basis: Art. 6(1)(b) GDPR, for flags also Art. 6(1)(c) GDPR in conjunction with Art. 16 of the Digital Services Act and Art. 6(1)(f) GDPR.

3.8 Guest name and display name

When you first start the app, you get a guest name made of “Guest” and a random number, for example “Guest48213”. It appears in your profile. Friends see it, and others can send you a friend request with it. We delete guest names without device data and account after 400 days without use.

You can optionally set a display name (at most 30 characters). Your friends and people you send a request to see it. We never show a name on reports or map suggestions.

Legal basis: Art. 6(1)(b) GDPR.

3.9 Account and emails

An account is optional. To register, you provide a username (3 to 20 characters), an email address and a password. We store the password only as a scrypt hash with a random salt, never in plain text. We also store the time of registration, last use, the check values of the devices you are signed in on, whether your email address is confirmed and whether sign-in with a code is switched on. With the account, we take over the trust, reports, Premium and display name of your device.

We use the email address to sign you in and to contact you about your account, for example about restrictions under the Terms of Use. We do not send newsletters or advertising.

Emails from us. We only send these emails:

• after registration and when you change your address, a code to confirm the address. A new address only applies after that; the previous confirmed address receives a notice about the change.
• for “Forgot password”, a code to set a new password, but only to a confirmed address. All other devices are then signed out.
• if you switch on “Sign-in code by email” (only with a password and a confirmed address), an additional sign-in code every time you sign in with your password.

The codes have 6 digits and are valid for 30 minutes, the sign-in code for 10 minutes and only on the device you are signing in on. We store a code only as a check value (HMAC) with purpose, address, expiry and number of failed attempts. We delete it after use; after 5 failed attempts it is no longer valid; regular clean-up deletes expired codes. If you do not confirm an address within 7 days, we remove it from the account. Addresses that Apple or Google provide as confirmed count as confirmed.

The emails are sent by our own mail server on our servers in Frankfurt am Main as noreply@carolado.com, as plain text only, in German or English depending on the app language; they go to the provider of your email address. The mail server does not accept emails; replies to this address do not reach us. To prevent abuse, we count emails per account, per network and per recipient address, for the recipient address only via a check value. The mail server logs deliveries with recipient address and time (section 3.20).

Settings and places. While you are signed in, we store your settings (for example appearance, route options, vehicle and electric car details, colour theme, “Contribute trips”) in the account so that they are available on your other devices. We only store your saved places there (home, work, favourites with name, address line and coordinates) if you switch on “Save places in your account” under “My places”; if you switch it off, we delete them from the account.

Sign-in protection. We count sign-in attempts per network and per username to prevent passwords from being guessed (section 3.6). If you sign out, change or reset your password or sign out on all devices, we block the device IDs of the signed-out devices (as a check value) so that they can no longer access your account. We delete these blocks after 180 days; the block of the ID you created the account with remains until the account is deleted.

hCaptcha. So that programs cannot create accounts en masse, guess passwords or trigger emails, we use the hCaptcha service of Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA, when you sign in, register and use “Forgot password”. In the web version, the challenge only loads when you open the window for signing in, registering or “Forgot password”. In the apps, the check only starts when you tap “Sign in”, “Create account” or “Send code”; the iPhone app also sends the iOS version, the version of the check module and check values of the names of loaded program libraries, the Android app technical device details such as model, manufacturer and system version. hCaptcha receives your IP address and technical information about your browser or device and evaluates how you interact with the challenge. In the web version, hCaptcha sets its own technically necessary cookies with a lifetime of up to 30 days. We only receive the result of the check and have hCaptcha confirm it. hCaptcha processes this data as our processor under its terms; Intuition Machines is certified under the EU-U.S. Data Privacy Framework. More in the hCaptcha privacy policy. There is no hCaptcha when you sign in with Apple or Google.

Legal basis: Art. 6(1)(b) GDPR, for protecting sign-in including hCaptcha Art. 6(1)(f) GDPR. The hCaptcha check is strictly necessary for the secure sign-in you request (§ 165(3) TKG 2021; in Germany § 25(2) no. 2 TDDDG).

3.10 Sign in with Apple or Google

If you choose “Continue with Apple” or “Continue with Google”, Apple or Google confirms your identity with a signed token. We check the token and store the provider, a user number of the provider and, if the provider supplies it as confirmed, your email address. So that the same token cannot be used twice, we keep a check value of it for one hour. When you first sign in, we create your username from your name and set your first name as display name if you do not have one yet; you can change both. With Apple, the email address may be a relay address. We never learn your Apple or Google password.

In the web version, the page loads Google’s sign-in button when you open the window for signing in or registering. Google receives technical data such as your IP address and information about your browser, even if you do not tap the button. If you are signed in to Google in your browser, Google may show the button with your name; this information stays with Google, we only receive it if you sign in with it.

Apple and Google process data for sign-in as independent controllers. Their privacy policies apply.

If you sign in with Apple in the iPhone app, the app also sends a one-time authorisation code. Our server exchanges it with Apple for a token with which we can revoke your Apple sign-in, and stores it encrypted. If you delete your account, we use it to revoke the sign-in with Apple and delete the token. When you delete your account, we also delete the link to Apple or Google.

Legal basis: Art. 6(1)(b) GDPR, for loading the Google button in the web version Art. 6(1)(f) GDPR (legitimate interest in offering you sign-in with Google).

3.11 Friends and location sharing

You can send friends a request using their username or guest name. We store friendships, open requests, the “Sees me” setting per friend and, while you are sharing, your share with its end time. Unanswered requests expire after 90 days. If you block someone, we store whom you blocked and when, until you lift the block or delete your data; the blocked person is not told. Blocks that others have set against you belong to their data and remain even after you delete your data.

Location sharing is off until you switch it on. You choose the duration (1 hour, 1 day or permanently) and which friends can see you. While it is on, the app sends your location with direction, speed and accuracy about every 30 seconds while it is open. In the background, this only happens during navigation.

The server keeps your shared location only in memory, not in the database. It lives as long as the share, for “permanently” up to 30 days after the last transmission. While the share is active, your friends also see your last known location, after 10 minutes without a new transmission as “Last seen …”. In CarPlay and Android Auto, friends who share their location with you appear as destinations; no further data is sent to us for this. If you switch off sharing, we delete the location immediately.

Legal basis: Art. 6(1)(b) GDPR. You decide yourself whether and how long you share and can stop at any time.

3.12 Live traffic via TomTom

When you plan a longer route, our server, never the app itself, asks TomTom for the current traffic situation; during navigation, for example after a recalculation, it may ask again at longer intervals. For this, it sends:

• start and destination as coordinates,
• the course of our route as at most 1,500 points,
• your avoidance options (tolls, motorways, ferries, unpaved roads),
• in truck mode, weight, dimensions, axles, maximum speed and whether you carry dangerous goods.

Your device ID, your IP address, your name and your account are not transmitted. TomTom replies with travel time, traffic jams and alternatives. We do not store the replies. We only count how many requests we make per day.

Recipient: TomTom International B.V., De Ruijterkade 154, 1011 AC Amsterdam, Netherlands.

Legal basis: Art. 6(1)(b) GDPR, because the traffic situation is part of the route planning you request, and Art. 6(1)(f) GDPR.

3.13 Further analysis of your route on our server

For the following functions, the app sends the course of the planned route to our server, where needed with vehicle details, travel time or departure time:

• information on borders, border controls, tolls and vignettes (without device ID),
• break suggestions and the warning about narrow roads, plus the driving time since the last break and, in truck mode, the driving time of the day. The app counts these times only on your device while it is running; only the two numbers are sent with the request to our server, which does not store them. You can view and correct them in your profile,
• charging planning for electric cars with battery size, consumption, state of charge, connector, charging power and preferred providers,
• traffic forecast for the route with the chosen departure time (Premium),
• speed limits along the route,
• lane guidance (which lanes fit at turns; in truck mode with the vehicle details).

We do not store these routes. Results may be cached briefly in memory without any link to you, at most until the end of the day.

Legal basis: Art. 6(1)(b) GDPR.

3.14 Premium, purchase via App Store and Google Play, offline packages and navigation without network

Carolado Premium is an annual subscription that you take out in the app through the App Store (iPhone) or Google Play (Android). It unlocks all colour themes and a custom route colour, the traffic forecast, offline maps and navigation without network.

Purchase. Apple or Google handle the purchase and payment. We do not receive your payment details. This is how we link the purchase to your device or account:

• When you open the purchase page, our server assigns a random purchase ID to your device or account. The app passes it to Apple (as appAccountToken) or to Google (as obfuscated account ID) when you buy.
• After the purchase, when the app starts and with “Restore purchases”, the app sends Apple’s signed receipt or Google’s purchase token to our server. The server checks Apple’s receipt itself; it looks up a Google purchase token with Google Play and acknowledges the purchase there.
• Apple and Google notify our server when a subscription changes, for example on renewal, cancellation, payment problems or refunds.
• We store the store, the subscription ID (with Apple the original transaction ID, with Google the purchase token), product, expiry, status, environment (test or real), time of purchase, the purchase ID and which devices or accounts use the subscription, with the time of last use. A subscription applies to at most 5 devices or accounts; with an account, it applies on all devices you are signed in on.

“Delete my data” and “Delete account” remove the purchase ID, Premium and the link to the subscription. The subscription entry then remains without any connection to your device or account and is deleted 400 days after expiry. Deleting does not end a running subscription: you can only cancel it with Apple or Google, in the app under “Manage subscription”.

Offline packages. The app downloads offline packages and the tiles for navigation without network via a ticket. It requests this ticket once with your device ID so that the server can check Premium. The downloads themselves carry no device ID. The packages are stored only on your device. The app calculates routes without network on the device.

Legal basis: Art. 6(1)(b) GDPR, for keeping subscription entries after expiry also Art. 6(1)(f) GDPR (evidence in case of queries, refunds and abuse).

3.15 Music button

The music button works only on your device. On the iPhone, with your permission, the app reads title and cover from Apple’s Music app and controls playback. If the app offers control of Spotify and you connect it in Spotify, the app connects to the Spotify app on your device; Spotify processes data as an independent controller. On Android, the app uses the notification access you allow in the system settings only to show and control the current playback of other apps. It does not read notifications. Music data does not reach our servers.

Legal basis: Art. 6(1)(b) GDPR.

3.16 CarPlay and Android Auto

If you use Carolado via CarPlay or Android Auto, your phone shows the map, route and instructions on the car’s screen. Supported vehicles also receive the route with manoeuvres, lanes and coordinates via CarPlay, for example for the driver display or head-up display. What the vehicle does with it is determined by its manufacturer. No additional data is sent to our servers.

3.17 Data on your device

Carolado stores on your device the device ID, your settings including your decision on “Contribute trips”, saved places, recent destinations, notices you have already seen and downloaded offline packages. In addition: whether and to which version of the Terms of Use you agreed before your first report, the destination of a running navigation for “Continue trip” (deleted on arrival, with “End”, after “No” and the next time you open the app if the trip is older than 90 minutes) and, in the apps, the device token from device attestation, on the iPhone also the ID of the App Attest key in the keychain. The web version uses your browser’s storage for this (Local Storage). We do not set cookies.

This is necessary for the functions you use (§ 165(3) TKG 2021; in Germany § 25(2) no. 2 TDDDG). Depending on your device settings, settings and saved places may end up in your operating system’s device backup. We exclude the device ID from this.

3.18 Contacting us

If you write to us or call us, we process your contact details (for example email address or phone number) and the content of your message to handle your request. Our mailbox info@kernelhost.com is operated for us by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace) as processor. We keep messages as long as necessary for handling and evidence and delete them no later than three years after your request has been completed, unless a legal obligation requires longer retention.

Legal basis: Art. 6(1)(b) GDPR if it concerns your use of Carolado, for notices under the Digital Services Act Art. 6(1)(c) GDPR, otherwise Art. 6(1)(f) GDPR.

3.19 Website carolado.com

When you visit the pages on carolado.com (such as this privacy policy), our web server processes your IP address, the requested address, the time and technical information about your browser to deliver the page. The pages load no content from other providers, set no cookies and use no analytics or advertising services. We do not log visits; for error and security messages, see section 3.20.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing and securing the website).

3.20 Servers, logs, security and backups

• Servers: All Carolado services run on servers owned by KernelHost GmbH in a data centre in Frankfurt am Main, Germany.
• Encryption: All connections between app, browser and server are encrypted with TLS (HTTPS). The server enforces this.
• Web server logs: Our web server does not write access logs. Error and security messages, for example when a request triggers our protection rules (web application firewall), may contain your IP address and the requested address.
• Community service logs: The community service does not write IP addresses to its logs; where it needs to name a network, it uses a short form of the check value. If someone calls addresses that no genuine app uses (decoys against copies), it writes a line with the path, this short form, the check value of the device ID, the program identifier (user agent) and a decoy key sent along, at most one line per network every 10 minutes. Every hour it writes counts about device attestation, without any link to persons.
• Mail server logs: The mail server logs deliveries with recipient address and time.
• Routing and search: These services only log technical information (time, type and result of a request), no locations, search terms or IP addresses.
• Retention: We delete logs containing IP addresses, email addresses or check values of device IDs after 14 days at most.
• Security: We store passwords only as scrypt hashes, device IDs and IP addresses only as check values. Only a few authorised people have access to the servers, and only with cryptographic keys.
• Backups: We back up the database continuously and daily in encrypted form, also to a separate backup server of our own in the same data centre. Deleted data may remain in backups for up to eight weeks and is then deleted automatically.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and availability) and Art. 32 GDPR.

4. Who receives data

• Other users see your reports without your name, reviewers see your open map suggestions without your name, and friends see your display name and username and, while you share it, your location.
• TomTom receives the details from section 3.12 for live traffic, without any link to you.
• Apple and Google process data as independent controllers when you use their app stores, sign in with them, buy Premium through them or the app uses their device attestation (App Attest, Play Integrity). For purchases, the integrity verdict and revoking Sign in with Apple, our server contacts Apple or Google, and both notify our server of changes to your subscription (sections 3.6, 3.10 and 3.14). If you have allowed sharing analytics with app developers on your device, Apple or Google provide us with crash reports and usage statistics without reference to your person.
• Google Ireland Limited operates our email mailbox as processor (section 3.18).
• hCaptcha (Intuition Machines, Inc., USA) receives the details from section 3.9 as processor when you sign in, register and use “Forgot password”.
• Cloudflare, Inc. (USA) operates the name servers for carolado.com. Your device or your DNS provider looks up the address of our servers there; your connections to Carolado do not run through Cloudflare.
• Spotify processes data as an independent controller if you connect the music button with Spotify.
• Vehicle manufacturers receive the route via CarPlay if your vehicle supports this (section 3.16).
• Authorities and courts only receive data if we are legally obliged to provide it. If we become aware of a criminal offence that threatens the life or safety of persons, we inform the competent authorities in accordance with Art. 18 of the Digital Services Act.

There are no other recipients. We do not sell data and do not pass data on to advertising partners.

5. Transfers to countries outside the EU

Our own servers are located in Germany, including our mail server. TomTom is based in the Netherlands, Google Ireland Limited in Ireland. Apple, Google and Spotify may also process data they process as independent controllers in the USA. Data that hCaptcha and Cloudflare process for us and Google Workspace may be processed in the USA. The basis for this is the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), under which Intuition Machines, Cloudflare and Google LLC are certified, supplemented by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) in the contracts of these providers.

6. How long we keep data

7. Deleting data in the app

Without an account: Profile, “Delete my data”. We delete your device data with trust score, your reports and their votes, your votes, your map suggestions that were not accepted, your flags and hidden users, friendships, requests, share and shared location, display name, guest name, tracks around closures, running trip points, daily values, Premium, purchase ID, the link to a subscription and the device attestation. Accepted map suggestions remain as map data, without any link to you. Flags by others about your contributions also remain without any link to you. The app then creates a new device ID.

With an account: Profile, “Delete account”, confirmed with your password (for accounts with Apple or Google only, without a password). We delete everything as above, plus your account, the synced settings and places, open email codes, the link to Apple or Google, the device attestations and the references to all your devices, and we revoke a sign-in with Apple at Apple (section 3.10).

Subscription: A subscription with Apple or Google does not end when you delete. Cancel it there first, in the app under “Manage subscription”.

Without the app: If you have an account, you can also request deletion by email to info@kernelhost.com. Details are on the page Delete account and data.

If you only uninstall the app, the data remains on our servers until it expires as described in section 6.

8. No obligation to provide data

You are not legally or contractually obliged to provide us with data. Without location access, you can plan routes in the apps from a start point you choose, but you cannot navigate, report or vote; the map and search work. Without an account, you can use everything except the account functions. Without consent to “Contribute trips”, the consequences in section 3.4 apply.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

Withdrawing consent (Art. 7(3) GDPR): You can withdraw your consent to “Contribute trips” at any time with the switch in the settings. This applies for the future.

Objection (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

Permissions in the operating system: You can revoke location, microphone and speech recognition (reporting by voice), access to the Music app and notification access at any time in your device settings.

How to exercise your rights: You can exercise most rights directly in the app (section 7). Otherwise write to us at info@kernelhost.com. If you have an account, please write from the email address confirmed in your account and state your username. Without an account, we only know the check value of a random device ID and cannot attribute data to you (Art. 11 GDPR); please use the functions in the app.

10. Complaints to the supervisory authority

You can lodge a complaint with a data protection authority. The authority responsible for us is the

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

You can also contact the supervisory authority in the EU country where you live or work.

11. Minimum age

Carolado is intended for people aged 16 and over. Anyone younger may not use Carolado or create an account. If we learn that an account belongs to a person under 16, we delete it.

12. Changes

If Carolado’s functions or the legal situation change, we will update this privacy policy. The current version is available in the app and at carolado.com/en/privacy. If new processing requires your consent, we will ask you beforehand.