Privacy Policy

Last updated and effective from: 22 October 2026

This Privacy Policy explains what personal data Carbetic ("Carbetic", "we", "us") processes, why, and what rights you have. It applies to the Carbetic mobile app on iOS and Android, to the app "T1D Babysitting by Carbetic" on iOS and Android, and to the website carbetic.app (see section 14). T1D Babysitting, the network for families of children with type 1 diabetes and babysitters, is described in section 5.

Who is responsible (data controller): Diego Szekely, sole trader (Carbetic), Rudolfgasse 1, 2380 Perchtoldsdorf, Austria
Contact: diego@carbetic.app · Legal notice

We are not required to appoint a data protection officer, so enquiries go directly to the address above. For safety questions and reports in T1D Babysitting, write to safety@carbetic.app. Authorities can reach us at legal@carbetic.app (section 17).

This policy is also available in German and French.

1. The data we process

1.1 Data you give us

• Meal inputs: the photos you take or upload, and any recipe link, text description, or voice note you submit for analysis.
• Your condition (optional): during setup you may tell us whether you have type 1 diabetes, type 2 diabetes, obesity (adipositas), none of these, or prefer not to say. This is health-related data (see section 1.3).
• Healthcare-professional status (optional): whether you use Carbetic personally or as a healthcare professional.
• Access & cooperation details (optional): if you redeem a partner, doctor, or cooperation code, we may store the name, email, and (for some codes) clinic and country you enter to grant that access.
• Clinical-study details (optional): if you join a study cohort or ask to receive study results, we store your trial ID and/or email and a record that you gave consent, with the date and time.
• T1D Babysitting (optional): if you use the network, what you enter there, such as your profile, your address and your messages. Section 5 lists all of it.

1.2 Data created when you use Carbetic

• An anonymous account ID: on first launch the app creates an anonymous identifier for your install. It is not your name, email, or a device advertising ID, and we do not use it to identify you personally. If you want to publish, write messages or review in T1D Babysitting, you link this ID to a sign-in with Apple, Google or your email address (section 5.4). Otherwise it stays anonymous.
• App and device data: app version, device type and operating system, language, your IP address, and an approximate location derived from it (see section 1.4).
• Usage and diagnostics: in-app events (for example which steps of setup you complete), crash reports, and performance data.
• Subscription status: your plan (Free, Standard, Unlimited) and entitlement state, and the purchase records our server checks with Apple and Google (section 1.5). Payments themselves are handled by your app store; we do not receive your full card details.
• Marketing-attribution data: if you installed Carbetic from an ad, limited measurement data that tells us the ad worked (see section 13.2).
• Link data (Android): if you installed Carbetic through one of our own links, which link it was, and the status and plan of subscriptions you start afterwards (see section 13.1).
• Push token (optional): if you allow notifications.

1.3 Health-related data (special category)

The condition you can optionally tell us at setup (type 1 / type 2 diabetes or obesity) is special-category (health) data under the GDPR. We process it only with your explicit consent, keep it separate, and do not link it to your meal photos or to anything you share through "Help improve Carbetic".

The meal scans and photos you may optionally share to improve Carbetic are stored without your condition and without any identifier; they are food images, not a record of your health. We never use any of this for advertising.

T1D Babysitting has its own rules for health information: a sitter's own type 1 diabetes and a child's type 1 diabetes are shown only with explicit consent (section 5.7). We do not use your condition answer in the network and never show it to anyone.

1.4 Approximate location

When you use Carbetic, we derive a coarse location, such as your country or region, from your device's IP address. We use it only to select country-specific nutrition data for your meal estimates, because the menus and recipes of restaurant and fast-food chains differ from country to country.

• For this, Carbetic does not access GPS or your device's location services, and does not determine your precise location.
• We do not use this location for advertising and do not build a location history.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in accurate estimates (Art. 6(1)(f) GDPR).
• T1D Babysitting uses your device's location only if you choose "Current location" as the search area and allow it, only while you use the app and only with approximate accuracy. Your phone rounds the position to the centre of a square of about 5 km, and only that rounded point is sent to our server. It is used for that search only and is never stored, not even in the safety log (section 5.10). Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Your profile always uses the address you type and shows others only an approximate area (section 5.9).

1.5 Plans and purchase checks (both apps)

A Carbetic plan bought in either app, on iPhone or on Android, unlocks the carb counter in both apps for the same account. To make this work, and so that you do not pay twice, our server checks purchases with Apple and Google.

• What the apps send: after a purchase or a restore, and from time to time, the app sends our server the signed purchase information from the App Store (iPhone) or the purchase reference from Google Play (Android), together with your anonymous account ID. Current versions of both apps do this for every plan, also if you never use T1D Babysitting.
• What our server asks: it checks the purchase with Apple (App Store Server API) or Google (Google Play Developer API). Apple and Google also tell our server about renewals, cancellations, refunds and expiry.
• What we store: the store and the app, the product, plan and period, transaction identifiers, start, expiry and renewal status, whether the plan is shared through Family Sharing, whether it was a test purchase, and which account the purchase belongs to. When you buy, the app gives the store a code derived from your account ID, so the purchase can be matched to your account. This code is not your name or email.
• What we use it for: to unlock your plan in both apps, to show "You're already subscribed through Carbetic" instead of a second offer, and to prevent one purchase from being used by several people.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• How long: while the plan is active, and up to 400 days after it has ended, to handle refunds and disputes.

Payments are still made only through Apple or Google (or Stripe on the website, section 14.4). We never receive your card details.

1.6 Apple Health and Health Connect (optional, Carbetic app only)

The Carbetic app can add the meals you save to Apple Health (iPhone) or Health Connect (Android). It does this only if you turn on "Apple Health" or "Health Connect" in its Settings and allow it on your phone's permission screen. Until then it is off.

• What is added: the estimated carbohydrates of each meal and, when available, its calories, protein, fat, fibre and sugar, plus any extra nutrients you had switched on in Advanced analysis when the meal was analysed (such as sodium or iron). Each entry also carries the time you saved the meal, its name when it has one, and a reference to the meal in Carbetic. Never your meal notes or photos.
• Which meals: the meals your Analysis counts. Meals you leave out of your Analysis are not added, and recipes only once you enter the portion you ate. Meals you saved before turning it on are added only if you say yes when the app asks.
• Changes and deletions: while it is on, a meal you edit in Carbetic is updated there too, and a meal you delete in Carbetic (one at a time, all at once or with "Delete my data") or leave out of your Analysis is removed there.
• Only added, never read: Carbetic asks only for permission to add nutrition data. It never reads anything from Apple Health or Health Connect, including data from other apps. To update or remove its own entries, it uses a list of what it added, kept in the app on your phone.
• Where it is stored: the app writes the data directly into Apple Health or Health Connect on your phone. This feature sends nothing over the internet and nothing to our servers. From then on, Apple Health or Health Connect keeps the data under your control, including any backup or sync you have set up there.
• No advertising, no sale, no sharing: we never use this data for advertising, marketing or profiling, never sell it, never share it with anyone and never use it to train AI. Our app analytics may record how you use this setting, for example that you turned it on or off, but never a meal or a nutrition value. On Android, our use of Health Connect follows Google Play's Health Connect policy, including its Limited Use requirements.
• Other apps: apps you allow to read nutrition data in Apple Health or Health Connect can use these entries, including insulin or looping apps. The values are estimates. The app warns you about this before you turn it on.
• Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give by turning it on and allowing it on your phone. You withdraw it by turning the setting off.
• Turning it off and deleting: turn it off in Carbetic's Settings at any time. The app then stops adding, updating and removing meals; if you turn it on again later, it applies the changes and deletions you made in between. To take away Carbetic's access, open the Health app and tap your profile picture, then Apps, then Carbetic, or open Health Connect, then App permissions, then Carbetic. Meals already added stay there until you delete them there, one by one or everything from Carbetic at once. Carbetic cannot remove them once you have uninstalled it.

2. Analysis of your meals (not stored by us)

When you ask Carbetic to analyze a meal, the photo, voice note, or text you submit is transmitted securely to one or more third-party AI processing partners that generate the carb estimate and return it to the app.

• We do not permanently store these inputs on our own servers.
• Our AI partners process them on paid, business terms under which your content is not used to train their models, and they retain it only briefly (typically up to ~30 days) for security and abuse prevention before deleting it.
• The resulting estimate and the photo are saved on your device as your meal history, and stay there until you delete them or uninstall the app. If you turn on Carbetic Follow, daily summaries (and photos only if you enable them) are additionally shared as described in section 4.

Sections 2 to 4 apply to the carb counter, in the Carbetic app and in the app "T1D Babysitting by Carbetic".

3. Optional: extended data sharing

You can choose to let us use your meals to build, analyze, and improve Carbetic's products, features, AI, and research. This is off by default. If you switch it on:

• We store the meal scans you create, including the photos, and any corrections you make to an estimate, so our models can learn from real examples.
• We store this in pseudonymized form: it is kept under a separate random identifier, decoupled from your anonymous account, your condition, and any email you may have given us.
• We use it to develop, train, test, and improve Carbetic's carb-recognition and other AI; to build and improve current and new features and products; for nutrition, food-recognition, and product research; for analytics; and to create de-identified, aggregated datasets and statistics. We may share it with Carbetic and the partners who help us with these purposes, under contracts that limit them to that use. We do not use it for advertising, and we will ask you again before using it for any genuinely new, unrelated purpose.
• It is based on your consent, which you can withdraw at any time in Settings. Withdrawing stops any further use of your data. Data that has already been incorporated into a trained model cannot be individually extracted from that model, but it will be excluded from all future training, and the underlying stored copy will be deleted.
• It never includes anything from T1D Babysitting (section 5.24).

4. Carbetic Follow: sharing your data with people you choose

Carbetic Follow is an optional feature that lets you share your carb log with a person or organisation you trust, for example your family or a team that supports you. Nothing is shared until you enter their follow code in the app and explicitly confirm on the consent screen.

4.1 What is shared

• Daily summaries of your logged meals for the last 90 days and, while sharing stays active, each new day: meal times, estimated carbohydrate and related nutrition values, how each entry was created (for example 3D scan or text input), and daily totals.
• Meal names and ingredients, unless you switch them off.
• Meal photos, only if you switch them on (off by default).
• The profile you choose for sharing: the name you enter, your date of birth, and your chosen avatar.

As everywhere in Carbetic, this is food and nutrition information (section 1.3): it is not a medical record. Nothing from Carbetic Follow or your carb log is ever shown to anyone in T1D Babysitting.

4.2 Who receives it

The person or organisation whose follow code you entered can view this data on our web dashboard at follow.carbetic.app after signing in to their own account. We show you their name and organisation before you consent. You choose the recipient; how they use what they see is their responsibility.

4.3 Storage

Shared data is stored for this purpose with the cloud providers described in section 7. A record of your consent (what you agreed to and when) is kept as proof of consent (Art. 7(1) GDPR).

4.4 Legal basis

Sharing is based on your consent (Art. 6(1)(a) GDPR), given on the consent screen when you connect. You can withdraw it at any time.

4.5 Stopping and deletion

You can stop any connection at any time in Settings. Stopping deletes the shared copy of your data, including photos, from the dashboard and our servers; the consent record is retained as proof. The recipient can also remove the connection on their side, which equally deletes the shared data.

4.6 The dashboard account (for people who view shared data)

If someone shares their data with you and you use the dashboard at follow.carbetic.app, we store your account data: your name, email address, sign-in method (Google, Apple, or email and password), the organisation name you enter, your follow code, your display preferences, and a record of your acceptance of the dashboard notice. We process this to provide the dashboard (Art. 6(1)(b) GDPR). You can delete your dashboard account at any time in its settings, which removes your account data and ends your connections.

5. T1D Babysitting: the network for families and sitters

This section applies when you use T1D Babysitting. Using the network is optional.

5.1 What the network is, and who is responsible

T1D Babysitting helps families of children with type 1 diabetes (T1D) and babysitters with T1D experience find each other and talk. You can use it in the Carbetic app (the "T1D Babysitting" button at the top of the home screen) and in the app "T1D Babysitting by Carbetic". It is one network with one account in both apps. It is available worldwide, except in Cuba, Iran, North Korea and Syria, where our cloud provider cannot operate.

Carbetic only helps people find each other and talk. We are not an agency, not an employer and not part of any agreement between members. We check identity only. We do not check backgrounds, criminal records, qualifications or diabetes skills.

The controller is Diego Szekely, Carbetic (section 17). For the profiles that members publish, the member and we can be jointly responsible: you decide what your profile says, and we decide how profiles are shown, checked and protected. Under this arrangement we handle all requests about your data, the security of the network and moderation. You are responsible for what you publish about yourself and, as a parent, about your child. You can always exercise your rights with us (section 5.23).

5.2 The two apps

• Carbetic is the carb-counting app. The network opens from a button at the top of its home screen.
• T1D Babysitting by Carbetic is a separate app whose home screen is the network. It also contains the Carbetic carb counter; sections 2 to 4 apply when you use it. Like Carbetic, it creates an anonymous app ID on first start (section 1.2) and registers your device for notifications (section 5.18). It contains no advertising or attribution tools.
• Between the two apps: each app can check on your device whether the other one is installed, so it can offer to open it or to continue with the same account. On iPhone, the two apps share a small note on your device for this: your account ID, your first name (shown in that offer), whether and with which provider you are signed in, and whether you have a plan. It contains no email or password, and it never leaves your device.
• One account: if you sign in with the same Apple or Google account, or the same email address, in both apps, both apps use the same account, profile and plan (section 1.5).

5.3 Looking around without an account

You can open the app and look around without an account and without an ID check, using your anonymous app ID. To see sitters and families near you, you publish a profile. No ID check is needed for that, only to send messages. Until then, the map shows blurred example people and no real data. To show results, we process your app ID, the area you look at (a place you type, the centre of the map or, if you choose it, your current location rounded to a square of about 5 km; section 1.4) and technical data needed to prevent misuse. For safety, searches and profile views are also recorded in our safety log (section 5.10).

To stop people from copying profiles, we count how many profiles an app ID and a network address open within a period. For network addresses we store only a code calculated from the address range with a secret key, never the IP address itself (section 5.22).

Everyone who has published a profile sees the information on sitter and family profiles, including a sitter's own diabetes if the sitter agreed to show it (section 5.7), and all photos. Nothing is blurred (section 5.6). Visitors without a published profile see no real profiles or photos, only a blurred example map. People who are not members can report by email (section 5.16).

Legal bases: performance of our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in protecting members from copying (Art. 6(1)(f)).

5.4 Your account and sign-in

To publish a profile, write messages or write reviews, you create an account by signing in with Apple, Google or your email address. We link this sign-in to your existing anonymous app ID, so your Carbetic data stays with you.

• From Apple we receive a user identifier, an email address and, if you share it, your name. If you use "Hide My Email", the email is a private relay address. We use the name only to fill in your details. The name others see is the first name you type, and after your ID check the name from your ID (section 5.6).
• From Google we receive a user identifier and your email address. As part of Google's standard sign-in, Google also passes on the name and profile picture of your Google account. We do not use the picture and never show either to others. The app may show you the first name, to tell you which account you are signed in with. Your name in the network is the first name you type, and after your ID check the name from your ID (section 5.6).
• With your email address you get a sign-in link by email. Our email-delivery provider Resend sends it for us; if that fails, Google (Firebase Authentication) sends it instead. We receive your email address and the confirmation that you opened the link. You do not need a password. If you open the link on another phone, the app asks for your email address again.
• Your email address is part of your account data. Other members never see it: it does not appear on your profile, in messages or in notifications. We use it only for the purposes below.
• What we use them for: to sign you in on any phone and in both apps, and to recognise you when you write to us from that address (section 5.23). Statements of reasons after a moderation decision and other notices about your account reach you in the app (section 5.16).
• Your network account also records which roles you have (family, sitter or both), your account status, in which app you created it, when you last used the network, and the app, platform, version and language of your last network request, so that notices reach you in your language.
• Devices: when your account is signed in on a new device, or in the other Carbetic app, we tell your other devices. Under "Sign-in and devices" you see which devices use your account (platform, app, last use) and can sign them out.
• Network Terms: before your first profile is saved, you accept the Network Terms and the Community Guidelines by ticking "I agree". We record the version and the time, and ask you again when a new version applies (section 5.19).

If your Carbetic app is part of a clinical study, it cannot be linked to a sign-in. You can still look around.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

5.5 Identity check with Didit

You can publish a profile without the ID check. You need it to send messages. You do it once, and it is free. Reviews can only be written after both people have sent messages, so everyone who writes one has passed the check. Our processor Didit (Barcelona, Spain; data processed in the EU) runs the check with its component inside the app. When the check starts, this component looks up the approximate country of your IP address through IP-location services (ipapi.co, country.is, ipwho.is); only your IP address is sent to them.

Separate from your carb scans. Your ID check is separate from your 3D carb scans. We never link the two.

Before the check you tell us your birth month and year, if you have not already done so for your profile (section 5.6). If you want to babysit and are younger than 16, the check does not start. The check compares your birth month and year with your ID.

What Didit processes: photos of your identity document, a live selfie and a short liveness check, a comparison of your face with the photo on the document (biometric data), the data printed on the document (names, date of birth, document number, nationality, issuing country, expiry date), and technical data about your device and connection, to detect fraud.

Your explicit consent. Comparing your face is processing of biometric data to identify you (Art. 9(1) GDPR). We ask for your explicit consent on a separate screen before the check (Art. 9(2)(a)). This consent also covers the automated result of the check (section 5.17). You can withdraw it at any time; this affects only future checks. Without the check you can still look around and publish a profile, but you cannot send messages, and so cannot write reviews.

What happens to the images. Right after the decision, we ask Didit to delete the whole session, including the images, the video and the face comparison. If a check needs a manual review, Didit keeps the session for up to 14 days until the review is done. Didit compares your face only with your own document, never with other people's selfies, keeps no face template, and may not use your data for its own purposes.

What Carbetic keeps:

• that you are verified, the date, and the provider;
• your verified first name or names and the first letter of your last name (your display name in the network after the check);
• your birth year and month (to show your age and to know whether you are 16 or 17), whether you are an adult, and the birth month and year you told us before the check;
• the country that issued your document;
• ID fingerprints: codes calculated with a secret key from your document number, any national ID number, and your names with your date of birth. They cannot be turned back into your data. We use them only to detect duplicate accounts and to stop removed members from joining again;
• a reference to the Didit session without personal data, for 90 days.

What Carbetic never stores: document images, selfies, videos, face data, document numbers, your full date of birth, your last name from your document (we keep only its first letter), your nationality or the address on your document.

Legal bases: your explicit consent for the face comparison (Art. 9(2)(a)); performance of our contract with you for the result (Art. 6(1)(b)); our legitimate interest in preventing fraud, duplicate accounts and the return of removed members, which protects children and all members, for the fingerprints (Art. 6(1)(f)).

"ID verified" on a profile means only that an ID document matched the person's live selfie on that date and that the age, duplicate and removal checks passed. It says nothing about character, skills or health.

5.6 Profiles

Sitter profile: display name (your first name and the first letter of your last name, as you typed them; after the ID check, from your ID), age (adults can hide it; always shown for 16 and 17-year-olds), up to 6 photos (photo 1 shows you), a text about you, your answer to "What experience do you have with diabetes?" (I have diabetes myself; my partner, my best friend or someone in my family has diabetes; or something else, in a few words), the devices you know (marked as self-declared), up to 8 hobbies, languages and levels, optional hourly and overnight rates, your approximate area, since when you are a member and ID verified, and reviews once you have 4 or more.

Family profile: display name (as for sitters, but no age), up to 6 optional photos (photo 1 is your profile photo; the others can be family photos, which may show your children), a text about the family, with your consent (section 5.7) the number of children with T1D, their age bands (0-2, 3-5, 6-9, 10-13, 14-17) and the diabetes devices they use, languages, an optional budget, your approximate area, and reviews once you have 4 or more. Family profiles never contain children's names, birthdays or schools.

Before the ID check: you can publish a profile without the ID check. We then store the first and last name you type and the birth month and year you tell us. Your last name is stored privately and never shown in full. We use the birth month and year to show a sitter's age and to make sure that sitters are 16 or older and families 18 or older, and that sitters aged 16 or 17 confirm that a parent or guardian agrees (section 5.8). Your profile shows your first name and the first letter of your last name, without "ID verified". It never shows your birth month and year; sitter profiles show only the age. The ID check later compares the birth month and year with your ID, and after the check the name shown comes from your ID (section 5.5).

Who sees what:

• Sitter profiles, including those of sitters aged 16 and 17, can be seen by everyone who has published a profile in T1D Babysitting.
• Family profiles can be seen by everyone who has published a profile in T1D Babysitting. People without a published profile, with or without an account, see no sitter or family profiles.
• Photos, family photos included, are visible to everyone who can see the profile. Nothing is blurred.
• You do not need the ID check to publish a profile. You need it to send messages (section 5.5).
• A person you are in a conversation with can still see your profile while the conversation is open, even if you paused your profile.
• You can pause your profile at any time. It then disappears from search and from the map.

Photos of children: family photos may show your children. As their parent or guardian, you decide whether to post them, and you are responsible for that choice. Post only photos of children you are allowed to share. Like the rest of your family profile, they are visible to everyone who has published a profile in T1D Babysitting. We never name or tag the children and do not analyse faces. You can delete a photo at any time.

Photo handling: the app removes location and other metadata, and our server encodes every photo again. Real photos are shown only through links that stop working after a short time, and the app has no button to download, save or share another member's photos.

Checks before publishing: profile texts and photos are checked automatically before others see them (section 5.12). A profile goes live only after your acceptance of the Network Terms, and for sitters aged 16 and 17 only after they confirm that a parent or guardian agrees (section 5.8).

Profiles are shown only inside the apps. They have no public web pages and are not indexed by search engines.

Legal basis: performance of our contract with you (Art. 6(1)(b)), also for family photos you choose to add and for the first and last name and the birth month and year you give before the ID check. For health information, see section 5.7.

5.7 Health information and your consent

Some profile details are health data (Art. 9 GDPR). We process them only with explicit consent, which you give on a separate step with a checkbox that is not pre-ticked.

• Sitters: the answer "I have diabetes myself" reveals your own health. We show it only with your explicit consent, given at that field (Art. 9(2)(a)). Like the rest of a sitter profile, it can then be seen by everyone who has published a profile. The other answers (partner, best friend, family member or something else) never name the other person.
• Families: a family profile can show the number of children with T1D, their age bands and the diabetes devices they use. As the parent or legal guardian, you give explicit consent for this on behalf of your child at the end of creating your profile (Art. 9(2)(a)). Without it, your profile is published without these details. Because the network is for families of children with T1D, a published family profile shows in any case that you are looking for a sitter for a child with T1D. Like the rest of the family profile, this information can be seen by everyone who has published a profile in T1D Babysitting.

You can withdraw consent at any time in the profile settings. The information is then hidden at once. A family profile stays published without the child details.

In messages, you decide yourself whether to share health information. We store it only to deliver it to the person you chose, never analyze it, and delete it with the message (section 5.11).

The network never receives your carb log, glucose data, Carbetic Follow data or your condition answer from the Carbetic app, and never passes a child's data from Carbetic to a sitter.

5.8 Sitters aged 16 and 17

Sitters can be 16 or 17. Families must be 18 or older. We check the age with the birth month and year you tell us, and the ID check confirms it. For sitters aged 16 and 17:

• before they publish a sitter profile, the app asks them to tick one box: "My parent or guardian agrees that I babysit". We record that they ticked it, with the time and the version of the text (section 5.19). We do not ask for or store any data about the parent or guardian;
• the profile always shows their age;
• reports of sexual content or harassment involving them are treated as the most urgent cases (section 5.16).

If a parent or guardian does not agree: they can write to safety@carbetic.app, also without an account. We then take the sitter profile offline and close its open conversations. This is not a penalty. We keep their message and our note on the outcome as a case (section 5.22). Once the matter is resolved, the sitter can tick the box again and publish the profile again.

Legal bases: performance of our contract (Art. 6(1)(b)) and our legitimate interest in protecting young sitters and in proving the confirmation (Art. 6(1)(f)).

5.9 Address and approximate area

Your profile never uses your device location. To publish a profile, you type your address once.

• Check: we ask Google Address Validation whether the address exists. We use only its verdict, and corrections of postcode and town that you accept.
• Position: our server turns the address into map coordinates once, using the OpenStreetMap Nominatim service. Only the address is sent, without your name, account or IP address. If that does not work, we use the centre of your postcode from the open GeoNames dataset, which is stored on our own servers.
• Approximate area: we place you in a grid square of about 2 km (sitters) or 3 km (families and anyone with a family profile) and put your point at a random place inside that square. The place stays the same until you change your address. On the map, your profile appears as a soft circle around that point, never as an exact point. In villages and remote areas, and when a family lives at the same address, the square is larger. You can always choose a 5 km square or show only your town.
• Nothing exact is kept: street, house number and exact coordinates exist only in memory during this step. They are never stored and never shown to anyone.

What we store: country, postcode, town, the result of the address check, the grid square at the smallest size for your role (so you can change the area size without typing your address again), your published point and area choice, and a code calculated from your address with a secret key (to recognise the same address again, for example for the larger square at a shared address).

What others see: a circle that covers your approximate area (about 2 km for sitters and 3 km for families, or larger if you chose a larger area), or only your town; distances only in bands (under 20 km, 20 to 35 km, 35 to 50 km, over 50 km); and a map that cannot zoom to street level.

Legal bases: performance of our contract (Art. 6(1)(b)) and our legitimate interest in keeping homes private and preventing fake locations (Art. 6(1)(f)).

5.10 Search, order of results, favourites and the safety log

To show results, we compare published points and work out distance bands. Inside a band, the order is shuffled per viewer and per day, and complete profiles get a small boost. There is no paid ranking and no ranking by reviews or activity. We do not create a profile of your interests for this. "How results are ordered" in the app explains the details.

Favourites are stored with your account. Only you see them. They are removed when the other profile is deleted.

User numbers: the Digital Services Act requires us to tell the authorities, if they ask, how many people use the network. For this our server notes whether an app ID used the network in a calendar month and keeps only the monthly total.

Safety log: to investigate misuse such as stalking, our server keeps a log of searches and views in the network. For each search it records the app ID or account, the time, the approximate search area (a grid square, never exact coordinates, and nothing at all for a search around your current location), the distance band and the number of results. For each profile view it records who viewed which profile and when, and for each photo view, who received which photo and when. You cannot see the log, and it is not used for ranking, advertising or analytics. Only our moderators can open it, to look into a safety case, and every look at it is logged too. Entries are deleted automatically after 12 months.

Legal bases: performance of our contract (Art. 6(1)(b)); for the monthly total, our legal obligation (Art. 6(1)(c)); for the safety log, our legitimate interest in safety and in preventing abuse, which protects members and children (Art. 6(1)(f)).

5.11 Messages

What we process: the text and photos you send, the time, whether a message was delivered and read (you can switch read receipts off; you then also do not see other people's), whether someone is typing, and whether you muted or hid a conversation. For the conversation list, our server keeps a copy of the first 80 characters of the last message. If you switch on "Show message previews" on a device, its notifications show up to 120 characters; that copy is removed from our servers as soon as the notification is sent.

Photos: you pick them from your photo library. The app removes location and other metadata, and our server encodes the photo again. Photos are stored in a private storage area and shown only through links that stop working after at most 90 minutes. They are checked automatically before delivery (section 5.13).

Encryption and access: messages are encrypted in transit and when stored, but not end to end. Apart from the fixed check for contact details when a message is sent (section 5.14), our servers never read, scan, translate or analyze the text of messages. People at Carbetic see messages only when someone in the conversation reports messages from it or reports the other person (section 5.16), or when the law requires it. For a report of messages, our moderators see the reported messages and up to 20 before and after them. For a report of the other person, they see the last 20 messages of the conversation before the report. Photos in these messages are included and are shown to them only through links that stop working after a short time. Every access is logged.

Blocks: if you block someone, the conversation closes for both of you. The messages stay on our server until their normal deletion date, so that a report can still be handled.

Legal basis: performance of our contract with you (Art. 6(1)(b)). Where the chat counts as a communications service, we also follow the rules on the confidentiality of communications (Art. 5 of the ePrivacy Directive and § 161 of the Austrian Telecommunications Act 2021).

5.12 Automatic checks of profiles, photos and reviews

There is no manual approval. Before others see them, your photos, profile texts, your "something else" answer and reviews are checked automatically. We use no artificial intelligence for these checks.

• Photos (on profiles and in messages) are checked by Google Cloud Vision SafeSearch, processed in EU regions. It rates how likely a photo shows adult, violent or racy content. A photo that is likely adult or violent, or very likely racy, is not published. SafeSearch does not recognise faces and does not identify who is shown. We also remove location and other metadata, encode the photo again and limit its size and file type.
• Profile texts, the "something else" answer and reviews are checked with fixed rules for phone numbers, email addresses, links and messenger names, words from a short list of banned words, and the length. Reviews are never checked for whether they are positive or negative.
• We keep only the result and the reason. If a check fails, you see what to change and can ask a person to review it (section 5.17). If the service is not available, nothing is published until the check can run.
• Google processes the photos on our behalf and does not use them to train its models.

Other rules in the Community Guidelines, for example which photos you may post, are not checked automatically. We act on them when someone reports a breach.

Legal bases: performance of our contract with you (Art. 6(1)(b)), because these checks keep the network within its rules, and our legitimate interest in keeping members and children safe (Art. 6(1)(f)).

5.13 Photos in messages and their automatic check

Before a photo in a conversation is delivered, Google Cloud Vision SafeSearch, processed in EU regions, checks it automatically for adult and violent content, in the same way as profile photos (section 5.12). There is no separate consent for this check. It is part of the chat. The check looks only at the image. It does not recognise faces and never sees the message text.

• A photo that passes is delivered. We keep only the result of the check with the message.
• A photo that fails is not delivered and is deleted within 24 hours. You see that it was not sent and can ask a person to review the decision.
• If someone reports a photo, a copy goes into the protected case file (section 5.16).
• Google processes the photos on our behalf and does not use them to train its models.

Legal bases: performance of our contract (Art. 6(1)(b)) and our legitimate interest in protecting members and children from sexual and violent images (Art. 6(1)(f)). Where the chat counts as a communications service, we also follow the rules on the confidentiality of communications. For evidence that contains health or other special-category data: the establishment, exercise or defence of legal claims (Art. 9(2)(f)).

5.14 Contact details in messages, and safety tips

To keep conversations in the app, where reporting and blocking protect you, phone numbers, email addresses and messenger links or handles (for example WhatsApp, Telegram, Signal, Instagram, Snapchat or Facebook) cannot be sent in messages. The app checks the text while you type, and our database checks it again when the message is saved, with the same fixed patterns. Dates, times, prices, postcodes and ages are not affected. A message that matches is not sent. Nothing about it is stored, and no one is told about it.

If you type something that looks like a bank account or a payment request, or words that may be abusive or sexual, the app may show a short tip. When you receive such a message, the app may show a tip under it. This check runs only on your device. Nothing about it is sent to us or stored.

Legal basis: our legitimate interest in keeping members, and especially children, safe (Art. 6(1)(f)).

5.15 Reviews

Once both people in a conversation have sent at least one message, each can write one review about the other: 1 to 5 stars, up to 3 tags from a fixed list, and a text. Reviews are from people who messaged each other on Carbetic. We don't check whether they met. A review is published at once. If you write a new review about the same person, it replaces your earlier one. Reviews are checked automatically (section 5.12).

A published review shows the author's display name, role (family or sitter) and the month it was written. Reviews and the average are shown only once a profile has 4 or more reviews. You can always see the reviews about you. There are no public replies. Authors can delete their review at any time, and anyone can report a review. If the author deletes their account, the review stays without their name ("A family" or "A sitter"). If the reviewed person deletes their account, all reviews about them are deleted.

Legal bases: performance of our contract for the review function (Art. 6(1)(b)); our legitimate interest in showing honest reviews to other members (Art. 6(1)(f)).

5.16 Reports, blocks, moderation and authorities

Reports: you can report a profile, a conversation, a single message, a photo or a review in the app. People without the app can write to safety@carbetic.app. We store the report (reason, the details written, who reported, when) and a copy of the reported content made by our server: the profile, the reported messages with up to 20 before and after them, the photo or the review. If you report someone you have chatted with, our moderators also see the last 20 messages of your conversation before the report, with the photos in them (section 5.11). We never tell the reported person who reported them.

Protective hiding: the reported account is hidden at once, until a person decides (normally within 24 hours), after a report by an ID-verified member that a child may be at risk or of threats (or of sexual content or harassment involving a sitter aged 16 or 17), or after reports by 3 different ID-verified members within 7 days. Reports by visitors are reviewed first but never hide anyone automatically.

Blocks: we store who blocked whom, so that the block works in both directions.

Moderation: Diego Szekely and one named backup moderator review reports, normally within 24 hours. The backup moderator acts on our instructions and is bound to confidentiality. We store the case, our decision, the reasons, the statement of reasons we send you in the app, and a log of every action and of every look at evidence. Measures range from a warning to removing content, limits, suspension and removal from the network. You can ask for a review of any decision by writing to safety@carbetic.app within 6 months; you can also go to court.

Notice to past contacts: if a member is removed after a safety review, for example because a child was at risk or because of threats, sexual misconduct or fraud, we may tell the people that member wrote to that the member is no longer on T1D Babysitting after a safety review, with safety tips. We do not say why.

Authorities: if we suspect a crime that threatens someone's life or safety, we inform the police or other competent authorities and give them the relevant data, such as the case, the account, the verified first name, birth year and document country, the profile, and relevant messages and photos (Digital Services Act, Art. 18). We answer orders from authorities and courts (Digital Services Act, Art. 9 and 10; contact legal@carbetic.app) and information requests the law allows, for example under § 13 of the Austrian E-Commerce Act, only after checking that they are valid. We keep no IP addresses in our own records; the request logs of our cloud provider can contain IP addresses for 30 days (section 5.22).

Legal bases: legal obligations under the Digital Services Act (Art. 6(1)(c)); our legitimate interest in keeping the network safe, protecting children and defending legal claims, and the interest of past contacts in their own safety (Art. 6(1)(f)); for health data in evidence, the establishment, exercise or defence of legal claims (Art. 9(2)(f)).

5.17 Automated decisions and your right to a human review

Some decisions in the network are made automatically:

For each decision we tell you the main reason. You can ask a person to review it ("Ask for a human review" in the app, or safety@carbetic.app), give your point of view and contest the decision (Art. 22(3) GDPR). The legal bases are the performance of our contract (Art. 22(2)(a)) and, for the ID check, which uses biometric data, your explicit consent (Art. 22(2)(c) and (4)).

5.18 Notifications

• By default, network notifications never show message text, health information or information about children: only the sender's display name and, for example, "Sent you a message". You can switch on "Show message previews" separately on each device; the text then appears on your lock screen. Photos never get a preview.
• We send notifications about new messages and photos, a reminder when you have not replied to a message for about a day, reviews, the result of your ID check, your profile status, the outcome of your reports, moderation and safety notices, and sign-ins on a new device. We never use them for advertising.
• If someone publishes a profile within about 50 km of yours, we may send you a notification, at most one a day, for example "A new babysitter joined near you" or "A new family joined near you". It uses only the approximate area already stored for your profile and shows no name or other details. It is not sent between 21:00 and 08:00 in your local time and waits until the morning. You can switch it off in the notification settings.
• Each app registers your device for notifications with a push token, which app it is, the language and time zone, whether notifications are allowed, whether this device shows network notifications, and whether previews are on. If both apps are installed on one phone, network notifications go to the T1D Babysitting app.
• The app asks for permission after your first profile is published. Messages also work without notifications.
• Notifications are delivered through Apple Push Notification service and Firebase Cloud Messaging. The delivery record on our server is deleted after 7 days.

Legal basis: your consent, given in your phone's notification prompt (Art. 6(1)(a)).

5.19 Records of consents and notices

We record, with the version of the text and the time: your acceptance of the Network Terms and the Community guidelines; each consent you give or withdraw (ID check, your health information, your child's health information); the confirmation by a sitter aged 16 or 17 that a parent or guardian agrees; and when you close the safety notice in a conversation. This proves that you were informed and agreed. Closing the safety notice is not a consent.

Legal bases: the legal obligation to prove consent (Art. 6(1)(c) with Art. 7(1) GDPR) and our legitimate interest in proving that safety information was shown (Art. 6(1)(f)).

5.20 Who receives network data

• Other members: what you publish, as described in sections 5.6 and 5.15. The people you write to receive your messages.
• Didit (processor; Barcelona, Spain): the ID check (section 5.5).
• Google (processor): hosting and database (Firebase and Google Cloud; database in the EU, functions and file storage in Frankfurt), sign-in links by email (Firebase Authentication), notification delivery (Firebase Cloud Messaging), and the photo check (Cloud Vision SafeSearch, EU regions).
• Resend (processor; email delivery, EU region): your email address and the sign-in email it sends for us (section 5.4).
• Google Maps Platform Address Validation: the address you type, once, to check it. For this service Google may also process the data under its own privacy terms.
• OpenStreetMap Foundation (Nominatim service, United Kingdom): the address you type, once, without your name or account, to find its approximate position.
• Apple and Google as sign-in providers (independent controllers): when you sign in.
• Apple and Google as app stores (independent controllers): when you buy a plan. They send us purchase information (section 1.5).
• Apple (APNs) and Google (FCM): deliver notifications.
• Map providers: Apple Maps (iPhone) and Google Maps (Android) receive the map area you look at, to draw the map. They do not receive your address.
• Our email provider (processor): hosts our mailboxes, where we receive and answer your emails.
• Our backup moderator: a named person who reviews reports on our instructions and under confidentiality.
• Police, authorities and courts: when the law requires it (section 5.16).

We do not sell network data and do not give it to advertisers. You can ask for the current names of all providers at diego@carbetic.app.

5.21 Transfers outside the EU

Network data is stored in the EU. Some providers or their parent companies are outside the EU:

• Google LLC (USA) may access data that Google stores in the EU. Google is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses apply as a fallback.
• Apple Inc. (USA): sign-in, notifications and the App Store, under the Data Privacy Framework or Standard Contractual Clauses.
• OpenStreetMap Foundation (United Kingdom): the EU has decided that the United Kingdom offers an adequate level of protection.
• Didit processes the data in the EU.
• Resend (Plus Five Five, Inc., USA) sends our sign-in emails from its EU region. Resend is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses apply as a fallback.

5.22 How long we keep network data

On your device, the app keeps a cache of profile and message photos. It is deleted with the conversation, when you leave the network and when you delete your network account.

5.23 Leaving, deleting and your other rights

You have all the rights described in section 11. For the network:

• Leave network: hides your profiles and closes your conversations; both sides can still read them. Your account, verification and favourites stay, and you can come back.
• Delete profile and account (Profile tab, Account): deletes your profiles and photos, your address data, your favourites, your blocks, reviews about you, your verification result, your photos in messages, and your Apple, Google or email sign-in with your email address (for Apple, we also revoke Carbetic's access to your Apple ID). Your carb-counting data and your plan stay. What we keep, and for how long, is in the table in section 5.22. Someone who signed in but never accepted the network terms can delete that sign-in in the same place.
• Your carb-counting data: "Delete my data" in the carb counter's settings (General, Data & Privacy) deletes your scan history and meal photos on your phone, turns data sharing off and asks us to delete the Carbetic data we store for you, which we do within 30 days. Purchase records and shop orders are kept as described in section 9.
• "Former member": after you delete your network account, the people you wrote to keep the text messages you sent until they expire (24 months after sending), shown as "Former member" without your name or photo. This is pseudonymised, not anonymous: the other person knows who wrote. We keep them because the conversation is also theirs, and for safety (Art. 6(1)(f)).
• Without the app: use carbetic.app/delete-account or email diego@carbetic.app from the email address you sign in with. Deleting does not cancel a plan; cancel it in the App Store or Google Play.
• Access and copy: write to diego@carbetic.app from the email address you sign in with, or tell us your account ID (Profile, Account). We send you your network data, including your profile, favourites, the messages you sent, reviews by and about you, consents and notices, as a machine-readable file within one month.
• Correction: edit your profile in the app. After the ID check, your name comes from your ID and is corrected by verifying again.
• Withdrawing consent: health information in the app settings; the ID check consent as described in section 5.5.
• Objection: you can object to processing based on our legitimate interest by writing to us. We stop unless we have compelling reasons, for example the protection of children.
• Human review of automated decisions: section 5.17.

5.24 What we never do with network data

• No advertising, no ad tracking and no sale of data.
• No use for training AI models, and no use in "Help improve Carbetic" (section 3).
• No network content or activity (profiles, searches, messages, reviews, location or health details) goes to analytics, attribution or marketing services.
• No forwarding of a child's carb logs, glucose data or Carbetic Follow data to sitters.
• No use of your device location, except the rounded point for a search around your current location, if you choose it (section 1.4).

6. Why we use your data, and our legal bases

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, you can object (section 11).

7. Who we share data with

We share data only with service providers ("processors") who handle data on our behalf and under contract, and, if you switch on the optional "Help improve Carbetic" setting (section 3), with the partners who help us with the purposes described there. Recipients fall into the following categories:

• Cloud hosting, database, and authentication providers store your anonymous account record and app data.
• AI processing partners analyze your meal inputs to generate estimates (section 2).
• Analytics and crash-diagnostics providers help us understand usage and fix problems.
• Push-notification provider delivers notifications if you opt in.
• Marketing-measurement / attribution provider measures ad performance if you arrived from an ad.
• App-store and payment providers process your subscription and confirm purchases to our server (section 1.5).
• People you choose (Carbetic Follow): if you connect with a follow code, the recipient you chose sees the data described in section 4. This happens at your direction and is never sharing for advertising.
• Apple Health and Health Connect: if you turn this on, the app writes your meals into the health app on your own phone (section 1.6). We do not receive this data and do not pass it on.
• T1D Babysitting: other users see what you publish in the network, as described in section 5.6. We use Didit for identity checks; Resend to send sign-in emails; Google for hosting, sign-in links by email (as a backup), notifications, address checks and the automatic photo check; OpenStreetMap Nominatim to place addresses on the map; Apple and Google for sign-in and maps; and an email provider for our mailboxes. Details are in section 5.20.

We may also disclose data if required by law, to protect our rights or users' safety, or in connection with a business transfer.

You may request the current list of the specific named providers we use at any time by emailing diego@carbetic.app.

8. International data transfers

Some of our providers process data in countries outside your own, including the United States. Where we transfer personal data outside the EEA/UK, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses, UK Addendum, or an adequacy decision / Data Privacy Framework certification. You can request a copy of the relevant safeguards at diego@carbetic.app. For T1D Babysitting, see section 5.21.

9. How long we keep data

• Meal inputs sent for analysis: not retained by us; deleted by our AI partners shortly after processing (typically within ~30 days).
• On-device meal history and photos: stored on your device until you delete them or uninstall.
• "Help improve Carbetic" data (if you opt in): the identifiable part (your meal photos) is kept for up to 36 months, or until you withdraw consent or ask us to delete it, whichever comes first. The anonymized part (carbohydrate/nutrition values under a random id, with no photo and no identifier) may be kept indefinitely for statistics and model improvement.
• Account, condition, and access data: until you ask us to delete it, or your account becomes inactive for an extended period.
• Purchase records (section 1.5): while the plan is active, and up to 400 days after it has ended.
• Analytics and diagnostics: typically up to 14 months.
• Link record of an Android install (section 13.1): as long as your account data, or until you object or ask us to delete it. The click counts per link contain no personal data and may be kept indefinitely.
• Carbetic Follow shared data: until you or the recipient end the connection (deleted right away) or you ask us to delete it; consent records are kept as proof of consent.
• Clinical-study data: until the study ends or you withdraw.
• Meals added to Apple Health or Health Connect (section 1.6): kept there, not by us, until you delete them there. The app's list of what it added stays on your phone and is deleted with the app.
• T1D Babysitting: see the table in section 5.22.

10. How we protect your data

We use encryption in transit (SSL/TLS), pseudonymization of training data, anonymous accounts by default, access controls, and reputable infrastructure providers. No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data.

T1D Babysitting: network data is encrypted in transit and at rest; messages are not end-to-end encrypted. Profiles and photos are served only through our server and through links that expire. The number of profiles that can be opened is limited to prevent copying. Exact addresses and ID images are never stored, and ID fingerprints and address codes are calculated with secret keys. The people who moderate use dedicated staff accounts protected by a passkey or security key, and every look at reported content is logged.

11. Your privacy rights

If you are in the EEA or UK (GDPR), you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to processing;
• data portability;
• withdraw consent at any time (including the "Help improve Carbetic" setting and the consents in T1D Babysitting, section 5.23); and
• lodge a complaint with your local data protection authority. As we are established in Austria, the competent authority is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at. You may also complain to the authority where you live or work.

Do you have to give us your data? No. Using Carbetic requires only the meal input you choose to submit. Everything marked optional in section 1 is genuinely optional, and declining it costs you nothing except the feature it powers. T1D Babysitting is optional too: to publish a profile, you need a sign-in, an address, your first and last name and your birth month and year, and to send messages, also an ID check; health information and photos in messages remain optional. For the forms on our website, the fields marked as required are needed for us to reply at all.

Automated decision-making. Carb estimates are produced automatically by AI, but they are only estimates for your own use and not a decision about you. In T1D Babysitting, some decisions are made automatically, for example the result of the ID check; section 5.17 explains them and your right to a human review. Apart from that, we do not take any decision about you that produces legal effects or similarly significantly affects you (Art. 22 GDPR), and we do not profile you for such decisions. Carbetic is not a medical device and must not be used as a basis for treatment decisions.

If you are in California (CCPA/CPRA), you have the right to: know, access, correct, and delete your personal information; opt out of the "sharing" of personal information; limit the use of sensitive personal information; and not be discriminated against for exercising these rights. The only personal information we share (as that term is defined by the CCPA) is the optional "Help improve Carbetic" data, which is off by default; turning that toggle off (or leaving it off) opts you out. Data you share through Carbetic Follow is disclosed at your direction to the recipient you choose and is not "sharing" for cross-context behavioral advertising. Meals the app adds to Apple Health or Health Connect are written on your phone and never reach us, so they are neither sold nor shared.

12. How to exercise your rights (and a note about anonymous accounts)

To make any request, email diego@carbetic.app, or use the in-app Settings → Privacy controls to change consent or delete your data. In T1D Babysitting, the controls are in the Profile tab.

Most Carbetic accounts are anonymous: there is no login, and we do not know who you are. We normally identify your data by the anonymous ID on your device. To act on a request we may need you to make it from within the app (or provide your in-app ID) so we can locate the right data. This also means that if you uninstall the app, the data stored only on your device is gone and cannot be recovered by us.

If you use T1D Babysitting with a sign-in, please write from the email address you sign in with. If you use Apple's "Hide My Email", tell us that relay address or your account ID (Profile, Account).

13. Tracking and advertising

13.1 Our own links

We share links to the app ourselves, for example in our Instagram profile: carbetic.app/install, or carbetic.app/install/ followed by a short name for the place where the link was posted. We count how many installs, free trials, and paid subscriptions each link brings, so we know which links work. We do this ourselves, without an advertising or attribution company, without cookies, and without your device's advertising ID.

• Android: Google Play tells the app which of our links you came from: the link's name, and when the link was opened and the install started. On first launch, the app sends this once to our server, together with the anonymous ID of your install, your anonymous account ID, and the app version. If you then start a subscription, the app sends the purchase reference that Google Play gave it, and our server asks Google Play for that subscription's status (free trial, paid, cancelled, or ended) and plan. We ask again regularly so the counts stay current. A subscription you already had before you opened the link is not counted for the link. If you did not come through one of our links, the app sends nothing for this.
• iPhone and iPad: the app does nothing for this. Apple counts downloads, free trials, and subscriptions per link in its App Store analytics and gives us only totals per link, leaving out groups smaller than five people. We receive nothing about you individually.
• We look at these numbers only as totals per link. We do not use them to advertise to you, do not pass them on, and do not combine them with your meals, photos, or condition.
• Legal basis: our legitimate interest in knowing which of our own links work (Art. 6(1)(f) GDPR). You can object at any time by emailing diego@carbetic.app; we then delete the link record of your install.

What happens when you open one of these links in your browser is described in section 14.6.

13.2 Ads

If you installed Carbetic from an ad, we use a marketing-measurement / attribution service to confirm the install and key events (such as starting a trial) so we can measure and improve our advertising. On iOS, this only happens if you allow it through Apple's App Tracking Transparency prompt. We do not use your health-related data, meal photos, or condition for advertising.

13.3 T1D Babysitting

T1D Babysitting data is never used for advertising or tracking and never goes to analytics, attribution or marketing services. The app "T1D Babysitting by Carbetic" contains no advertising or attribution tools. The only usage figure for the network is the monthly total described in section 5.10.

14. The carbetic.app website

Everything above describes the apps. This section describes the website, which is a separate system with its own, much smaller set of data.

14.1 No tracking, no advertising cookies

The website contains no analytics, advertising, or tracking scripts and sets no tracking cookies. Your browser stores two purely technical values on your own device: the language you selected, and, once you have sent the healthcare-professional form, a note that you already sent it so you are not shown the form twice. Neither is transmitted to us as an identifier, and you can clear both in your browser at any time. Because this storage is strictly necessary for functions you asked for, no cookie banner is required.

14.2 Server logs

Our hosting provider records standard log data whenever a page is requested: IP address, date and time, the page requested, the referring page, and your browser and operating system string. This is needed to deliver the site and to detect and defend against attacks (Art. 6(1)(f), our legitimate interest in a functioning and secure website). These logs are kept only for a short period and are not used to build a profile of you.

14.3 Forms on the website

The website offers a small number of forms. Data you enter is stored on our hosting account outside the publicly accessible web directory and is also sent to us by email. In each case we store your IP address and the time of submission for a short period to limit abuse and spam (Art. 6(1)(f)).

• Healthcare-professional form (/doc): form of address, name, clinic or practice, postal address, email, phone, your message, and which follow-up you asked for (call, visit, patient materials). We use this to answer your enquiry, send the materials you requested, and arrange any follow-up you asked for (Art. 6(1)(b), steps taken at your request, and Art. 6(1)(f)). We keep it for as long as the professional contact is live and for a reasonable follow-up period afterwards.
• Job applications (/jobs and /apply): name, email, optionally phone, Instagram handle, what you currently do, how many hours per week you could contribute, a link to your work, and any file you choose to upload. We use this solely to assess your application (Art. 6(1)(b), steps prior to a contract). Uploaded files are stored under a random file name outside the public web directory and are not reachable from the internet. We delete applications at the latest six months after the position is filled or the process ends, unless you agree that we may keep yours on file.
• Individual landing pages maintained with partners may carry a simple contact form. It collects only what the form shows, is used only to answer you, and follows the same rules.

Providing this data is voluntary; without at least a name and an email address we cannot reply. Your data is not used for advertising and is not passed on for anyone else's purposes.

14.4 Paying on the website

If you subscribe through the website rather than an app store, payment is handled by Stripe. Your card details go directly to Stripe and we never receive the full card number. Stripe processes payment data as an independent controller under its own privacy policy at stripe.com/privacy; we receive only the payment status and the details we need for our records and tax obligations (Art. 6(1)(b) and Art. 6(1)(c)).

14.5 Email

If you write to us, for example to diego@carbetic.app, safety@carbetic.app or legal@carbetic.app, your message and address are stored in our mailbox at our email provider so we can reply and keep a record of the correspondence (Art. 6(1)(b) and Art. 6(1)(f)). Messages to safety@carbetic.app about T1D Babysitting are handled as described in section 5.16.

14.6 Opening one of our app links

When you open one of our app links (section 13.1), our server reads your browser's user-agent string at that moment only to decide where to send you: the App Store, Google Play, or a page with both. It adds one to a counter for that link and that kind of device (iPhone, Android, other, or link preview). We do not store your IP address, your browser string, or any identifier for this, and we set no cookie. The store link we send you to carries only the link's name. Our hosting provider (section 14.2) and our cloud provider keep their standard request logs, which include the IP address and browser string; our cloud provider deletes them after 30 days. Legal basis: Art. 6(1)(f), our legitimate interest in sending you to the right store and knowing which links work.

15. Children

If you are under 16, you may use the carb counter in the Carbetic app only with the permission of a parent or guardian (Terms of Use, section 4.1). A Google Family Link account, which a parent sets up, counts as that permission. Where the carb counter relies on consent, for example for the condition you can tell us at setup (section 1.3), a parent or guardian gives that consent for a child under 16, or agrees to it (Art. 8 GDPR). T1D Babysitting is not for people under 16, in either app, and the app "T1D Babysitting by Carbetic" is only for people 16 and older (see below). If you believe a child under 16 uses Carbetic without a parent's or guardian's permission, contact diego@carbetic.app and we will delete the child's data.

In T1D Babysitting, families must be 18 or older. Sitters must be 16 or older, and sitters aged 16 or 17 confirm that a parent or legal guardian agrees (section 5.8). We check the age with the birth month and year given, and the ID check confirms it. Children of families are never users. Parents describe them only with the details in sections 5.6 and 5.7, never with names, birthdays or schools. Parents may add family photos that show their children. Like the whole family profile, these are visible to everyone who has published a profile in T1D Babysitting (section 5.6). To report a concern about a child's safety, write to safety@carbetic.app. In an emergency, call your local emergency number.

16. Changes to this policy

We may update this policy from time to time. If we make material changes, for example to how we use data to improve our AI or to T1D Babysitting, we will update the date above and notify you in the app. Where the law requires, we will ask for your consent again.

17. Contact

Diego Szekely (Carbetic)
Rudolfgasse 1, 2380 Perchtoldsdorf, Austria
diego@carbetic.app (privacy requests and everything else)

T1D Babysitting: safety questions, reports, child safety and appeals against moderation decisions: safety@carbetic.app. Authorities, including orders under the Digital Services Act: legal@carbetic.app. Both in German and English.

For EU/EEA and UK users, you also have the right to contact your local data protection authority.