Privacy policy
Last updated 2 November 2026.
This explains what personal data HelpCarry uses, why, who helps us run the service, how long we keep it and what your rights are. HelpCarry is for adults (18+) only.
1. Who is responsible
The data controller is HelpCarry, Motzfeldts gate 23, Oslo, Norway. Contact for all privacy questions and requests: contact@helpcarry.com. We have not appointed a data protection officer because we are not required to; the address above reaches the people responsible.
2. What we collect
- Account: when you sign in with Google, your name, email address and profile picture from Google; when you sign in by email, your email address. Your confirmation that you are 18 or older, and the date you gave it. If you look around as a guest, a random guest account with no contact details.
- Profile you add: display name, home country and city, languages, bio, home airport, currency and language preferences.
- What you post and do: trips (routes, dates and, if you add them, flight numbers), requests, offers, bookings, chat messages, reviews, handover records and photos (Proof Pack), meeting plans, reports, blocks and disputes.
- Notifications: if you turn on push notifications, the push subscription your browser gives us.
- Technical data: a session cookie that keeps you signed in, security and error logs (IP address, browser, time, the page or API called), and rate-limit counters. We do not use advertising cookies. Analytics cookies are set only if you accept them (see Analytics and cookies).
We do not collect ID documents, selfies or national eID data, and we do not handle payments or card details. Please don't share ID photos, one-time codes or bank details in chat.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Run your account and the service: show your posts, match trips and requests, chats, bookings, handover records, reviews, family follow links. | (b) contract: needed to provide what you asked for. |
| Keep people safe: 18+ confirmation, Scam Shield chat warnings, moderation, reports and blocks, suspensions, fraud and abuse prevention, rate limits, security logs and backups. | (f) legitimate interests: protecting members and the service from harm and fraud. |
| Push notifications (route alerts, replies, reminders). | (a) consent: turn them off at any time in Profile or your browser. |
| Google Analytics: understand which pages and features are used so we can improve them. | (a) consent: only if you press Accept; withdraw it any time under Cookie settings. |
| Vercel Web Analytics: cookieless, aggregated visit counts (pages, referrers, country, device type). | (f) legitimate interests: knowing the service works and is reachable, without identifying anyone. |
| Answer legal requests and keep records the law requires. | (c) legal obligation. |
We do not sell your data, use it for advertising or build marketing profiles. Your public profile (display name, country, languages, reviews and rating) is visible to other members so they can decide whether to deal with you.
4. Who we share it with
Other members see what you post and what you send them. We also use these service providers (processors), who may only use the data to provide their service to us:
- Vercel Inc. (USA): hosting, serverless functions, logs, private storage for photos and backups (Vercel Blob), and cookieless Web Analytics.
- Google Analytics (Google Ireland Ltd., with Google LLC, USA): website statistics, only if you accept analytics cookies. See Analytics and cookies.
- Neon (Databricks, Inc.): our database, hosted in the EU (Frankfurt, Germany).
- Google: sign-in (Google OAuth). When you delete your account we also ask Google to revoke HelpCarry's access. If you choose "Translate with Google" on a message, that message text goes to Google Translate under Google's own terms.
- Resend (Plus Five Five, Inc., USA; sending from the EU, Ireland): delivers our emails, such as sign-in codes and the booking updates you keep switched on. It receives your email address and the email contents.
- Web push services run by your browser vendor (for example Google, Mozilla, Apple or Microsoft): deliver notifications you turned on. Notification contents are encrypted end to end between us and your browser.
- Error monitoring (if enabled, for example Sentry): technical error reports with personal data kept to a minimum.
We will update this list before adding a new provider. We share data with authorities only when the law requires it, or when needed to protect someone's safety.
5. Analytics and cookies
We use two analytics tools to see how HelpCarry is used, so we can fix what's confusing and build what people need. Neither is used for advertising.
- Google Analytics 4, only with your consent. Nothing from Google Analytics loads until you press Accept on the cookie banner. If you accept, it sets first-party cookies (
_gaand_ga_*, kept up to 13 months) and records pages viewed, how you arrived (for example a campaign link), approximate location (country or city), device and browser. Google uses your IP address only to work out that approximate location and does not log or store it for EU/EEA visitors. Google signals, ad personalisation and cross-site linking are switched off, and ad-related consent stays denied. Event data is deleted after at most 14 months. - Vercel Web Analytics, without cookies. Counts page views, referrers, country and device type. It sets no cookies and stores no IP address; visits are grouped with a hash of the request that changes every day, so you can't be recognised from one day to the next or across sites.
We also remove campaign tags (such as utm_source, gclid or fbclid) from the address bar as soon as a page opens, so they don't end up in links you share.
Your choice: you can accept or decline at any time. reopens the banner (it's also in the site footer). Declining stops Google Analytics and deletes its cookies. You can also use Google's opt-out browser add-on, or object to Vercel Web Analytics by emailing contact@helpcarry.com.
6. Transfers outside the EEA
Some providers above are based in the USA. Where data leaves the EEA we rely on the EU-U.S. Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise. Ask us at contact@helpcarry.com for a copy of the relevant safeguards.
7. How long we keep it
- Your account and content: until you delete your account. Deletion removes your profile, trips, requests, offers, chats, reviews, photos and sessions straight away.
- Deletion pause: while something you are carrying or sending is in transit, or a dispute is open, deletion waits until it is resolved so the other person is protected.
- Backups: private daily backups are kept for 14 days, and the database provider keeps a short recovery history (up to 7 days). Deleted data can remain in these until they roll over; we never restore it into the live service except to recover from an outage.
- Empty guest accounts: deleted after 31 days without activity.
- Analytics: Google Analytics event data at most 14 months, its cookies at most 13 months; Vercel Web Analytics keeps only aggregated, cookieless counts.
- Security and error logs: kept only as long as needed to investigate problems, normally no more than 90 days.
8. Your rights
Under the GDPR you can:
- Get a copy of your data (Art. 15) and take it with you (Art. 20): Profile → Download my data, or email us.
- Correct it (Art. 16): edit your profile, or email us.
- Delete it (Art. 17): Profile → Delete account, or email us.
- Restrict or object to processing based on legitimate interests (Art. 18 and 21).
- Withdraw consent at any time (Art. 7(3)): turn off notifications or decline analytics under Cookie settings.
- Complain to a data protection authority (Art. 77). In Norway this is Datatilsynet (PO Box 458 Sentrum, 0105 Oslo). You can also complain where you live or work in the EU/EEA. We'd appreciate the chance to fix it first: contact@helpcarry.com.
We answer requests within one month (Art. 12(3)). We may need to confirm it's really you, usually by replying from the email address on your account.
9. Automated warnings
Scam Shield and our moderation rules automatically look for common scam patterns (for example requests for advance payment, gift cards or ID photos) and banned items. They show warnings and may flag content for review; they do not make decisions with legal or similarly significant effects on their own. A person reviews reports and suspensions, and you can contact us to contest a decision.
10. Security
Connections are encrypted (HTTPS), handover photos are stored privately, and staff access is limited. No system is perfectly secure. If a breach is likely to put you at high risk, we will tell you without undue delay.
11. Changes
If we change this policy in a way that matters, we will tell you in the app before the change applies. See also our terms.