Privacy Policy

Effective date: February 2026

1. Introduction

Carryo Limited ("Carryo", "we", "our", or "us") is a company incorporated in Hong Kong. We operate a peer-to-peer cross-border delivery marketplace that connects patrons (people who need items delivered) with voyagers (travelers who carry items across borders for a fee).

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have in relation to your data. By creating an account or using the Carryo mobile application or website, you acknowledge that you have read and understood this policy.

If you do not agree with this policy, please do not use our services.

2. Information We Collect

2.1 Account Information

• Full name
• Email address
• Password (stored in hashed form via Firebase Authentication)
• Profile photo (optional)

2.2 Identity Verification Documents

• Government-issued photo ID (passport, national ID, or driver's license)
• Selfie photo for liveness verification

2.3 Delivery and Transaction Data

• Delivery requests you post, including item descriptions, dimensions, and weight
• Proof-of-delivery photographs
• Payment evidence screenshots (where submitted for off-platform payment confirmation)

2.4 Communications

• In-app chat messages between patrons and voyagers

2.5 Location Data

• Country and city information derived from trip origins and destinations
• GPS coordinates recorded at the time of delivery confirmation

2.6 Device and Usage Information

• Device type, operating system, and app version
• Firebase Cloud Messaging token (for push notifications)
• Basic server logs (IP address, request timestamps) for security and debugging
• App language preference

3. How We Use Your Information

Processing your account information, delivery data, and communications is necessary to provide you with the Carryo Platform and the services you request.

4. Legal Basis for Processing

Contract performance: Processing your account information, delivery data, and communications is necessary to provide you with the Carryo Platform and the services you request.

Legitimate interests: We process certain data (such as server logs and fraud detection signals) based on our legitimate interest in maintaining platform security and preventing abuse.

Legal obligation: We process and retain data where required by applicable law, including Singapore's PDPA, GDPR, Russia's Federal Law 152-FZ, or China's PIPL.

Consent: Where required, we obtain your explicit consent before processing data — for example, for optional profile photos or marketing communications.

5. How We Share Your Information

We do not sell your personal data to third parties. We share your data only in the following circumstances:

5.1 With Other Users

Your name, profile photo, rating, and trust score are visible to other users on the Platform. Delivery details (origin, destination, item description) are shared with the matched voyager or patron.

5.2 With Service Providers

Didit (KYC Provider): We share your government ID and selfie with Didit to verify your identity. Didit processes these documents on our behalf under strict data processing agreements.

Firebase (Google): We use Firebase Authentication to manage sign-in and Firebase Cloud Messaging to send push notifications.

Google Cloud Platform (GCP): Our backend API and admin panel are hosted on GCP Cloud Run.

Our database and file storage provider. All user data, delivery records, chat messages, and uploaded files are stored in Google Cloud services.

We verify voyagers' flight tickets using airline schedule data. Every voyager's route is confirmed before they can accept a delivery offer.

5.3 For Legal Reasons

We may disclose your data to law enforcement, regulators, or courts where required by applicable law, a valid legal process, or to protect the rights, property, or safety of Carryo, our users, or others.

5.4 Business Transfers

If Carryo is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any material changes to this policy.

6. International Data Transfers

Carryo is headquartered in Hong Kong. Our cloud infrastructure providers (Google/Firebase, Supabase) may store and process your data in the United States, the European Union, or other regions where their servers are located.

Where data is transferred outside your country of residence, we rely on appropriate safeguards, such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.

For users in Russia, we process data in compliance with Federal Law No. 152-FZ "On Personal Data". Russian user data is primarily stored within Russia where technically feasible.

7. Data Retention

Account data: Retained for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, subject to legal holds.

Identity verification documents: Retained for the period required by applicable KYC and anti-money-laundering regulations (minimum 5 years in most jurisdictions).

Delivery records and transaction history: Retained for 7 years to comply with financial record-keeping requirements.

Chat messages: Retained for the duration of your account. May be retained beyond account deletion where required for dispute resolution or legal compliance.

Server logs: Retained for up to 90 days for security and debugging purposes.

We may process and retain data where required by applicable law, including Singapore's PDPA, GDPR (for EU/EEA residents), Russia's Federal Law 152-FZ, or China's PIPL.

8. Your Rights

Depending on your country of residence, you may have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data where we have no overriding legal obligation to retain it.
• Right to restrict processing: Request that we limit how we use your data in certain circumstances.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

These rights apply as specified under GDPR (EU/EEA users), Russia Federal Law 152-FZ, China PIPL, Hong Kong PDPO (Cap. 486), and other applicable local laws. To exercise any of these rights, contact us at support@carryo.co. We will respond within 30 days.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection authority.

9. Children's Privacy

Carryo is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has created an account, we will delete the account and associated data promptly.

If you believe a minor has created an account on our platform, please contact us at support@carryo.co.

10. Cookies and Similar Technologies

We do not use third-party advertising cookies, analytics cookies, or tracking pixels. We only use the following strictly necessary cookies:

• A cookie stores your selected language (English, Arabic, Russian, or Chinese) so you don't have to re-select it on every visit.
• A temporary session cookie is set for authenticated access to our API documentation. It is cleared when you close your browser.

11. Security Measures

We implement technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in transit using TLS/HTTPS for all data exchanged between your device and our servers
• Passwords stored exclusively via Firebase Authentication (hashed and salted — never stored in plaintext)
• Private storage buckets for identity documents, delivery photos, and payment evidence — accessible only via time-limited signed URLs
• Row-level security (RLS) policies on our database, ensuring users can only access their own data
• Rate limiting and access controls on our API endpoints
• Restricted access to administrative panels, protected by strong credentials

Despite our efforts, no system can be guaranteed to be 100% secure. If you believe your account has been compromised, contact us immediately at support@carryo.co.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you via in-app notification or email.

The "effective date" at the top of this page indicates when the policy was last revised. Your continued use of the Platform after the effective date constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:

Email: support@carryo.co