Privacy

The short version

• Karbon stores your email address, your household size, and the ledger you write yourself.
• You sign in with Google. There is no password, and Karbon sees nothing of your Google account but your email address.
• No tracking, no analytics, no advertising, no third-party scripts, and no email from Karbon.
• You can download your ledger as a file and delete your account from your profile, at any time.
• Two kinds of record can outlive a closed account. They are named in “How long it is kept”.

Who is responsible

Flamant Tekst & Design (sole proprietorship), CVR 33179731, Husumvej 44, 2700 Brønshøj, Denmark, is the data controller for Karbon. Write to sebastian@flamant.dk for anything on this page.

What Karbon stores

Only when you have an account, and only in Karbon’s own database:

• Your email address, the language setting, and a time zone (Europe/Copenhagen unless changed), which decides what counts as “today”.
• Your household size. If you used “find your number” before signing in, also its result: a monthly figure and a yearly flights figure, both in Karbon’s own unit.
• Your ledger: each logged day and each purchase you charge, with its date and amount, and for a logged day the choices you made from the menu (breakfast, dinner, transport and so on).
• Your goal, if you set one: the name you gave it, its target, and whether it has been spent.
• A sign-in record for each device you are signed in on: a scrambled (hashed) token and its expiry. The token itself lives only in your cookie.
• The date the account was created.

Karbon does not store your name, your picture, your Google account ID, your location, your IP address or your device details in its own database.

Why this is allowed: you asked for an account, and these are what an account is made of (GDPR Article 6(1)(b), performance of a contract).

What Karbon does not do

• No tracking and no analytics, from Karbon or anyone else. No page loads a script from a third party.
• No advertising, and your data is not sold or shared. The only outside service the code talks to is Google, to sign you in.
• No email. Karbon has no mail service connected, so it sends you nothing — no newsletters, no reminders.
• Reading the public pages (prices, world, method, this page) needs no account and sets no cookie.

Signing in with Google

Karbon asks Google for two things: openid and email — the basic pair. Google sends back your email address, and that is all Karbon reads and keeps. Karbon cannot see your contacts, files, calendar or anything else in your Google account. Google knows that you signed in to Karbon; what it does with that is covered by Google’s privacy policy.

Cookies and what stays on your device

Three cookies, all only for signing you in, none for tracking:

• karbon_session — keeps you signed in, for up to 90 days or until you sign out. Not readable by page scripts.
• karbon_oauth_state — a random value that lasts 20 minutes, to check a Google sign-in is one you started.
• karbon_wizard — only if you came from “find your number”: your household size and the two figures, for 20 minutes, so they can become your profile.

Two small notes are kept in your browser’s own storage and never sent to Karbon: that you have seen the intro to “find your number”, and — if you dismiss the “add to home screen” prompt — how many times and when.

Who handles it, and where

• Vercel hosts the site. Its servers for Karbon run in Washington, D.C., in the United States, so your data passes through the US whenever you use a signed-in page. As the host, Vercel also sees each request to the site, including your IP address, and keeps its own logs under its own privacy notice.
• Neon holds the database, in Frankfurt, Germany (eu-central-1). It keeps a short restore history, set to six hours, so a row deleted from the database can still be restored from that history for up to about six hours.
• Google handles the sign-in, as above.

There is no one else: no analytics company, no ad network, no mail provider.

Error records

When something on the site breaks, Karbon writes a record to its own database so the fault can be found and fixed. It holds the time, the error message and technical trace, the page address and request type, the deployment it happened on, and a count of repeats. For an error reported from your browser while you were signed in, it also holds your internal account ID. The page address is recorded as your browser gave it, so it can include anything after a “?”. The record has no field for your email address. The error message itself is written by the software, though, and if something broke halfway through a request it can mention what was being handled at the time.

Why this is allowed: keeping a live site working is a legitimate interest (GDPR Article 6(1)(f)), and the record is deliberately thin.

How long it is kept

• Your account and ledger — until you close the account. Karbon does not delete inactive accounts on a timer.
• Sign-in records — valid for 90 days, and deleted the moment you sign out or close the account. Expired ones are not yet cleared out automatically; they no longer let anyone in.
• Error records — kept with no expiry. When you close your account, the link between your account ID and any record is cut, so the record no longer points to you.
• Email sign-in links — the live site signs in with Google only. The code also holds an email-link path that is switched off here, because no mail service is connected. If an email address is sent to it anyway, the address is written down — with the “find your number” figures, if any were sent along — before the code finds it cannot send. That record is not tied to an account, does not disappear when you close one, and is not yet cleared out automatically. If you think your address is in it, write and it will be deleted by hand.

Your rights

Under the GDPR you can:

• Get a copy and take it with you. On your profile, “Export my ledger” downloads a JSON file: your email address, household size, monthly starting figure, and every ledger entry with its running balance. It does not yet include the per-day choices, your goal or your language setting — write and you will get those too.
• Delete it. On your profile, “Close account” deletes your account, ledger, day details, goal and sign-in records straight away and signs you out. It cannot be undone. The exceptions are the two in “How long it is kept”.
• Correct it. Household size can be changed on your profile. For anything else, write.
• Restrict or object to how your data is used — write.
• Complain. To the Danish Data Protection Agency, Datatilsynet. You are welcome to write to us first, but you do not have to.

Write to sebastian@flamant.dk; requests are answered within one month.

Changes

If Karbon starts doing something this page does not say — analytics, email, a new provider — this page is changed first, and the date at the top moves.