What we keep

Carbora is run by Carbora Ltd, a company registered in England and Wales (company number 17482064), whose registered office is 17A Langland Gardens, London NW3 6QE. The company decides what the app collects and why, so in data-protection terms it is the controller of everything described on this page. It was incorporated on 25 September 2026 by Carbora’s two founders, Evan Garg and Rohan George, who are its directors; before that date the two of them were joint controllers in their own names, and this page said so.

There is one address for every question or request about your data: admin@carbora.org.uk. No Data Protection Officer is appointed — not required at this size. You can also complain to the Information Commissioner’s Office (ico.org.uk) if you think we’ve got this wrong — though we’d rather you told us first.

We record which shops you say you’ve visited, and when — either because you pressed “I’ve been here” on a shop’s card, or because you tapped the sticker at a partner shop. We do not record where you are, what device you use, or what you do anywhere else. There are no advertising trackers and no third-party analytics.

• A passport. A made-up display name, when you started, and your points total. There is no email address, and no way to add one.
• Your stamps. Which shop, when, how many points it was worth, and whether it came from a sticker tap or from you telling us — plus which special edition it counted towards, if any.
• Raw taps. Which sticker, which passport, and the time. Three pieces of information, deleted after 90 days. Pressing “I’ve been here” creates no tap record at all — only the stamp.
• Leagues. If you join a league, the other members see your display name, your points and how many shops you’ve visited — never anything else.
• Your agreement. Which version of this page you agreed to, and when.

Some things the app uses never reach us at all, because they never need to:

• Your answers to “Where to?” — what you were in the mood for, how long you had, how far you’d go. Remembered on the phone so the next time is one tap. The shops it picks are chosen on the phone too.
• Your location, if you allow it. Used on the phone to work out which shops are near you and to put the nearest first. It is not sent to us, not stored, and not used to check where you were when you pressed “I’ve been here” — we don’t check that, and we can’t.
• A copy of your own passport and the shop list, so the app still works when the signal drops. It’s your data, cached for you.
• Who you’ve blocked. If you block someone in a league, that list is kept on your phone only — we never learn who you’ve blocked.
• Anything the sticker scanner reads that isn’t ours. When you press “Scan the sticker”, your phone reads whatever NFC tag you hold it to. If it isn’t a Carbora sticker, the app discards it on the phone and sends us nothing — not the tag, not what was on it. A Carbora sticker sends only the code printed into that sticker, which is what proves you were at that shop.

Three companies run the infrastructure this app sits on, and none of them see more than their job requires:

• Supabase — holds the database and your sign-in credential, and serves the map, hosted in Ireland. Because your phone downloads the map straight from Supabase, Supabase sees your IP address and which part of the map you looked at, and may keep that in its own request logs. We don’t receive it, and it never reaches our database.
• Upstash — counts requests per minute to stop abuse, keyed to a hashed IP address that’s discarded within two hours and never written to the database.
• Vercel — runs the servers that answer every request, hosted in London (lhr1).

None of the three are paid with your data, and none of them get more than the minimum needed to do their one job.

Your IP address. Your location. Your device or browser fingerprint. What page you came from. Whether you were really standing in a shop when you said you were. Anything at all about what you do on other websites.

This is not a promise about our intentions — there is nowhere in our database to put those things. The table that records a tap has three columns, and the request that records an “I’ve been here” carries one thing: which shop.

None. This website sets no cookies for players. The app keeps its sign-in on your phone, in the phone’s secure storage, which is how it knows the passport is yours. That is needed for the app to work at all, it isn’t shared with anyone and it isn’t used to track you, so there is nothing to ask you about.

The directory holds a shop’s published business details: its name, address, the kind of shop it is, and its location. Where a business trades under an owner’s own name, that name can count as personal data. We hold it because listing Oxford’s independents is what the app is for, and a published shop front is information the owner already makes public — our legitimate interest, weighed against yours in our records. We don’t hold anything about an owner beyond what’s on the listing. Ask at the address above and we’ll correct or remove it.

Shops and organisers see counts, never people: how many visits a shop had on a given day, how many were sticker taps and how many were self-reported, how many different visitors, which hours were busy. Any figure covering fewer than five people is not shown at all, because a small number can identify someone.

These counts have no connection back to any passport. That is why they survive when you delete your account — there is nothing in them to delete.

• Raw taps: 90 days, then automatically deleted.
• Your stamps and points: until you delete your account. They are your record of what you did.
• A passport nobody uses: if a passport goes 12 months without being opened or used to log a visit, we delete it and everything in it, exactly as if you had pressed Delete. Uninstalling the app doesn’t tell us anything, so this is what stops a passport you can no longer reach from being kept for ever. Opening the app once in that time is enough to keep it.
• Anonymous shop counts: kept indefinitely. They do not refer to you.

You can download everything we hold about you, as a file, from Account in the app. You can delete your account from the same place, and it is a real deletion — not a flag on a row we keep. If you’ve lost access to the app, email us and we’ll help.

You do not have to give us an email address to use any of this, and there is no way to.

On servers in the United Kingdom and the European Union. Your data is not transferred outside the UK or EU.

Nothing about you is scored, profiled, or decided by an algorithm. The only automatic checks are whether a sticker tap was genuine (a yes or no about the tap itself) and whether you already stamped a shop in the last day (so the same door can’t be pressed over and over for points). Points are a game score, not a judgement about you — and they can’t be spent on anything.

Because you agreed when you started your passport, and because we cannot give you a passport without recording what is in it. If you withdraw by deleting your account, everything personal goes with it.

You’re welcome to play. Nothing here is different for a younger passport: no location ever leaves your phone, and there’s no advertising or profiling to opt out of because none exists. A league shows a friend your name, points and shop count — never where you are. If a parent or guardian wants to see or delete a child’s data, the same export and deletion tools above work for that.

If we change what we collect or why, we’ll update this page and the version number at the top, and the app will ask you to agree again before you carry on. The version number is the one recorded against your agreement, so it is always answerable which wording you saw.