Privacy policy

Who is responsible

Carried is developed by Dominik Drąg. For privacy questions, contact support@dominikdrag.com.

Your reflection and prayer

Carried lets you speak or type a reflection, review it, and ask for a Christian prayer based on those words. A reflection may contain personal or sensitive information, including religious beliefs. Include only what you want processed for this purpose; you do not need to identify yourself or another person.

Speech transcription runs on your iPhone. Your recording is not uploaded. When you agree and ask Carried to write a prayer, the app sends the current reviewed reflection over an encrypted connection to Carried’s prayer service hosted on Cloudflare. The service sends the reflection with Carried’s fixed instructions through OpenRouter to OpenAI. The current processing permission covers the promises described here rather than one model name. For requests covered by that permission, Carried uses GPT-6 Luna; earlier permission, and requests already prepared under it, remain on GPT-5.6 Luna. The app asks for explicit agreement to the updated disclosure; earlier permission is not silently changed.

Earlier reflections, earlier prayers, recordings, purchase identifiers and App Attest identifiers are not sent to OpenRouter or OpenAI. Carried does not offer a public feed or publish your prayer to other users.

Prayer service and providers

Cloudflare hosts Carried’s prayer service and receives ordinary connection information such as your IP address and request timing. OpenRouter routes the prayer-writing request to OpenAI. Carried restricts model routing to OpenAI and does not fall back to another model provider if that route is unavailable. Requests exclude providers that use your words for model training; Carried does not opt in to training or prompt logging through OpenRouter. This does not mean the services retain no data.

OpenAI retains prompts for a period it does not publish. Carried does not promise zero retention or a fixed provider deletion period. Removing something from your iPhone does not delete a copy already processed by a provider.

Read Cloudflare’s privacy policy, OpenRouter’s privacy policy, its data collection documentation, and OpenAI’s privacy policy. Provider policies describe their own practices and do not replace this app-specific explanation.

Processing locations

Cloudflare operates global infrastructure. The AI request is routed through OpenRouter to OpenAI; processing may take place in the United States and outside the European Economic Area. Carried does not promise EU-only processing or zero retention. Provider policies and applicable transfer safeguards govern their processing; this app disclosure does not replace them.

App authenticity and service records

Carried uses Apple’s App Attest service to check that requests come from a valid installation. The app sends an App Attest key identifier, attestation or assertion, request binding and one-use server challenge. Carried’s service retains the verified public key, receipt, replay counter, environment and a derived installation identifier while that installation remains authorized.

The service stores content-free attempt and operation records for idempotency, recovery, allowance, fraud prevention, concurrency and spend control. These can include random operation identifiers, client correlation identifiers, disclosure version, selected model, purpose, namespace, a keyed request fingerprint, outcome, timestamps, token and cost accounting, and allowance or spend reservations. They are linked to a pseudonymous installation or subscription principal; hashing or HMAC does not make them anonymous. Subscriber daily prayer-writing limits use these existing content-free subscription and attempt records across devices. Admitted initial writes, subscriber revisions and explicit recovery requests count toward the daily limit, including failed or unknown provider outcomes after admission. No Reflection or prayer is stored to enforce the limit. The app shows the reset in local time and keeps the current words; the reset does not extend the current attempt’s expiry.

Challenges expire after two minutes. If an enrollment is rejected, the service retains a keyed value derived from its App Attest key identifier for 24 hours so the rejected enrollment cannot race or replay into acceptance; it does not retain the rejected attestation, public key or receipt in that record. Signed attempt or operation tickets have a fixed maximum 24-hour expiry. The Worker source deletes detailed attempt and operation rows, including provider token and cost fields, after 30 days. It deletes per-principal attempt timestamps and per-installation daily free-dispatch counts after 90 days. Day-only aggregate dispatch, successful-operation, enrollment, token and provider-cost totals also remain for 90 days; those aggregate rows contain no installation, subscription, attempt, operation, request or content identifier. The schema and Worker are deployed, and production prayer generation is enabled. Scheduled cleanup has not yet been observed running against production data. Installation authentication, replay state and consumed allowance remain while the installation is authorized. Owner deletion removes the installation’s public key, receipt, attestation metadata, replay state, allowance and linked operation material, but retains a durable keyed value derived from its App Attest key identifier solely to deny reenrollment and another free allowance. The owner-only revocation and deletion tooling has not been exercised against deployed service data.

Carried’s service is designed not to store reflections, prayers, recordings, raw StoreKit transaction JWS values, authorization headers, provider responses or raw provider errors in its database or application logs. A lost successful prayer cannot be recovered from the service. Cloudflare, OpenRouter, OpenAI, Apple and RevenueCat also process infrastructure or service records under their own policies.

What stays on your iPhone

• The current attempt: your current reflection, transcript where applicable, and generated prayer can be stored temporarily to recover an interrupted session. There is one current attempt, not a journal or saved-prayer library. It expires 24 hours after it starts; using it does not extend that period. Cleanup takes place when the app can run, rather than at a guaranteed exact instant.
• Temporary audio: the app attempts to delete a recording after successful transcription or when you discard it. An interrupted or failed transcription may retain audio for retry within a 10-minute window from the start of capture. Expired files are removed when cleanup runs. A stopped app cannot guarantee deletion at a particular minute.
• Content-free metadata: whether the free First Prayer is completed and which processing disclosure you accepted are stored separately from your words. This metadata survives clearing an attempt and may be included in your device backup.

Current-attempt files and audio are protected with iOS file protection and excluded from device backup by the app. Carried does not synchronize reflections or prayers to an account or iCloud library.

Purchases and subscription data

Purchases use Apple’s in-app purchase system. Apple processes payment; Carried uses RevenueCat to manage subscription access. The app does not ask you to enter payment-card details.

RevenueCat receives purchase and subscription records and a randomly generated app user ID so it can validate purchases, restore access and provide subscription history and analytics. Carried does not create a sign-in account or supply a name or email address to RevenueCat. Automatic advertising and device-identifier collection is disabled in the app’s RevenueCat configuration. RevenueCat still stores subscription records off your device.

Once per install, RevenueCat also receives an attribution token from Apple’s AdServices framework. It exchanges the token with Apple to learn whether the install came from an Apple Ads campaign and, if so, which campaign, ad group and keyword, and keeps that with the anonymous subscription record. Carried uses this only to measure its own Apple Ads. It does not use the advertising identifier (IDFA) or ask for tracking permission.

For paid prayer access, the app also sends a StoreKit 2 signed subscription transaction to Carried’s service. The service verifies the transaction and current subscription status with Apple. It does not store the raw signed transaction. It stores a keyed identifier derived from the Apple environment and original transaction ID so one subscription lineage can be recognized across renewals, restores, relaunches and devices.

Your reflection, recording, transcript and prayer are not sent to RevenueCat. App Attest and subscription identifiers are not forwarded to OpenRouter or OpenAI.

See Apple’s privacy information and RevenueCat’s privacy policy.

Help right now

Help right now contains bundled practical resources and three original prewritten prayers. Reading this content requires no subscription, processing permission, internet connection or AI request. Carried does not collect Help usage events or use your Reflection to choose a resource.

Call 988 and Text 988 are labelled for the United States. They open your device’s calling or messaging interface without a prefilled message, Reflection or prayer. These actions require a capable device and calling or messaging service. The helpline finder opens https://findahelpline.com/ in your browser and requires internet. Carried does not infer your country or request location permission to choose these resources. External phone, messaging and website services process their ordinary connection information under their own terms.

Carried cannot provide emergency help. These prayers can accompany reaching out; they do not replace it.

Support messages

If you email support, your email address and anything you include in the message will be received through the support mailbox and used to respond. Please describe technical problems without sending your reflection, recording or prayer. You can redact screenshots before attaching them.

Your choices and deletion

You can type instead of using the microphone, change the reviewed text, or decline the processing disclosure before sending a prayer request. You can manage microphone permission in iPhone Settings. Declining a new request does not retract a request already processed.

Use the app’s discard controls to clear a recoverable attempt or retained recording. Deleting the app removes local app data and resets that installation’s App Attest key. It does not cancel an Apple subscription, erase device backups, delete support emails, or immediately remove provider, purchase, security, allowance or content-free operation records.

For a privacy or deletion request, email the address above without including prayer content. Carried has no sign-in account or direct identity profile, so the developer may be unable to locate an anonymous provider record from a reflection alone. Provider-held data may require that provider’s process. The service-side owner tooling can revoke or delete a located installation, subject to the durable anti-reenrollment record described above; it has not been exercised against deployed service data.

Tracking, analytics and website information

Carried has no advertising SDK, IDFA use, data broker sharing or cross-app tracking. It measures its own Apple Ads campaigns with Apple’s standard attribution, described under Purchases. To understand whether people finish onboarding, complete a prayer and understand the offer, the app sends a small set of content-free usage events to PostHog, with data hosted in the European Union: that onboarding was shown, which of its screens were reached, and how it ended (speaking, typing, or already subscribing); the accepted response to a prayer — Amen, continuing without Amen, or changing the words — and whether it was a First Prayer or a subscriber’s prayer and began from speaking or typing; completion is recorded when Amen is chosen; a fixed measurement version and bounded prayer-writing prompt version, or “unknown” when that version is unavailable, accompany these events; whether the microphone and speech-recognition prompts were allowed; that writing a prayer failed, as a fixed category such as a network or service problem, including a closed subscriber-daily-limit or service-capacity category; and, at the offer, that it was shown or could not load, the plan chosen, and the start and result of a purchase or restore. PostHog also receives when the app is opened, closed, installed or updated; a random install identifier generated on your device and hashed (SHA-256) before it is sent, which is not your App Attest key, your subscription, or an advertising identifier; and basic technical details its library adds (app version, device model such as “iPhone”, iOS version, screen size, language and region, time zone, and Wi-Fi or cellular). No reflection, recording, transcript, prayer, Scripture reference, price or error message is ever part of these events. PostHog uses your IP address to estimate an approximate location — country, region, city, postal code and approximate coordinates — stores that location with the events, and then discards the IP address itself. It never records screens, taps or recordings. RevenueCat provides purchase-history and subscription analytics. The Carried service keeps content-free security, operation, token and spend records for app functionality; it does not use them for advertising or product-behavior analytics. The OpenRouter workspace was observed with prompt storage, broadcast, paid-endpoint training and its data-sharing discount off. Cloudflare account-level exports and enabled runtime behavior still need final verification, so Carried does not claim that providers keep no logs.

The Carried website has no reflection submission form or product analytics. Its light/dark preference is stored in your browser for this domain. The website is hosted by Cloudflare, which receives connection information when serving it. Website hosting and support-email processing are separate from on-device app storage.

Changes to this policy

This page will be updated when Carried’s data handling changes. The date above identifies the latest revision. A changed in-app processing disclosure requires agreement before a new prayer-writing request.