Privacy Policy

Information we collect falls into one of two categories: "voluntarily provided" information and "automatically collected" information.

"Voluntarily provided" information refers to any information you knowingly and actively provide us when using our app and its associated services — for example, your email address when you register for an account.

"Automatically collected" information refers to any information automatically sent by your device in the course of accessing our app and its associated services — for example, device identifiers, app-usage and diagnostic data, and crash reports.

Depending on how you use Carrington, we may process:

• Account information — the email address you register with, and authentication identifiers managed by our identity provider.
• Usage and diagnostic data — interactions with the app, feature usage, and crash/error reports, used to operate and improve the service.
• Notification preferences and settings you configure in the app.
• Payment and subscription status — handled by the app-store and payment processors below; we do not store full payment-card details.

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal information only where we have a lawful basis to do so. Depending on the activity, our lawful bases are:

• Performance of a contract — to create and operate your account and provide the app's core features.
• Legitimate interests — to secure, maintain, debug, and improve the service, and to prevent abuse, where those interests are not overridden by your rights.
• Consent — where required, for example certain notifications or analytics; you may withdraw consent at any time.
• Legal obligation — to comply with applicable law.

We only collect personal information that is reasonably necessary to provide our services to you.

When we collect your personal information, you have the right to be informed about:

• Who the data controller is — 9 RESE' LLC (325 Montoya St NW, Albuquerque, NM 87104, United States).
• The purposes and lawful bases for processing (described above).
• The categories of recipients / processors who receive the data (see "Third-Party Service Providers (Processors)" below).
• Whether data is transferred outside the EEA/UK and the safeguards used (see "International Data Transfers").
• How long the data is retained (see "Data Retention Schedule").
• Your data-subject rights and how to exercise them (see "Your Data-Protection Rights").
• Your right to lodge a complaint with a supervisory authority.

We rely on the following third-party providers to operate Carrington. Each processes only the data necessary for its function and is bound by its own terms and privacy/data-processing commitments:

• Firebase Authentication (Google LLC) — manages account sign-in and stores authentication identifiers (e.g. your email address and account UID).
• Cloud Firestore (Google LLC) — stores app and account data such as your settings, preferences, and saved content.
• Google Cloud Platform (Google LLC) — underlying cloud hosting, storage, and serverless compute (including Cloud Functions and Cloud Storage) that runs the service.
• Vertex AI / Gemini (Google LLC) — generative-AI service used to produce summaries and AI-assisted content within the app (see "AI-Generated Content").
• Firebase Analytics & Crashlytics (Google LLC) — collects aggregated usage analytics and crash/diagnostic reports to help us operate and improve the app.
• Google Ads (Google LLC) — conversion measurement for our website ad campaigns (see "Cookies and Similar Technologies" below).
• App-store and payment processors — Apple App Store / Apple Pay and Google Play / Google Payments process purchases and subscriptions; Stripe processes web payments (web only). We do not store full payment-card numbers.

We may also disclose personal information to our employees, contractors, and related entities, and to courts, regulators, and law-enforcement officers where required by law.

Our website uses a small number of cookies and similar technologies:

• Essential cookies — set by Firebase Authentication when you sign in and by Stripe when you check out on the web. These are strictly necessary; the site does not function properly without them, and they are not consent-gated.
• Advertising measurement (consent-based) — the main website pages load a Google Ads conversion tag (gtag.js, Google LLC) under Google Consent Mode v2, with ad storage denied by default. Only if you choose "Accept" on the cookie banner does the tag set Google Ads cookies (for example "_gcl_au") to measure whether visits from our ads lead to sign-ups or purchases. If you decline (or make no choice), no advertising cookies are set and ad-click identifiers are redacted; Google then receives only cookieless, aggregated pings used for modeled conversion counts that do not identify you. This is conversion measurement only; the website runs no analytics property and does not build behavioral profiles.
• Preference storage — your cookie-banner choice is remembered in your browser's local storage so the banner is shown only once and your decision is re-applied on later visits.

You can change your choice at any time via cookie preferences, control or delete cookies through your browser settings, and manage how Google measures and personalizes ads at Google Ads Settings.

Carrington uses generative AI (Vertex AI / Gemini, provided by Google LLC) to produce certain content shown in the app — for example, plain-language summaries of research papers and other AI-assisted text. The app may also generate AI-assisted content that is posted to our own social-media channels.

AI-generated content is produced by automated systems and may be inaccurate, incomplete, or out of date. It is provided for general information only and should not be relied upon as professional, scientific, medical, financial, or safety advice.

We keep your personal information only for as long as we need it for the purposes described in this policy, or as required by law.

• Account data (email, account identifiers, settings) — retained until you delete your account.
• Usage analytics and diagnostic / crash data — retained for 90 days.
• Backups and archived copies — retained for 90 days before deletion.

Where required, we may retain certain information longer to comply with a legal, accounting, or reporting obligation, or for archiving in the public interest or scientific/historical research purposes. When information is no longer needed, we delete or anonymize it.

If you are in the EEA or the UK, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Rectification — ask us to correct inaccurate or incomplete information.
• Erasure ("right to be forgotten") — ask us to delete your personal information in certain circumstances.
• Restriction — ask us to restrict processing in certain circumstances.
• Data portability — receive your information in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Object — object to processing based on our legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Lodge a complaint — with your local data-protection supervisory authority.

To exercise any of these rights, contact us using the details in "Privacy Contact" below. We will respond within the time limits required by applicable law.

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to:

• Know / Access — request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom it is shared.
• Delete — request deletion of personal information we collected from you, subject to legal exceptions.
• Correct — request correction of inaccurate personal information.
• Portability — receive a copy of your personal information in a portable format.
• Opt out of "sale" or "sharing" — we do not sell your personal information for money.
• Limit use of sensitive personal information — to the extent any is processed.
• Non-discrimination — we will not discriminate against you for exercising these rights.

You may submit a request using the details in "Privacy Contact" below. We will verify your identity before responding, as required by law.

Carrington is operated using Google Cloud / Firebase infrastructure, which may process and store data on servers located outside your country, including in the United States. Where we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

When we collect and process personal information, and while we retain this information, we will protect it within commercially acceptable means to prevent loss and theft, as well as unauthorized access, disclosure, copying, use, or modification.

Although we will do our best to protect the personal information you provide to us, we advise that no method of electronic transmission or storage is 100% secure, and no one can guarantee absolute data security.

You are responsible for selecting any password and its overall security strength, ensuring the security of your own information within the bounds of our services.

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals where and within the timeframes required by applicable law (including, where applicable, the GDPR and U.S. state breach-notification laws).

These Services are not directed to children. We do not knowingly collect personal information from children under the age of 13 (or under the minimum age required by applicable law in your jurisdiction, such as 16 in parts of the EEA). If we discover that a child has provided us with personal information without verifiable parental consent, we will delete it from our servers.

At our discretion, we may change our privacy policy to reflect updates to our business processes, current acceptable practices, or legislative or regulatory changes. If we decide to change this privacy policy, we will post the changes here and, where required, notify you. Your continued use of the app after changes take effect constitutes acceptance of the updated policy.

For any questions, concerns, or to exercise your privacy rights, you may contact us:

9 RESE' LLC (operator of Carrington)
Privacy requests: [email protected]
General contact: [email protected]
325 Montoya St NW, Albuquerque, NM 87104, United States