Privacy Policy
Effective 13 October 2026
Who we are
Carve is an app for planning and driving routes, for iPhone and CarPlay and for Android and Android Auto, made by Chris Aston Chen (“Carve”, “we”). This policy explains what the apps do with information, and what your choices are. Questions: [email protected].
Your account
You can use Carve without an account; you'll need one to drive, record and keep routes in sync. You sign in with Apple or with Google. From that sign-in Carve's backend keeps an account identifier and what your provider passes on: with Google, your email address, name and Google profile picture; with Apple, nothing more — Carve doesn't ask Apple for your name or email.
Your account also has a username you choose, and optionally a display name and a profile picture. These are how you appear to other people: other signed-in Carve users can see them, they appear on routes you share, and your profile picture is stored at a public web address. Profile pictures are re-encoded when you choose them, which removes location and camera details from the photo.
You can also add a photo to a route you made, taken with your camera or chosen from your library. Carve sees only the photo you pick. It's re-encoded at the size you frame it, which removes location and camera details, then checked automatically before anyone else can see it; a photo that fails the check is deleted. Once added, it's stored at a public web address and shown as the route's picture to anyone you share the route with. You can change or remove it at any time. If you report someone's photo, Carve keeps the report — which photo, and your account — to review it, and hides that photo on your device.
If a route you made has no photo of its own, Carve looks for one: a freely licensed photo from Wikimedia Commons taken near the route. To find it, the app sends Carve's server up to four points from the middle of the route — never where it starts or ends — rounded to about a kilometre, with the towns at its ends, the names of its roads and the route's name. Carve's server, not your device, asks Wikimedia Commons for photos taken near those points, and for photos named after the route's roads and the places in its name, and doesn't keep the points. A photo found this way is copied to a public web address and shown with its photographer's name and licence, which links to the photo's page. You can remove it, or replace it with your own; once removed, Carve doesn't look again for that route.
Your routes
- On your device. Routes you plan, save, record or import — their names, start and end points, stops, the road path and turn instructions computed for them, their elevation profile and description, and when you last drove them — are stored in the app.
- In your account. When you're signed in, each route is kept on Carve's servers as well, so it's on every device you sign in to. Routes in your account are private to you. When you delete a route, it's removed from your devices and marked deleted on our servers; that server copy is erased when you delete your account.
- Drives in progress. Which stops you've reached and your last position on a route are kept only on the device, so an interrupted drive can pick up where it left off. Drive history isn't sent to our servers.
- Recording a drive. While you record, the trace of where you drive stays on the device. When you end a recording with a connection, the trace (thinned to a few hundred points) is sent to Mapbox to match it to the roads, and the result becomes a route like any other.
- Settings and search history stay on the device.
Sharing routes
Every route you keep in your account has a link — carve.run followed by a short code — that opens it. Anyone who has the link can see the route — its name, points, stops, road path, description and photo — and your username and profile picture as the person who made it. Links you send are outside Carve's control. Links never include your location or when you've driven the route.
When a link is shared in a message, carve.run shows a preview — the route's name, length and a small map of it, drawn by Mapbox.
Group: driving together
Group, part of Carve Apex, lets people driving the same route see each other on the map. It's off unless you turn it on, for one route at a time, from the route's preview or during the drive.
- What others see. While Group is on and you're within about 3 miles of the route, your phone sends Carve's server your position every few seconds (every 20 seconds while you're stopped), with your heading, speed, how far along the route you are, whether you're stopped and which way you're driving it. Other Carve users sharing the same route — or a copy of it — see your position, wherever they are along it, on their map and car screen, with your display name (or username) and profile picture, how far ahead or behind you are, and how long ago you last updated.
- Only while you share, and only nearby. You see others only while you're sharing yourself. Further than about 3 miles from the route your phone stops sending and your position is removed, so turning Group on at home doesn't reveal it unless you live near the route. The server checks the distance itself rather than leaving it to the app, but it can only check the position a phone reports — it can't tell whether that's true.
- No history. The server keeps one record for you: your latest position on the route. It's deleted when you turn Group off, end the drive or leave the route, and if your phone loses its connection first, others see it as where you were last seen for up to 30 minutes, after which it's deleted. Carve doesn't keep a record of where you've driven.
- Are you driving in a group? When you open a route near people already sharing it, the app may ask whether you'd like to join them. To ask, it sends the server the route and where you are, and gets back only how many people are sharing within a mile — never who or where. Your position isn't stored; the server keeps only when your account last asked, so it can be asked at most every 15 seconds.
- Hide and Report. You can hide any driver: neither of you will see the other again. Hidden drivers are listed under Me, where you can show them again. You can report a driver; Carve keeps the report — who, on which route, and your account — to review it.
Your name in a group is the display name you set under Me, or your username. Deleting your account deletes your position, hidden drivers and reports with it.
How you use the app
So we can see whether Carve is working for the people using it, the app records usage events and sends them to Carve's server: when it's opened and how long it stays open; signing in and out, and whether the account is new; routes opened, created, imported, edited, renamed, deleted, shared and downloaded, and which route each is about; drives started, finished or ended early, with how long they took, how much of the route they covered and whether they used CarPlay or Android Auto; leaving and rejoining a route; recordings; Group turned on and off; and Carve Apex offers, purchases and restores.
Each event carries your account (when you're signed in), a random identifier made for the app on your phone, the app's version, and whether it's an iPhone or Android phone. It never includes your coordinates, what you search for or a route's name. But events about a route say which route, so events about drives show which route you drove and when. Events wait on your phone until there's a connection.
They're used only to understand and improve Carve — never for advertising, and never sold or shared. They're kept for 90 days, then deleted, and deleting your account deletes yours. To stop them, turn off Share Usage with Carve under Me; anything not yet sent is discarded.
Location
Carve asks for location access to centre the map, to plan from where you are, and to guide a drive or record one. During a drive or a recording it tracks your position continuously — on Android with a notification showing while it does, on iPhone in the background while the drive is active — so it can announce turns, clear stops, and tell when you've left the route. Carve doesn't ask for location access at other times in the background.
Your location is processed on the device and is not sent to Carve's servers, except while you use Group, as described above, and — on Android, rounded to an area about 11 km across — to get the weather where you are during a drive (see Weather, below). Coordinates go to the services below only as needed to do what you asked. You can withdraw location access at any time in your phone's settings; the map still works, but drives can't be guided.
Describing a drive
You can describe a drive, or a change to one, in your own words — “a twisty hour, coffee halfway, back by 5” — typed or spoken. Speech is turned into text on your phone; the recording never leaves it. What you asked goes to Carve's server with the route as words — its name, length and time, the names of its roads, stops and towns, and the names of places the app found for it, with how far and how long — and the server asks Anthropic what to change, and then how to tell you what changed. Anthropic never receives coordinates, and nothing that identifies you: finding places and working out routes happen on your phone, with the services below. While Share Usage with Carve is on (under Me), Carve's server keeps what you asked for 90 days, with how it was read, what the app did, what Carve replied and your thumbs up or down if you give one, so we can see where describing a drive goes wrong and fix it. It's kept with your account if you're signed in, never with coordinates or your IP address, and it's deleted with your account. Turn it off and nothing you ask is kept. To keep the free allowance fair, the server counts requests by account, or by IP address if you're not signed in.
Weather
Carve shows forecasts from Apple Weather: along a route, for when you'll reach each part of it; on the map, when you turn on its Weather layer; and during a drive, for where you are and what's ahead. To get them, the app asks for the forecast at a few places — points along the route, the parts of the map in view, and during a drive where you are — but each is first rounded to the middle of an area about 11 km (7 miles) across, so Apple Weather is never told your exact position or your route's exact path. On iPhone the app asks Apple Weather itself; on Android it asks Carve's server, which asks Apple Weather and keeps nothing. Forecasts are kept on your device for a day, so a drive has its weather without signal.
Services that receive data
| Service | What it receives | Why |
|---|---|---|
| Mapbox | Requests for the map, terrain and traffic covering the area on screen or along a route; a route's points when computing its road path or directions back to it; a recording's trace when you end it; a shared route's path, to draw its link preview; and, on Android, what you type in search and where the map is centred, and the coordinates of places to name. | Maps, offline downloads, road paths, elevation, drive-time guidance, recordings, link previews, and on Android place search and stop names. Mapbox's SDK may also collect anonymised usage telemetry under Mapbox's privacy policy; you can turn this off from the ⓘ button on any Carve map. |
| Apple (iPhone) | What you type in search and coordinates to name; your Apple Account for sign-in and purchases; drive status for CarPlay and Live Activities. | Search, stop names, Sign in with Apple, Carve Apex purchases, and the car and lock-screen displays — under Apple's privacy policy. |
| Apple Weather | Places to forecast — points along a route, areas of the map in view, and during a drive where you are — each rounded to the middle of an area about 11 km across; on Android, sent by Carve's server rather than your device. | Weather along routes, on the map and during drives — under Apple's privacy policy. |
| Google (Android, and Google sign-in on iPhone) | Your Google Account for sign-in and Google Play purchases; on Android, your Carve sign-in, kept in Google's encrypted Block Store; drive status for Android Auto. | Sign in with Google, Carve Apex purchases, staying signed in after you reinstall or move to a new phone, and the car display — under Google's privacy policy. |
| Supabase | Your account, profile, routes, profile picture and route photos; usage events, unless you turn them off; what you ask when describing a drive and how it went, kept 90 days, unless you turn off usage sharing; while you use Group, your latest position on the route; on Android, the rounded places to forecast, which it doesn't keep. | Carve's backend: it hosts the accounts and routes described above, passes Group positions between the people sharing a route, and asks Apple Weather for Android. |
| Anthropic | A route's name, length, time, climb, highest and lowest points, the names of its roads and stops, and the towns it starts and ends in — no coordinates and nothing that identifies you. What you ask when you describe a drive or a change, with the names of places found for it. Photos you add to routes, and photos from Wikimedia Commons taken near a route. | Writing the short description under a route's name, and choosing the picture of the kind of country it drives through. Turning what you describe into changes to the route, and telling you what changed. Checking a route photo before anyone else sees it, and choosing a photo from Wikimedia Commons for a route without one. |
| Wikimedia Commons | Up to four points near the middle of a route, rounded to about a kilometre, and the names of its roads and the places in its name, sent by Carve's server — not your device, and nothing that identifies you. | Finding freely licensed photos taken near a route — under the Wikimedia Foundation's privacy policy. |
| Amazon Web Services | The words of spoken directions, such as “In half a mile, turn left onto Skyline Boulevard.” | Turning directions into the voice you hear. The recordings are shared by everyone, not tied to you. |
| Cloudflare | Visits to carve.run, including opened route links. | Hosting carve.run and its link previews, and protecting it from abuse. |
Mapbox, Apple Weather, Anthropic, Amazon and Wikimedia don't receive your name or contact details from Carve. To keep usage fair, the services that write route descriptions, choose route pictures and fetch weather for Android count requests by IP address, describing drives is counted by account (or IP address without one), and photo checks are counted by account; those counts are deleted after a week.
Carve Apex and purchases
Subscriptions are sold through the App Store on iPhone and Google Play on Android, which handle payment and billing; Carve never sees your card or bank details. Each purchase is tied to your Carve account — on iPhone with your account identifier, on Android with a one-way hash of it — so that it follows your account. Carve doesn't keep purchase records on its servers.
What Carve does not do
- No advertising, and no advertising or cross-app tracking identifiers.
- No third-party analytics or crash-reporting services: usage events, described above, go only to Carve's own server. If you've chosen to share analytics with developers in your phone's settings, Apple or Google may share aggregated crash reports with us.
- No selling, renting, or trading of personal information.
Keeping and deleting your data
Your data stays until you delete it. You can delete a route in the app, remove offline maps from a route's menu, and sign out at any time. Delete Account, in the app under Me, permanently erases your account, profile, profile picture, route photos, routes (including ones you'd deleted) and their links, and your Group position, hidden drivers, reports and usage events from Carve's servers, removes them from that device, and revokes Sign in with Apple. Route descriptions and voice recordings that aren't linked to anyone are kept.
On iPhone, the app's data is included in your device backups according to your iOS settings; your sign-in stays on the device. On Android, the app's data isn't backed up, except your sign-in in Google's Block Store, which signing out or deleting your account removes.
Children
Carve is a driving app and is not directed at children under 16. We don't knowingly collect information from them.
Your rights
Depending on where you live you may have rights to access, correct, export or erase your personal data, and to complain to a supervisory authority. Most of it you can change or delete in the app; for anything else, write to [email protected] and we'll help.
Changes
If this policy changes in a way that matters, the effective date above moves and the app will point you to the new version. Earlier versions are available on request.