Privacy policy for the CaraTrip app

1. Controller and contact

The controller is market port GmbH, Splieterstraße 27, 48231 Warendorf, Germany. Email: info@marketport.de, telephone: +49 2581 9493360. App support: service@marketport.de.

Our data protection officer: Nils Möllers, Keyed GmbH, email: info@keyed.de, telephone: +49 2505 639797.

2. Local travel data, media and permissions

Trips, vehicles, campsites and other places, entries, travel expenses, checklists, documents, photos and GPS tracks initially reside on your device. Entering them alone does not upload them to Private Cloud. Your device lock, local protection features and selected backups govern access to local copies.

Camera, photo selection, files, location and notifications serve the features you use. You control system permissions in device settings. Imported images and files can contain metadata such as capture time and coordinates. Exports and backups go to your selected location or recipient; a cloud file provider also processes data under its own terms.

3. Location and GPS tracking

For location capture, maps and enabled GPS tracking, CaraTrip processes precise coordinates, timestamps, movement and routes as required by the feature. Tracking you start or automatic tracking you enable can continue while the app is minimized or the screen is off, subject to system capabilities and permissions. An Android foreground service indicates active recording. You can disable tracking and automatic recording in the app and location access in system settings.

Tracks initially remain local. Uploads occur through synchronization, sharing or exports you enable. Map and routing requests are separate data transmissions.

4. Optional iCloud, Private Cloud and trip sharing

On Apple devices, iCloud/CloudKit can synchronize data through your Apple Account. Apple processes the data needed for that service under its privacy information. iCloud is not an Android feature.

With Private Cloud, sync data is encrypted on the device and sent over HTTPS to the configured server. The sync code contains credentials and the decryption key. Treat it like a password. The server also processes space and device identifiers, permissions, revisions, timestamps and connection metadata. Encrypted content therefore does not mean anonymous use.

Trip sharing and collaboration make selected content accessible to authorized recipients. Full sync packages are encrypted; transmitted sharing metadata and specifically provided views can be processed on the server. Share other people’s data only when you are entitled to do so. Revoking access does not remove copies or exports already held by recipients. If you choose another server, also consider its operator.

5. Maps, place search and routes

Apple maps, place search and MKDirections on Apple devices send the required map areas, search terms, origins and destinations and technical connection data to Apple. Android loads map styles and tiles from OpenFreeMap (Hyperknot Software Kft., Hungary); the requested map area and IP address are processed to deliver them. Its infrastructure may use further providers such as Cloudflare. Android place search uses the Geocoder available on the device; its provider depends on the device.

When you explicitly request an Android road route through the CaraTrip relay, the required waypoints and technical request data go to the configured server, and the waypoints go to openrouteservice operated by HeiGIT gGmbH in Heidelberg, Germany. HeiGIT receives the server’s request; the relay server sees your connection. This is not a continuous upload of your GPS tracks. External map and navigation apps receive the place or route data you choose to open, under their own privacy rules.

6. Automatic technical diagnostics with Sentry

Sentry is always active for technical errors, crashes and, on Apple devices, app hangs, independently of the additional CaraTrip reports switch. The provider is Functional Software, Inc. (Sentry), USA. It processes technical error and crash information, stack traces, app version and build, operating system, device information and technical app states; on Apple this can include error messages and sanitized diagnostic context. The network service also processes the IP address during transmission.

The apps do not set Sentry user profiles and remove user associations or filter credentials and sensitive request components. Android additionally restricts sent events to fixed technical fields. These measures do not guarantee that every possible error message is anonymous. Screenshots, screen recordings/Session Replay and automatic usage analytics are disabled. Sentry is not used for advertising.

The configured Sentry endpoints use the US region; transfers to the USA are possible. Sentry describes its transfer mechanisms and safeguards, including the EU-US Data Privacy Framework and standard contractual clauses, in its privacy and data processing information linked below.

7. Voluntary CaraTrip reports and support

Additional CaraTrip error reports can be enabled separately and are sent to caratrip.de. Current versions send a fixed technical event category, error type, app/OS/device details and language; free-form messages, file names, private content and original object identifiers are not part of this report projection. Disabling it stops future additional reports, not Sentry.

When you explicitly submit a support request, we process your name, email address, subject, message, language and accompanying technical app information. The request is stored in the CaraTrip system and may be forwarded by email to our support team for handling. Do not send sync codes, passwords or unnecessary third-party data.

8. Other online services and security

News and other requested CaraTrip content are loaded from caratrip.de. Currency features may retrieve European Central Bank reference rates. Requests involve normal connection data such as IP address, time, requested address and technical client information. Server logs, error logs and limited abuse-prevention data support secure operation. Hosting, infrastructure and email service providers may process this data on our behalf. Opening this policy also makes a website request.

We use HTTPS for CaraTrip services and restrict administrative access. We do not sell your data or use travel data for personalized advertising. External providers may process data outside the EEA; their linked information explains their respective recipients and safeguards.

9. Purposes and legal bases

We provide the app, sync, sharing, map and support features you request under Article 6(1)(b) GDPR. Where consent is required, particularly for voluntary additional reports, Article 6(1)(a) GDPR applies. You can withdraw consent at any time for the future without affecting prior lawful processing. A system permission does not automatically replace every consent required under data protection law.

Necessary technical error diagnosis, security and abuse prevention rely on Article 6(1)(f) GDPR: our interest in a secure, reliable app and protected services. Statutory retention obligations rely on Article 6(1)(c) GDPR. We do not make automated decisions producing legal or similarly significant effects or carry out corresponding profiling.

10. Retention and deletion

Local data remains until you delete it or remove the local app data. You must delete exported files and your own backups separately at their storage locations. Uninstalling an app does not delete previously uploaded cloud data or copies on other devices.

Private Cloud data remains while the configured space is in use. The app provides deletion functions for space owners and, depending on the platform, a choice when leaving between immediate deletion and 30 days of encrypted backup retention. An expired backup is no longer usable as an active sync space and is removed by expiry processing. Simply switching off sync on a device is not a deletion request. Manage iCloud copies additionally through Apple and your connected devices.

Support requests and diagnostic reports are retained for as long as handling the request, analyzing errors or defending against specific abuse or legal claims requires. They are then deleted or anonymized unless legal obligations require retention. Technical logs follow the necessary operational and security purpose; Sentry additionally follows the retention of the respective project. We do not promise a single fixed number of days for all services here. Backup copies can remain until replaced or their backup retention expires and are restricted from regular use.

You can request deletion or access through info@marketport.de even without app access. Provide only information necessary to identify the data; do not send a decryption or sync code. We will arrange secure verification if needed. Without a key, we cannot identify encrypted records from their content.

11. Your rights

Subject to legal requirements, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. You may complain to a data protection authority, in particular the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (ldi.nrw.de). Contact us using the details above to exercise your rights.

12. Scope and changes

This policy covers the current features described; older installed versions can differ. We update this page when relevant changes occur. The linked general market port privacy policy additionally applies to its general website offerings. Those general notices do not replace the app-specific data flows explained here.