Legal
Privacy Policy
This policy covers both the Karfolio app and karfolio.com. It is written from what the app and our API actually do, not from a template. Where the app and the website differ, we say so.
Last updated: 3 September 2026.
1. Who we are
Karfolio is operated by Karfolio, the controller of your personal data under the GDPR.
- Address — Marsstraat 40B, 6133 WL Sittard, The Netherlands
- Support and privacy questions — info@karfolio.com
2. What we collect
We only collect what the app needs to work. Concretely:
Account data
- Your name and email address.
- Your password, stored only as a hash — we never see or store the password itself.
- A user ID that identifies your account internally.
- Your profile picture, bio and interests, if you provide them.
Content you create
- Vehicles you add, including photos, make, model and specifications.
- Logbook entries and drives, including notes and titles.
- Kardex spots: vehicles you photograph in the wild, with their location.
- Likes, follows, tags and blocks.
Location data
- Precise GPS coordinates with timestamps — recorded while you record a drive. This is the most sensitive category we handle. Recording only runs during an active drive that you start and stop yourself.
- Background recording — on iOS the app can keep recording while it is in the background, so a drive is not cut short when you lock your phone. On Android this runs as a foreground service with a persistent notification, so you can always see when recording is active.
- Kardex spot location — the location of a spot, if you add one.
Photos, videos and audio
- Media you upload of your vehicles and spots. Videos include their audio.
- Photos may contain EXIF metadata, including the location where they were taken.
Device data
- A Firebase Cloud Messaging device token, so we can send you push notifications.
Website (karfolio.com)
The website only processes what you fill in on the beta signup form: your email address, a referral code derived from that address, the referrer's code if you arrived through an invite link, a short label for the place on the site where you signed up, the signup date and a confirmation flag. Nothing more — no name, address, phone number or vehicle details.
Right after you sign up we email you a confirmation that you are on the list. Every email we send from the beta list carries an unsubscribe link that takes you off it immediately, and you can always ask us to remove your address instead.
To keep the form from being spammed, the server counts signups per IP address (at most five per ten minutes) in working memory only. That record expires within ten minutes; the IP address never reaches the database and is never linked to your signup. The form also uses a hidden field and a timing check to recognise bots, which stores nothing extra about you.
What we do not collect
- No advertising SDK, no analytics SDK and no tracking. We do not build advertising profiles, and we do not sell or share your data with data brokers.
- We do not ask for your date of birth.
3. Why we use it, and on what legal basis
| What | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Account data | To create and secure your account and let you sign in | Performance of a contract |
| Content you create | To show your garage, drives and spots — to you and to others, as your privacy settings allow | Performance of a contract |
| GPS during a drive | To calculate your route, distance, speed and duration | Consent — you grant location access and start each drive yourself |
| Photos, videos, audio | To display them in the app | Performance of a contract |
| Device token | To send the push notifications you enabled | Consent |
| Moderation reports and blocks | To keep the platform safe and to meet our legal and app store obligations | Legitimate interest |
| Support correspondence | To answer your question | Legitimate interest |
| Beta signup (website) | To invite you to the beta and tell you when Karfolio goes live | Consent |
You can withdraw consent at any time by turning off the relevant permission in your device settings, by turning off notifications, or by using the unsubscribe link in any beta email — or by asking us to remove your signup. That does not affect processing that already took place.
4. Location, specifically
Karfolio records your location only during a drive you start yourself, and stops the moment you end that drive. It never records in the background outside an active drive.
A drive starts when you tap Start drive and ends when you tap Stop drive. Between those two moments the app records coordinates with timestamps so it can work out your route, distance, average and top speed, and duration.
Because a drive should not be cut short when your screen locks, the app keeps recording in the background: on iOS through the location background mode, on Android through a foreground service that shows a permanent notification for as long as recording is active. Stop the drive and the recording stops with it.
Recorded routes are stored with the drive and stay there until you delete the drive or your account. A drive's route is drawn on a map, so consider that a drive starting or ending at your home address shows that location to anyone who can see the post.
6. What other people can see
Your posts, drives, spots and profile can be visible to other users. You control this in Settings → Privacy. Keep in mind:
- A drive's route is shown on a map. Do not record drives that start or end somewhere you would rather not make public.
- A Kardex spot includes the location where you took the photo.
- Blocking someone works in both directions: they disappear from your feed and you disappear from theirs.
7. How long we keep it
- Account data and content — until you delete them, or until you delete your account.
- Moderation reports — kept after the reported user's account is deleted, because they form the record that keeps our moderation meaningful. Reports you filed are deleted along with your account.
- Server logs and caches — rotated automatically and kept no longer than 30 days.
- Beta signups — until launch, and after that no longer than needed to inform you about that launch and your access — or until you unsubscribe, which you can do from any email we send.
- Abuse-check IP addresses — working memory only; gone within ten minutes.
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and object, and the right to data portability. To exercise them, contact info@karfolio.com. We respond within one month.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Deleting your account
You can delete your account in two ways:
- In the app — Settings → Security → Delete account.
- On the web — karfolio.com/account-deletion — enter your email address and confirm with the code we send you.
Both routes do exactly the same thing and delete, permanently and immediately:
- Your profile, vehicles and Kardex spots
- Every drive and logbook entry, including recorded routes
- All photos and videos you uploaded
- Your likes, follows, blocks and challenge progress
- Your login
This cannot be undone. Reports other users filed about your content are retained, as described in section 7.
10. Children (under 13)
Karfolio is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child has created an account, contact info@karfolio.com and we will remove it.
11. Security
All traffic between the app and our servers uses HTTPS. Passwords are stored hashed. Access to production systems is limited to people who need it.
13. Changes
We may update this policy. Material changes are announced in the app. The date at the top shows when it was last changed. See also the terms of service.