Privacy Policy

Last updated: April 15, 2026

CareRing ("we", "us", "our") is a family caregiver coordination app operated by Vasil Nonchev, based in Sofia, Bulgaria. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the CareRing mobile application and related services.

We take your privacy seriously, especially given the sensitive nature of health-related information. We comply with the European Union General Data Protection Regulation (GDPR) and applicable Bulgarian data protection laws.

1. Data Controller

Vasil Nonchev
Sofia, Bulgaria
Email: privacy@carering.app

2. Data We Collect

2.1 Account Data (collected at sign-in)

Data	Source	Purpose
Name	Google Sign-In	Display in care circles
Email address	Google Sign-In	Account identification
Profile photo URL	Google Sign-In	Display in care circles

2.2 Health & Care Data (entered by you)

Data	Purpose
Medication names, dosages, schedules	Medication tracking and reminders
Medication administration logs	Adherence tracking
Daily check-ins (mood, pain, sleep, appetite, mobility)	Wellness monitoring
Medical conditions and allergies	Medical information hub
Emergency contacts	Quick access to important contacts
Appointments (doctor, therapy, lab)	Care schedule coordination
Care notes	Shared care documentation
Task assignments	Caregiver coordination

2.3 Technical Data (collected automatically)

Data	Purpose
Device push notification token (FCM)	Sending medication reminders and task notifications
Crash reports	App stability monitoring (via Firebase Crashlytics)
App version, device model, OS version	Debugging and compatibility

3. Legal Basis for Processing (GDPR Article 6)

Consent — You voluntarily provide health and care data by entering it into the app.
Contract performance — Processing is necessary to provide the CareRing service you signed up for.
Legitimate interest — Crash reporting and technical diagnostics to maintain service quality.

Health data is processed under GDPR Article 9(2)(a) — explicit consent. You may withdraw consent at any time by deleting your account.

4. How We Use Your Data

Display care information to members of your care circles
Send push notifications for medication reminders, task assignments, and care updates
Synchronize data between your devices and care circle members
Generate care reports (PDF export) when you request them
Monitor app crashes and fix bugs

We do NOT:

Sell your data to anyone
Use your data for advertising
Share your data with data brokers
Use your health data for profiling or automated decision-making
Train AI or machine learning models on your data

5. Data Sharing

5.1 With your care circle members

When you join a care circle, other members of that circle can see the care data within it (medications, tasks, check-ins, notes, medical info). You control which circles you join and can leave at any time.

5.2 Third-party service providers

Provider	Purpose	Data shared	Location
Google Firebase (Authentication)	User sign-in	Email, name, profile photo	EU (europe-west1)
Google Firebase (Cloud Messaging)	Push notifications	Device token, notification content	EU
Google Firebase (Crashlytics)	Crash reporting	Device info, crash logs (no health data)	EU
RevenueCat	Subscription management	Anonymous user ID, purchase receipts	US (Standard Contractual Clauses)

We do not share health or care data with any third party. Health data is stored only on our own servers and your device.

6. Data Storage & Security

Server: Google Cloud Platform, region europe-west1 (Belgium, EU). All data encrypted at rest (AES-256-GCM) and in transit (TLS 1.3).
Device: Local database encrypted with SQLCipher (AES-256). Sensitive preferences encrypted via Android Keystore.
Authentication: Firebase Authentication with Google Sign-In. We never see or store your Google password.
Access control: Role-based access within care circles (Owner, Admin, Member, Viewer).

7. Data Retention

Your data is retained for as long as your account exists.
When you delete your account, all your data is permanently deleted from our servers within 30 days.
Crash reports are retained for 90 days.
Server logs are retained for 30 days.

8. Your Rights (GDPR Articles 15-22)

You have the right to:

Access — Request a copy of all data we hold about you
Rectification — Correct inaccurate data (you can edit directly in the app)
Erasure — Delete your account and all associated data ("right to be forgotten")
Data portability — Export your data in a machine-readable format (JSON)
Restriction — Request that we limit processing of your data
Objection — Object to processing based on legitimate interest
Withdraw consent — Withdraw consent at any time by deleting your account

To exercise any of these rights, use the in-app settings or contact us at privacy@carering.app. We will respond within 30 days.

9. Account Deletion

You can delete your account at any time from Settings within the app. This will:

Delete your user profile and all personal data
Remove you from all care circles
Delete circles you own (and all data within them)
Revoke your authentication credentials

Deletion is permanent and cannot be undone.

10. Children's Privacy

CareRing is not intended for use by children under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. International Data Transfers

Your data is primarily stored in the EU (GCP europe-west1, Belgium). RevenueCat processes subscription data in the US under appropriate safeguards (Standard Contractual Clauses). No health data leaves the EU.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the app or by email. The "Last updated" date at the top reflects the most recent revision.

13. Contact Us

For privacy-related questions or requests:

Email: privacy@carering.app
Vasil Nonchev
Sofia, Bulgaria