CaliberBase Carry
Privacy Policy
Effective October 23, 2026; clarified October 17, 2026
Clarification of existing processing: encrypted vault storage, readable account metadata, optional disclosures and backup retention. This update does not add data collection or change how we use your information.
- We do not sell your information. We share it only with the companies that run our service (Section 6) and when the law requires.
- If your sign-up showed you a recovery code, your permits are locked on your device before they reach us, and we cannot read them.
- The current iPhone and iPad tracking form collects only the issuing state or territory and expiration date, with a generated jurisdiction label for storage. It does not ask for personal names, permit numbers or addresses. Older records and records from another CaliberBase app may contain additional fields; Carry does not expose those fields in its tracking form. The camera can read your card on your phone and then throws the picture away; nothing about the picture is saved or sent.
- The app offers Free Carry and an optional Carry Plus annual subscription through Apple. It has no third-party advertising or tracking SDKs and never reads your device's location. (Our own server does record a country and region from your IP address when you sign in; Section 1.)
- You can delete your account from inside the app.
We will not claim to know nothing about you. Section 1 lists what is readable on our side, and Section 9 what we keep after you delete.
1. What we hold
| What | Can we read it? |
|---|---|
| Your email address, and values that let us check your password (a hash and salt, never the password) | Yes |
| Your confirmed Free Carry jurisdiction, and any home or residence state you supply. The confirmed free choice is separate from editable profile fields | Yes, unencrypted: the map is built around them |
| The first and last name you give your account, if any | Yes (encrypted at rest under a key we hold), so we can tell whose account is whose when you write in |
| Your permits: the current iOS tracking form saves issuing jurisdiction and expiration date, with a generated label. Older or other-product records may also contain an issue date, printed names or notes. Do not put permit numbers in notes | End-to-end account: no. Older account: state and expiration date yes (unencrypted), the rest yes (encrypted under a key we hold). See Section 2 |
| How many permits you have, and when each was created or changed | Yes |
| Apple subscription references: platform and environment, original transaction reference, random account-binding token, status, expiration, revision and verification timestamps | Yes, to verify paid access. We do not receive full payment-card details or an Apple subscriber email for creating your CaliberBase account |
| When you were last active; when you created the account, accepted the Terms and confirmed your email (for an account that existed before we required it, the recorded date is the day the requirement began); on an end-to-end account, two locked copies of your key | Yes, but we cannot open the key copies |
| Two-factor settings if you turn them on: the secret (encrypted under a key we hold) and, if you leave "Remember this device for 30 days" ticked on the website, that device's label and IP address until 30 days after you last use it. The app never sets this | Yes |
| Sign-in records: time, IP address, the browser or device details reported, and the country and region of the IP (never a city, coordinates, network provider or data centre). We keep your last 20 sign-ins and a second record for 90 days | Yes |
| Support messages, notes our staff write on your account, and attachments you send | Yes, not encrypted. Please do not send permit numbers or pictures of your permit |
We use the 90-day record in aggregate (how many people use Carry, how many come back, which countries, states and devices). Our staff can also open one account's recent sign-ins to help you or look into abuse. Nothing automated uses either record to make a decision about your account. On the website, you can see your own last 20 sign-ins yourself, any time, from Recent Sign-Ins under Profile & Account (when, your browser or device, and the country and region it came from). The 90-day record stays staff-only.
2. Two kinds of account
End-to-end (your sign-up showed you a recovery code). Your permit details are encrypted on your device with a key that only your password or recovery code can unlock. We store ciphertext and cannot read it. We never receive your password or recovery code (we keep only a value that checks a code you present). If you lose both your password and your recovery code, we cannot recover your permits. The Permits screen shows which kind you have.
Older (created before end-to-end encryption). A permit's state and expiration date are unencrypted so the app can list and sort them; the rest is encrypted on our servers under a key we hold. That protects it if the database is stolen, but we can technically read it and could be compelled to produce it. These accounts reset a password by email; end-to-end accounts cannot.
No longer collected. Earlier versions let you record a permit number, a date of birth, an address and photographs of your card. We no longer collect them. On September 22, 2026 we deleted every photograph we had stored, and checked every account whose permits we can read for a permit number, a date of birth or an address left over from before: we found none, so there was nothing else to delete. On an end-to-end account, anything you added to a permit stays inside that encrypted permit, where we cannot read or delete it, until you open and save the permit in the app or on the website; saving removes it.
3. In the iPhone and iPad app
- Camera. Apple's document scanner and text recognition read the state and expiration date on your device. The picture is not saved and is never sent to anyone. Only what you confirm in the form is saved.
- Reminders. Notifications on your device, only if you allow them: on the days you select before expiration (defaults: 120, 90, 60, 45, 25, 20, 14, 7, 3 and 1 days; reminders whose scheduled time has passed are skipped) and, if it lapses, one at 9 a.m. the next morning. The app sets them when you open it while signed in, so changes made elsewhere can keep old reminders until you next open the app; signing out removes them. The lock screen shows the state and, after a lapse, the expiration date (you can hide previews in iOS Settings). No push service is involved.
- On your device. An encrypted copy of your permits lets the app work offline and is excluded from backups. Your session token, saved account details, the key for that copy and, on an end-to-end account, your own key stay in the iOS Keychain on that device only.
- No third-party code. No third-party analytics, advertising or tracking code, and it never reads your device's location (our own server keeps the sign-in records in Section 1). "Near me" hands a search to Apple Maps.
- Map data. The app downloads it from carry.caliberbase.us without an account when it has no saved copy, the copy is over a week old, or you tap Refresh. Like any web request, this shows your IP address to our host, Cloudflare (see Section 9 for its logs). It carries no account details and is not counted in our page counter.
- Maryland and Virginia. A card labelled FROM THE DEVELOPER links to the developer's own firearms training courses and opens in your browser. The app sends nothing about you, but that site sees your IP address and browser like any site you visit, under its own policy.
4. How we use it, and the email we send
We use your information to run your account and show you your records, answer support requests, keep the service secure and detect abuse, and meet legal obligations. We do not use it to build an advertising profile.
We send account mail only: a link to confirm your email address; if you ask to reset a password, a one-hour link (older accounts) or a message pointing you to your recovery code (end-to-end accounts, because a password we could reset would be a password that let us read your permits); a sign-in code if you use two-factor authentication and ask for the emailed one; deletion notices (Section 9); and status updates, replies and other messages from our staff about a support request or your account. We do not email permit reminders. The website shows a status badge next to each permit ("Expired", "Renews in N days", "Active") when you open it.
5. What we do not do
We do not sell or rent your personal information, or share it with data brokers, advertisers, insurers or firearms retailers. We do not report your permit records to any government agency, and nothing in the service works as a registry. We do not use your records to train machine-learning models (on an end-to-end account we could not).
6. Who helps us run it
- Cloudflare hosts the service (application, database, file storage), delivers our email, and routes mail sent to our support and staff addresses onward to our team's own inbox. On the website, its Turnstile bot check runs when you create an account, and its Web Analytics script on our public pages reports the page, referrer, country, device type and typically browser and load timing to us in aggregate.
- Our own page counter on the public site records the page and the country, state and city of each request. Neither counter is linked to your account or sets an advertising cookie.
- Google Fonts serves the website's typefaces, so your IP address reaches Google when a page loads.
- Stripe is involved only if you start a checkout for, or convert your account to, another product we offer (a Carry account can do this on the website, never in the app). Stripe does not process Apple in-app subscription payments; we never receive a full card number.
- Apple processes iOS subscription payments and provides signed transactions and subscription-status updates for verification. A separate CaliberBase login links access across devices. See Apple's Privacy Policy.
Cloudflare and Stripe process information under the applicable service terms and configurations; we do not promise zero provider retention. Once support and staff-notice mail reaches our team's own inbox, it is subject to that mailbox provider's own terms rather than this policy. The native app has no Web Analytics or Google Fonts SDK. Account creation opens the secured website, where Turnstile and website resources may load.
7. Moving your account to another product
Our website lets you upgrade your existing Carry account to CaliberBase Vault using the same email and password. This is optional and requires eligible paid, lifetime or granted Vault access. It moves your permits into Vault on that same account, removes the Carry copies once the move completes, and issues a new recovery kit; your old recovery code stops working. The migration is one-way. Carry now supports signing in to a Vault account as well; verified Vault Paid access includes Carry Plus, while Vault Free includes Free Carry. From then on, that product's own Terms and Privacy Policy apply, including its subscription and billing terms.
8. Legal requests
We comply with a subpoena, warrant, court order or other binding demand to the extent required. What we can produce is what we hold (Sections 1 and 9): chiefly your email address; your home state, the state you live in and your account name; how many permits you have and when they changed; sign-in times and IP addresses with country and region; two-factor and trusted-device records; support correspondence; subscription and account-binding references; and your encrypted permit data. On an end-to-end account we cannot decrypt your permits. On an older account we can, so a permit's name, issue date, printed first and last name and notes could be produced in readable form, and its state and expiration date are not encrypted at all. Nothing here stops a court ordering you to unlock your own account; whether that is lawful is unsettled, and is a matter for you and your attorney. We will tell you about a demand for your data where we are allowed to.
9. Keeping and deleting your data
We keep your data while your account exists. You can delete your account in the app (Permits, then Account & Security, then Delete Account) or on the website. It is scheduled for deletion: disabled at once, then permanently deleted after fourteen days. Your permits and sign-in records are deleted with it.
If you delete it yourself, we try to email you a link to cancel during those fourteen days. If the email does not reach you, write to us before the date and we can stop it.
If our staff schedule the deletion, which is also how a request you write to support is carried out, the account is disabled at once and deleted on or shortly after the date in the notice (fourteen days ahead unless staff set another period). That notice tells you how to object instead of carrying a cancel link.
Either way a second notice follows when the deletion is complete, and if a notice cannot be delivered the deletion still goes ahead.
End-to-end accounts: Permanent account deletion removes the wrapped keys and encrypted permits from the active service. It does not immediately erase every backup copy. Encrypted contents and wrapped keys can remain in recovery backups until those copies expire or are removed. We do not restore permanently deleted accounts. On older accounts the server encryption key is ours; deleting one account does not destroy that shared server key.
Recovery backups can contain encrypted vault contents, wrapped keys and readable account metadata after removal from the active service. Our Cloudflare backup archives become eligible for expiration after seven days; removal is asynchronous, not an exact erasure deadline. Independently held backup copies follow a separate seven-day rolling retention procedure and require operator removal. Provider database recovery copies follow their own recovery window. Authorized recovery operators can read backed-up metadata and server-encrypted fields using recovery keys; end-to-end encrypted contents still require the user's key. Recovery takes place in quarantine, with completed deletions reconciled before service resumes. We do not use recovery backups to restore accounts that have been permanently deleted.
These records outlive the account. We keep them to answer questions about a deletion, to keep a security history with application-level append-only and integrity checks, to follow up on support requests, and to keep payment and Founders records straight.
| Record | What it keeps | How long |
|---|---|---|
| Completed deletions | Your email address, internal account number, and the dates the deletion began and finished | No end date: kept until we set one |
| Security audit log (application-level append-only controls; retained for investigations) | The same email and account number, the request and completion dates, and actions our staff took on the account, including the subject of any message they sent you | No end date: kept until we set one |
| Support conversations, kept under your internal account number | For a ticket opened in your account: subject, category, priority, status, dates, assigned staff member, any escalation note or reference, and each message's date and author. Attachments are deleted with your account; their name, type and size stay | The record: no end date. Message text: blanked within two years after the ticket closes (seven days after it is marked resolved, or sooner if staff close it; a ticket still open at deletion is closed then). File name, type and size: two years after upload. Email you send to our support address: up to two years from your last message in the thread |
| Billing or Founders record if you subscribed through Apple, started a checkout for another product, or reserved a Founders number | A checkout: your email, the plan, our payment provider's references. A Founders reservation: your internal account number and the number, status and dates, so a number is never given twice | No end date: kept until we set one |
| Notices to our staff | When you sign up or open a support ticket we email our staff a notice with your email address (and the ticket's subject). Those mail copies are not removed when you delete your account | No end date: kept until we set one |
Cloudflare also logs requests to our servers, which can include the IP address and page requested, in a request log we have switched on that people with access to our Cloudflare account can read; it keeps them for a short period on its own schedule.
Apple subscription retention. Deleting a CaliberBase account does not cancel an Apple subscription; cancel renewal in Apple Account subscription settings. When the account is permanently purged, its direct subscription user link is removed, but the original transaction reference and random account-binding token remain as an ownership tombstone to prevent another account claiming the purchase. These transaction and security references currently have no scheduled deletion date.
10. Your choices and rights
You can manage your account and, with eligible access, your permits in the app and on the website. Free Carry asks you to confirm one jurisdiction; that saved free choice cannot be edited. Carry Plus permits additional jurisdictions without replacing the original free choice. You can export your permits from Backup & Restore on the website (the app does not export), and delete your account from either. For anything else we hold, such as sign-in records or support history, write to support@caliberbase.us and we will respond within 45 days. Depending on where you live you may also have legal rights to access, correct, delete or port your data, and to be free from discrimination for using them. We cannot produce the contents of an end-to-end account's permits, because we do not have them in readable form.
11. Children, where your data is held, changes and contact
The service is for adults (18 and over); we do not knowingly collect information from children, and if a minor has created an account, tell us and we will remove it. We operate from the United States and process your information here; if you use the service from elsewhere you are transferring it to the United States, where privacy law differs from your own. We may update this policy, and will tell you in the service or by email before a change that materially reduces the protection of information we already hold takes effect. CaliberBase Carry is operated by CaliberBase: support@caliberbase.us, or
CaliberBase
P.O. Box 244
Crofton, MD 21114
United States