Privacy Policy

Last updated: October 30, 2026

This Privacy Policy describes how Curbie (“the app”, “we”, “us”, or “our”) collects, uses, and discloses your personal information when you use the Curbie – Parkeringsregler app or otherwise communicate with us (collectively, the “Service”). In this policy, “you” and “your” refer to you as a user of the Service.

By using the Service, you agree to the collection, use, and disclosure of your information as described in this policy. If you do not agree, please do not use the Service.

Data controller

The data controller of your personal information is Staffan Kilnes, Stockholm, Sweden. Contact: staffan@kilnes.com.

Changes to this policy

We may update this Privacy Policy from time to time, including to reflect changes in our practices or for other operational, legal, or regulatory reasons. The updated policy will be posted with a revised “Last updated” date.

Information we collect

Your account

• Account without sign-in. The first time you open the app, we create an account for you automatically, identified by a random ID. You don’t have to give us any personal information to use Curbie. The app also stores a random device ID in your iPhone’s keychain.
• Sign in with Apple (optional). If you sign in with Apple, we receive a stable user identifier from Apple and, if you choose to share them, your name and email address. If you use Apple’s “Hide My Email”, we receive a relay address instead of your real one. We use them to identify your account, and your name to show who has parked a shared vehicle.

Information you provide

• Vehicles. What you enter when you add a vehicle: name, vehicle type, color and, if you add it, the license plate.
• Parkings. When you park, we store your vehicle’s exact position, the street and street segment, the time you parked and the time you need to move. Earlier parkings are kept as the vehicle’s parking history.
• Shared vehicles. When you share a vehicle, we create an invite code that is valid for 24 hours, and store who is a member of the vehicle.

Information collected automatically

• Location (while you use the app). With your permission, the app uses your location while it’s open, to show the map and find the street you’re on. To fetch the parking rules for your area, the app sends us the approximate area you’re in (a cell about 76 meters across) and the street segments shown, not your exact position. Your exact position is only stored when you park. To show a street address, the app looks up the position with Apple’s map services.
• Push notifications. If you allow notifications, we store your device’s push token from Apple and from Firebase Cloud Messaging, so we can send you reminders before you need to move your vehicle.
• Usage analytics. We use Google Firebase Analytics to understand how the app is used. It automatically collects events such as app opens, sessions and screens viewed, an app instance ID, your device model, operating system and app version, and an approximate location (country or region) derived from your IP address. It does not use your advertising identifier, and advertising features are turned off.
• Crash reports. We use Google Firebase Crashlytics to find and fix crashes. When the app crashes, it sends a crash report with the device’s state at the time, the device model, operating system and app version, and an installation ID.
• App attestation (App Check). We use Apple’s App Attest through Firebase App Check to check that requests come from a genuine copy of the app.
• Operational logs. Our servers log technical data (time, IP address, request, errors) and count requests per account to prevent abuse.

How we use your information

• Provide the Service. Show the parking rules where you parked, save your parkings, send reminders, and manage your account and shared vehicles.
• Improve the app. Understand how the app is used and fix crashes and errors.
• Security and abuse prevention. Rate limiting, App Check attestation, and detecting misuse.
• Communicate with you. Respond when you contact us about the Service.
• Legal obligations. Comply with applicable law.

Legal bases (GDPR Art. 6): performance of contract (the Service’s core functionality), legitimate interest (improving the app, security and abuse prevention), and consent (location and notification permissions, granted through iOS prompts and revocable in Settings).

How we share information

We do not sell your personal information. We share it with these recipients for the purposes above:

• Supabase, Inc. — as data processor for our database, accounts and server functions. Your account, vehicles and parkings are stored in Supabase’s eu-north-1 region (Stockholm, Sweden).
• Google Ireland Limited / Google LLC — as data processor for Firebase Analytics, Crashlytics, Cloud Messaging and App Check, and for Firebase Authentication for accounts created in versions of the app before 1.4.
• Apple Inc. — for Sign in with Apple, push notification delivery (APNs), App Attest, and maps and address lookups.
• Other users of a shared vehicle. Everyone who shares a vehicle can see its name, type, color and license plate, where it is parked, and its parking history, including who parked it. Members see each other’s names. The vehicle’s owner can also see members’ email addresses. Someone with a valid invite code can see the vehicle’s name and the inviter’s first name.
• Authorities and other parties to the extent required by law or to protect the Service, our rights, or the rights of others.

International transfers

Your account, vehicle and parking data is stored in the EU (Stockholm). Supabase and Google are US companies, and they and Apple may process data outside the EU/EEA, for example for analytics, crash reports and push notifications. Such transfers rely on the EU–US Data Privacy Framework, the European Commission’s Standard Contractual Clauses, or other approved mechanisms.

Retention

• Account, vehicles, parkings and parking history: until you delete the vehicle or your account. Deleting a vehicle you own removes it, and its parkings, for everyone it’s shared with.
• Accounts without sign-in that never stored any data are deleted after 30 days without use.
• Invite codes: unused codes are deleted once they expire, after 24 hours.
• Push tokens: until you sign out, the token stops working, or you delete your account.
• Analytics and crash reports: according to Google’s retention periods for Firebase. They are linked to an app installation, not to your account.
• Operational logs: for a limited period according to our providers’ defaults.

Deleting your account

If you have signed in with Apple, you can delete your account in the app under Settings. This deletes your account, the vehicles you own (including for anyone you shared them with), their parkings, your memberships of other people’s vehicles and your push tokens. If you use the app without signing in, contact us and we will delete your account. Deleting your account doesn’t delete analytics and crash data held by Google, since that isn’t linked to your account.

Security

We protect your information with encryption in transit (TLS) and at rest, access rules that only let you reach your own data and vehicles shared with you, and App Check. No security measures are perfect — we cannot guarantee absolute security.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information.
• Request data portability (a copy of your information).
• Object to or restrict certain processing.
• Withdraw consent (e.g. revoke location or notification permission in iOS Settings).
• Lodge a complaint with a supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY).

Contact staffan@kilnes.com to exercise your rights. We may need to verify your identity (e.g. via the email associated with your Apple ID) before acting on a request.

Children

The Service is not intended for children under the age of 13 (or the lower age limit applicable where you live). We do not knowingly collect information from children under that age. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

Contact

Questions about this policy or how we process your data: staffan@kilnes.com.