Privacy Policy.
The short version: CarrierPony has no accounts, collects no personal data, runs no analytics, and the relay cannot read anything you send. Here is the long version.
Last updated: July 4, 2026
Who this covers
This policy covers the CarrierPony iOS app and this website, both developed and operated by NorseHorse, an independent developer. Contact: NorseHorse@norsehor.se.
What the app collects
Nothing about you. There is no account, no sign-up, and the app never asks for your name, phone number, email address, or contacts. Your identity in CarrierPony is a cryptographic keypair generated on your device.
What the relay sees
Messages and files travel through a store-and-forward relay so they can be delivered when the recipient's phone comes online. The relay handles:
- Sealed envelopes — ciphertext encrypted end to end between the two paired devices. The relay has no keys and cannot read it. Envelopes are held only until delivered, then deleted.
- Routing identifiers — opaque, key-derived identifiers used to deliver envelopes to the right device, plus a device push token so iOS can wake the app. None of these are tied to a name, number, or email, because the app never has any.
- Standard connection metadata — like any internet server, the relay sees connecting IP addresses at the network level. It does not build profiles from them.
Push notifications
Delivery uses Apple's push service to wake the app. Notifications do not expose message content to the relay operator; the plaintext of a message exists only on the two paired devices.
What this website collects
Nothing. No analytics, no trackers, no advertising scripts, no third-party fonts, no cookies for tracking. If you use the launch-notify form, your email address is stored solely to send you a single launch announcement and is never shared or sold.
Third parties
There are none in the message path other than Apple's push infrastructure, which carries wake-up signals, not message contents. No data is sold or shared with anyone.
Data retention and deletion
Envelopes are deleted from the relay on delivery. Undelivered envelopes are dropped after a bounded holding period. Deleting the app deletes your keys and message history from the device (make a backup first if you want to keep them). Because there is no account, there is no server-side profile to delete.
Children
CarrierPony is not directed at children under 13 and does not knowingly collect information from anyone, children included.
Changes
If this policy changes, the update appears on this page with a new date. There is no dark-pattern re-consent flow because there is no data collection to consent to.
Contact
Questions about privacy: NorseHorse@norsehor.se.