Privacy notice
Last updated: 17 May 2026.
This notice explains what personal data CarryCurve collects, why we collect it, who we share it with, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
CarryCurve is operated by Foreranger Limited, a company incorporated in England and Wales (company number 10535686) with its registered office at C/O Mulberry & Co Eastgate House, Dogflud Way, Farnham, Surrey, England, GU9 7UD. In this notice, "we", "us", "our", and "the operator" refer to Foreranger Limited. We are the controller of your personal data for the purposes of UK GDPR.
For privacy matters, contact hello@carrycurve.com.
What personal data we collect, and why
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Email address (Pro subscribers) | Authenticate Pro access; deliver daily digest, sweet-spot alerts, welcome and account emails | Performance of contract (UK GDPR Art. 6(1)(b)) | While subscription is active, then 6 years from end of financial year of last transaction |
| Email address (newsletter subscribers) | Deliver the weekly free newsletter | Consent (UK GDPR Art. 6(1)(a)) | Until you unsubscribe |
| Stripe customer ID, subscription ID, plan | Manage billing, cancellation, customer-portal access | Performance of contract | While subscription is active, then 6 years (HMRC tax-record requirement, Limitation Act 1980 s.5) |
Functional cookie (cc_pro, signed) |
Remember your Pro unlock so you don't re-enter the email each visit | Strictly necessary for the service you requested (PECR exemption); functional cookie always permitted | 30 days from last set |
Cookie-choice marker (cc_cookie_choice, localStorage) |
Remember whether you accepted or rejected analytics | Strictly necessary | Until you clear browser storage |
| IP address, request path, user-agent (server logs) | Operational debugging, abuse prevention, traffic monitoring | Legitimate interests (UK GDPR Art. 6(1)(f)) — running and securing a public web service | 30 days in Fly.io logs, then automatically rotated out |
Data we do not collect
We do not collect your name, postal address, phone number, profile data, behavioural-tracking identifiers, or third-party advertising identifiers. We do not run advertising or third-party analytics tags on the site.
Subprocessors we share data with
To run CarryCurve we use a small set of third-party processors. Each is contractually bound to use your data only for the service they provide to us.
| Processor | What they handle | Where | Their privacy policy |
|---|---|---|---|
| Stripe Payments Europe Ltd | Card payments, subscription billing, customer-portal cancellation. We never see your card number. | Ireland / EU; sub-EU US transfers under Stripe's standard contractual clauses | stripe.com/gb/privacy |
| Resend (Resend, Inc.) | Sends transactional emails — daily digest, sweet-spot alerts, welcome, account notifications | USA; transfers under standard contractual clauses | resend.com/legal/privacy-policy |
| Buttondown (Buttondown LLC) | Manages the weekly newsletter list and delivery; hosts the public archive at letter.carrycurve.com |
USA; transfers under standard contractual clauses | buttondown.com/privacy |
| Fly.io (Fly.io Inc.) | Hosting and infrastructure for the web app and cron jobs; receives request logs incidentally | UK (London region) primary; USA for control plane | fly.io/legal/privacy-policy |
We do not sell your data to anyone. We do not share data with advertising networks.
Cookies and similar technologies
- Functional cookie (
cc_pro). A signed token that records which email you unlocked Pro with. Required for Pro to work; exempt from consent requirements under PECR Reg. 6(4)(b). - Cookie-choice marker (
cc_cookie_choice). Remembers whether you pressed Accept or Reject on the cookie banner. Stored in your browser's localStorage. - Analytics. Off by default. We do not currently load any third-party analytics scripts. If we add one in future it will be gated behind your Accept choice.
Data sources
Yield curve data displayed in the tool is sourced from each currency's official publisher: the Bank of England (UK gilts), the US Department of the Treasury (US Treasuries), the Bank of Canada (Government of Canada bonds), and the European Central Bank (Euro-area AAA-rated government bonds). This is public market data; it is not personal data.
International transfers
Some of our subprocessors (Resend, Buttondown, parts of Stripe and Fly.io) operate in the USA. Transfers of personal data outside the UK happen under the UK GDPR's standard contractual clauses (or the UK addendum to the EU SCCs) where required, and only for the purposes listed above.
Your rights under UK GDPR
You have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data, subject to our legal retention obligations (see below)
- Restrict processing in some circumstances
- Port data you provided to us in a machine-readable format
- Object to processing based on legitimate interests
- Withdraw consent for newsletter delivery at any time
- Complain to the UK Information Commissioner's Office (ico.org.uk) if you believe your rights have been infringed
Erasure and the 6-year retention obligation
If you ask us to delete your account, we will:
- Cancel your active Stripe subscription immediately;
- Mark your account as deleted so the email no longer unlocks Pro features;
- Stop sending you transactional emails (digest, alerts);
- Remove you from the newsletter list (if subscribed);
- Retain a minimal financial record (your email, Stripe IDs, subscription dates and amounts) for 6 years from the end of the financial year of your last transaction. This is required by HMRC's record-keeping rules and the 6-year limitation period for contractual claims under §5 of the Limitation Act 1980. After this period elapses, the record is permanently deleted or anonymised.
You can self-serve cancellation and deletion from /account, or email hello@carrycurve.com.
Children
CarryCurve is a tool for fixed-income professionals. We do not knowingly collect data from anyone under 18.
Changes to this notice
If we make a material change to how we handle your data, we will update this page and notify subscribers by email. The "Last updated" date at the top of this page reflects the most recent change.