Privacy

The short version

Curio stores the account you make, the picks you share, and who you follow. It sends crash reports and basic usage events to two service providers so the app can be fixed and understood. It shows you no advertising, sells nothing to anybody, and does not track you across other apps or websites. There is no advertising identifier in this app, and it never asks for your location, your contacts or your calendar.

The rest of this page is the detail, including the parts that are not flattering.

Who is responsible

Curio is made and operated by Vector9, based in Canada. One person is responsible for it and for the protection of what it holds. If you want anything on this page explained, corrected or acted on, write to hello@curiocc.app and that person will read it.

What Curio collects

Your account. An email address and a password, which is stored only as a hash. If you sign in with Google or Apple instead, Curio receives the email address and name that service returns, and nothing else - Curio does not copy your Google profile picture. Curio also stores the handle you choose, and the display name, one-line bio and profile picture you set, if you set them.

What you make. The links you post, together with the title, creator and artwork that Curio looks up for them, and any note you write. Your follows, your reactions, the accounts you block, and any reports you file. Your saves, which are visible only to you. If you rate Curio in the app, your score and any comment you add, with the app version and whether you use iOS or Android, are stored with your account, kept until the account is deleted, and read only by Vector9 to improve Curio.

Your settings. Which music and book services you prefer links to open in, your theme, and whether your account is private.

Diagnostics. Crash reports, and a small set of usage events: the app opening, moving to the background, updating, which screen you are on, when you create an account or sign in, and how far you get through the short tour that runs once on your first visit. Screen names are recorded as templates rather than as real addresses, so a screen about one person is recorded as the shape of that screen and not as that person. The sign-in record notes which door you used, whether an email and password, a recovery code, Apple, or Google, and never the password itself. The tour records that it started, which steps you saw, when a step could not be shown, and that it ended, whether you finished it or skipped it. It records nothing about what is on the screen behind it. Rating Curio records that you were offered the rating, the score you send and whether you started from the prompt after a post or from Settings, never your comment, and when you open the store from it. It also records when the app asks the store to show its own review card, but not whether the card appeared, because the store does not say.

What Curio does not collect. No location permission is ever requested. No contacts, no calendar, no microphone, no camera. The photo library is read only at the moment you pick a profile picture, and only that one image leaves your device. There is no advertising identifier, no ad network and no cross-app tracking of any kind.

Where it goes

All of it is stored and processed outside Canada. Each service is named below with the country it runs in.

Supabase holds the database, the sign-in system and the stored images. The project runs in Frankfurt, Germany.

Sentry receives crash reports. Curio’s Sentry project is hosted in the European Union, and is configured not to record your IP address. Crash reports carry the account identifier, the app version, the device model and operating system, and a trail of the requests the app made just before the crash. Each request in that trail is recorded as its address with everything from the question mark onwards cut off, so what Sentry receives is that the app asked to read posts, not which post or whose handle it asked about. It does not include your password, the text of your notes, or anything you have written.

PostHog receives the usage events described above, together with your email address, so that those events can be read as one person’s rather than as an anonymous count. It is hosted in the United States. Curio disables its location lookup, so PostHog is not asked to turn your address into a place. Nothing in the app profiles or locates you, and the one lookup that would have is switched off in code rather than left as a preference. Your crash reports carry only the account identifier, never the address.

Vercel hosts this website and counts visits to it, and how often each store button is pressed. Each count is made at Vercel’s edge from the request itself: the page, the site that sent you here, your approximate location (down to the city), and the kind of device, operating system and browser. It sets no cookie, stores no identifier on your device, and cannot follow you to another site. It is a measure of this website only and is entirely separate from the app: signing in to Curio is not involved, and Vercel is never told who you are.

Resend sends the sign-in and password emails on Curio’s behalf, and therefore receives your email address and the code being sent. It is based in the United States.

Expo delivers the app’s updates. Curio can be fixed between App Store releases by fetching a new version of its code, and the app asks Expo for one each time it opens. That request tells Expo your device’s network address, the platform you are on and which version you are running, so that it can answer with the right update or with nothing. It carries no account, no identifier Curio has given you, and nothing you have written. Expo is based in the United States.

Anything you write to support using the feedback screen in the app is sent to Curio’s own inbox as an email, through Resend, rather than being stored as a message. It carries your handle, the email address on your account, your account identifier, and the version, device and operating system you were running, and the reply address is set to yours so that a question about what you reported reaches you. The message itself is not kept anywhere else. One record about the send is kept in Curio’s database for thirty days: that your account sent feedback, and when. It holds no message text, and it exists so a daily limit can be enforced, because feedback and Curio’s sign-in codes are sent through the same mailbox.

The form on the support page is a separate route and behaves differently. What you write there, together with the name and email address you put into it, is sent to Curio’s own inbox as an email, through Resend. It is not written to Curio’s database and it is not attached to your account, because that page does not know who you are. Your address is used to reply to you and for nothing else.

What your device fetches directly, and who sees that

This is the part most apps do not tell you. Curio shows album art, film posters, book covers and video thumbnails, and it plays thirty-second music previews. Most of those files are not copied onto Curio’s servers first - your device fetches them from the service that holds them.

That means those services can see your device’s IP address and the kind of device you are using, in the ordinary course of you scrolling. The services are YouTube and Google Books, both Google; The Movie Database; the Internet Archive and Open Library; and Apple and Deezer for music artwork and previews. Playing a YouTube or Vimeo video opens that company’s own player inside the app, which behaves as their player does anywhere else.

Curio does not tell any of them who you are. It sends no account identifier, no handle and no cookie of its own. But an IP address is an IP address, and pretending otherwise would be the dishonest version of this paragraph.

When you tap through to Spotify, Letterboxd, a bookshop or anywhere else, you leave Curio and that site’s own terms and privacy policy apply.

Who can see what

Your handle, display name, bio, profile picture and posts are visible to anyone signed in to Curio.

Your saves are private to you. Your blocks are private to you. Reports are visible only to whoever reviews them.

Profile pictures are an exception worth knowing. They are stored at a public web address that contains your account identifier, so anyone holding that address can open the image without signing in. That is how the app displays them quickly. If that is not acceptable to you, do not set one.

How long it is kept, and what deleting really does

You can delete your account from inside the app, under Settings. It is immediate and it is not reversible. It removes your account, your profile, your posts and notes, your follows, saves, reactions and blocks, your profile picture, your ratings of Curio and their comments, and any reports you filed, which are attached to your account and go with it.

Three things deliberately survive it, and you should know what they are.

• Reports that named you are kept, and your identifier and any quoted text are removed from them as your account goes. That record is deliberately held with no link back to your account, so it is not yours to delete: a complaint that erased itself when the person complained about closed their account would make moderation impossible. Reports you filed are the other direction and are not kept, as above. Deleting your account withdraws your own complaints; it does not erase complaints made about you. The removal is a second step after the account itself is gone, and it is retried once if it does not take. If it fails both times the deletion still stands, and writing to hello@curiocc.app will finish it.
• A cache of link information. When anyone shares a link, Curio stores what it found at that address - the title, the creator, the artwork - so the next person to share it does not cause the same lookup. That cache is stored against the link, not against a person, and it is not deleted when an account is. It contains nothing about you.
• Diagnostics already sent. Crash reports and usage events that have already reached Sentry and PostHog remain there, under an account identifier that no longer belongs to anyone, until those services’ own retention periods expire.

Sign-in records held by the authentication system, which can include the address you signed in from, are kept for a limited period by that system for security purposes.

Feedback send records are kept for thirty days. Each one is your account identifier and the time you sent feedback, with no message text - what you wrote is emailed and never stored. They exist so the daily limit described above can be counted. A scheduled job removes them once they reach thirty days, whether or not anybody sends feedback in the meantime, and they are deleted with your account rather than surviving it.

If you want the surviving diagnostics purged as well, write to hello@curiocc.app and it will be done by hand.

Your rights

Curio honours these for everybody, wherever you live, because keeping two standards would be worse than keeping one. You may ask to:

• be told what is held about you, and why;
• have anything inaccurate corrected;
• have it deleted;
• receive a copy in a portable, machine-readable form;
• withdraw your consent, which means closing the account.

The fastest route to deletion is the button in the app. For anything else, write to hello@curiocc.app. If you are not satisfied with the answer, you can complain to your national privacy regulator.

If there is ever a breach that puts anyone at real risk, the people affected and the relevant regulators will be told.

Age

Curio is for people aged 13 and over. It is not directed at children, and it does not knowingly collect anything from anyone under 13. If you believe a child has an account, write to hello@curiocc.app and it will be removed.

Changes

When this page changes, the date at the top changes with it. If a change alters what is collected or where it goes, you will be told in the app before it takes effect rather than left to notice a date.