Privacy Policy

1. Who is responsible

Curio is operated by North Star Strategic Partners LLC, the controller of the personal data described here.

2. Data we handle

Account and sign-in data

• Google sign-in: Google account ID, email address, name, avatar and a Google access token. We do not keep the sign-in refresh token.
• Sign in with Apple: Apple account identifier, an Apple refresh token kept only so we can ask Apple to revoke access when the account is deleted, and the name Apple provides on the first authorization. We store that first name and do not overwrite it later.
• Email sign-in: email address used for a one-time code.

If you choose Apple's Hide My Email, Apple gives us a private-relay address. That address cannot match your Google address, so signing in that way creates a second, separate Curio account rather than linking the accounts. We do not use an Apple private-relay address as an identity key for linking.

Your Curio session is stored in the iOS Keychain on your device. A Keychain entry can remain after the app is uninstalled.

Location

The app asks for “while using the app” location permission. We use location to show you on the map, find places nearby, provide turn-by-turn navigation and notice the places you visit (see Places you visit). When the app is not on screen, location is used in three cases only: while a navigation route is running; for up to 10 minutes after navigation ends at or near its destination, with the iOS location indicator showing, to see whether you stayed; and, only if you turn on “Also in the background” and allow location “Always”, for a few minutes at a time when iOS tells Curio that you have arrived somewhere or come near a place on your map. Nothing runs in between. We do not keep a trail of where you have been. The iOS build declares background location capability for turn-by-turn directions and for the check after navigation ends.

For Places search and geocoding, search text and coordinates reach Google. During active turn-by-turn navigation, the Google Navigation SDK sends Google navigation data, including your GPS location and the route you take, so Google can provide and improve navigation. Google handles that data as an independent controller under its own privacy policy, not as our processor. Natural-language search sends Google's Gemini the city name under the map centre, never raw coordinates.

Places you visit

Curio notices when you spend a few minutes at a place, so it can remember where you have been and learn what you like. This is on once you allow location, and you can turn it off at any time in the app under Manage account → Places you visit (“Notice places I visit”). Curio looks for a stay in these situations only:

• After navigation. When turn-by-turn navigation in Curio ends at or near its destination, Curio keeps reading your location for up to 10 minutes, with the iOS location indicator showing, and stops as soon as you leave.
• While the app is open. When Curio is on screen and you are within about 100 metres of a place on your map, it checks whether you stay. The check stops when you leave the app.
• In the background, only if you choose it. Only if you turn on “Also in the background” and allow location “Always”. iOS then wakes Curio briefly when it sees that you have arrived somewhere, or when you come within 100 metres of one of the 20 places on your map nearest to you, and Curio reads your location for a few minutes to find the place. Nothing runs between those moments. You can turn this off in the app or in iOS Settings at any time.

What stays on your phone. The location readings for a stay are written to a protected file on your device and deleted as soon as the stay is worked out. The stay itself (its position, accuracy and times) stays on your device until it is matched to a place or given up on, and for at most 7 days. Turning visit detection off, or signing out, deletes every stay not yet matched.

Matching a stay to a place. The app sends the stay's position, accuracy, and arrival and departure times to our server, which answers with the places around it. Our server does not store the position or the times and does not write them to its logs. If Curio knows too few places around the stay, our server asks Google once for nearby places, so Google receives the position. The app then picks the likeliest place on your phone.

What we keep. A visit the app matched with confidence is kept unless you tell us you were not there. A visit it was unsure about is kept only if you confirm the place. A kept visit records the place, the calendar day, how long you stayed as a range (under 10 minutes, 10 to 30 minutes, 30 to 90 minutes, over 90 minutes, or unknown) and how it was noticed. It never records coordinates, a time of day, a route or a trail of where you went.

Importing past visits. Under Import past visits you can find places you have been in your photos or in a Google Timeline export. Curio reads each photo's location and date on your phone and stores none of them. A Timeline export is read on your phone, and the copies the app makes of it are deleted after reading. To match a past stay to a place, its centre goes to our server as described above and is not stored. Only the visits you choose to keep are uploaded. An import's progress and the visits waiting for your review stay on your phone and are cleared when you sign out.

How visits are used. Your visits are visible only to you. They shape your own recommendations (for example “You've been 4 times”) and let Curio work out your home city and notice trips (see Home and trips). Counted across everyone, visits also give a place a return rate (“Most visitors come back”), used only for places at least 3 people have visited, and never naming anyone.

Deleting visits. A visit is kept until you delete it or your account. Answering “I wasn't there” when Curio asks about a visit deletes it, and you can ask us to delete any visit at support@gocurio.app. Deleting a visit also deletes the record that you confirmed it, the visit date it set on a saved place for that day, and its readings in our recommendation logs, and your home city and current trip are worked out again without it. To cap costs we count, per account and per day, how many Google lookups visit matching made; those counts are kept for 7 days.

Photos and content you provide

The photo library opens only when you choose a cover image for an Insider Map you are building, or when you import past visits from your photos (see Places you visit). That cover is uploaded and stored with your account. The app never uses the camera. There is no per-place photo upload; place imagery comes from Google and is served through our proxy.

We store the content needed for the features you use: saved places, personal notes, tags, categories, collaborative lists, shared places, and Insider Maps, including their title, description, cover, curated places and seller notes. Imported libraries remain in a staging area while you review them, before you commit them to your map.

Google saved-places import

If you ask to import your saved places from Google, we receive the saved collections covered by the scope https://www.googleapis.com/auth/dataportability.saved.collections. We hold a separate Google refresh token for this import, record the scopes Google actually grants, and build credentials only from those scopes. The service permits one export per 24 hours per user. We use the data only to import your own saved places into your own map.

Natural-language search

When you search in natural language, Google's Gemini receives the query text, your own tag vocabulary, the city name under the map centre, today's date and your locale. We do not send Gemini an account identifier. We send each request with Gemini's storage option turned off (store: false).

Our server keeps the raw query text, detected language, map-region context, parsed result, and timing and token counts in a table readable only by our own systems. We use this to debug bad parses, meter usage and improve search quality. We aim to retain these search records for no more than 90 days.

Product analytics records the length of the query, never its text.

Instagram import

When you share an Instagram post into Curio, we send the post URL to ScrapeCreators. It returns the public media and caption. The images and caption go to Google's Gemini to identify the places discussed, and candidate places are resolved against Google Places. For a video post, Gemini also receives still frames sampled from the video and its audio track, which it transcribes.

Creator media is never stored. Image URLs exist in memory only for the job and are purged after 15 minutes. We keep no copy and no media URL, only each slide's media type. The extracted result for a public post is cached and shared across users. The post is read once; later sharers receive the cached outcome. The cache is keyed to the public post, not a user, and is retained indefinitely. We record that you ran an import, which places you saved, and attribution to the original creator's handle.

Before you sign in

Curio's introduction runs before you sign in. When it starts, the app gets a random onboarding ID from our server and keeps it in your device's Keychain. We store only a one-way hash of the ID. The ID can only search for cities, fetch places in a city and start Instagram imports, and it expires after 30 days.

To limit abuse and cost, we store a one-way hash of your IP address, made with a secret key, with the ID and with each request that costs us a Google or import lookup, and we remove it after 48 hours. We count those lookups per ID, per hashed IP address per day, and for everyone per day.

You choose a city by name, or let the app find the city you are in. To find it, your coordinates go to our server and to Google. We remember which city covers that spot for 30 days, keyed by the coordinates rounded to about 1 km and not linked to you or to the ID. We do not store your exact coordinates.

Your answers (the moods you pick, what you dislike, your reactions to places, and the places you keep or skip) stay on your phone until you sign in. Instagram posts you share during the introduction are processed as described under Instagram import and are tied to the ID until you sign in.

When you sign in, the app sends those answers to our server. We save the places you kept or liked to your map, record your reactions, move the ID's imports to your account, and keep a record of your answers with your account, where they help shape your recommendations, until you delete your account. If you never sign in, the ID and its imports are deleted when the ID expires. After you sign in, the ID's own record is deleted 30 days later.

How Curio learns your taste

Curio ranks places for you and tells you why a place may suit you. To do that it uses:

• Your reactions and actions. “Not for me”, like and love; the places you save, open, share, get directions to or navigate to from results; and your visits.
• What you tell us. The moods and dislikes you pick in the introduction; the places in Instagram posts you import (a post you remove from your imports stops counting); notes you type about your taste or for a mode, such as “no chains”; and your answers when Curio asks “Is this your kind of place?”. Notes are read by Google's Gemini (see Service providers) and are never shown to anyone else. Curio also reads the private notes you write on places you saved, as described below.
• Places that are alike. When you mark a place “Not for me”, Curio may rank places much like it a little lower (see How we understand places). If you remove a pattern Curio has learned about you, we keep a note of that so it does not come back.
• Tests of our ranking. Sometimes a results list mixes the order from two versions of our ranking, or swaps two neighbouring results, and we record which version supplied each place. This tells us which version works better.

Notes on places you saved. When you write or edit a private note on a place you saved, Curio sends the note's text (its first 1,000 characters) to Google's Gemini, which tells us what the note says about that place: what you think of it, details such as whether it is good for kids or has outdoor seating, and what kind of place it is and its price. We store only those labels and values, never the words of your note; the note itself stays with your saved place, as before. Curio uses this reading only for your own recommendations and modes. It is never shown to anyone else and never used for anyone else's results. Editing the note replaces the reading, and clearing the note, removing the place or deleting your account deletes it.

We keep a log of the results we showed you, including the search text, the area searched, the reasons shown and the ranking-test records, for 180 days. Your reactions and your actions on results are kept until you delete your account. A note is kept until you delete it, it expires, or you reset your taste (“Start a fresh portrait”). Its earlier text is kept only while you can still undo a change (30 days, or 24 hours after a reset), and nothing in that history is kept longer than 90 days.

We use all of this only to rank and explain places inside Curio. It has no legal or similarly significant effect on you.

Home and trips

Curio works out your home city from the cities of the places you save, react to and have visited. It never uses your device's position or the map area you browse for this. We store only the city's name and country and a centre rounded to a tenth of a degree (about 11 km), never an address. If you set your home city yourself, we keep your choice and do not overwrite it; you can hand it back to Curio to work out again.

When your visits show you away from your home city on two days in a row, Curio treats you as on a trip there and can adjust your recommendations for that city. We store only the current trip: its city, a centre rounded the same way, and the days it started, was last seen and ended. A trip is forgotten 30 days after its last visit. You can turn a trip off. Past trips that Curio shows you are worked out from your visits when you look at them, and are not stored separately.

Your home city and trips are never shown to anyone else. Your home city is kept until you delete your account.

People with your taste

Curio compares tastes across accounts to find people whose taste agrees with yours, and uses what they did with a place as one signal when it ranks that place for you. Taste here means a person's reactions (“Not for me”, like and love) and saves. People you are connected to start as likely matches: people who shared places with you, other members of shared lists of up to 50 people that you belong to, and Insiders whose Instagram handle matches a post you imported. Everyone, including them, then counts only as much as their taste actually agrees with yours.

What we store. For each account, up to 50 people whose taste agrees most, with how strongly they agree, how many places that rests on, whether they started as a connection, and when this was worked out. The list is rebuilt every night, and each rebuild replaces the one before. We also store which places tend to be liked by the same people, as numbers that name no one.

What anyone sees. No one is shown who their matches are, and no one is told that they are someone else's match. Curio has no screen that lists them. Curio uses matches only as counts: it may tell you that a number of people with your taste loved a place, and only when at least 3 of them reacted to it. In the same way, your reactions and saves count, without your name, in other people's results.

Deletion. Once you ask to delete your account, your reactions and saves stop counting for anyone and you are left out of every rebuild. When the account is erased, your list and every entry that names you on someone else's list are deleted.

How we understand places

To find places that are alike, Curio writes a short text description of each place that is on someone's map, on a shared map, in a share or in an imported post. The description is built from the place's name and categories; Google's editorial summary of the place; up to five Google reviews of the place; the title, caption and place notes of public Instagram posts people imported; notes Insiders publish on the free samples of their maps; and notes and tags that people chose to share with others on shared maps and in shares. Your private notes, titles and tags are never used.

We store Google's summary and review text for these places, and the attributes Google lists for them (for example whether a place serves wine, is good for children or groups, takes reservations, allows dogs or has wheelchair access). We refresh both on a cycle we set, every 60 days today. For each review we store its text, language, rating and date, never the reviewer's name, photo or profile.

Each description is turned into a list of numbers (an embedding) on our own servers by an open-source model; the text is not sent to any outside provider for this. Comparing these numbers finds places that are alike. Descriptions and embeddings describe places, not people, and carry no account identifier. When your account is deleted, descriptions that held text you shared are rebuilt without it and their embeddings are replaced. A place's description and embeddings are deleted once no map, share or import includes the place.

Product analytics and crash reports

PostHog receives product events such as app opens, shares created or opened, lists joined, search submissions and outcomes, import steps, and Insider Map views, checkouts and purchases. There are roughly 50 event types. Every event includes the environment and app build number. On sign-in and session restore, analytics is linked to your account's internal user ID. The accompanying traits are app build, platform and locale—not your email, name or picture. Signing out resets the analytics identity. Some events contain opaque share or list tokens and Insider Map prices.

Sentry crash reporting runs only in builds where it is configured. An unconfigured build starts no crash SDK and sends nothing. Personally identifying data collection is turned off. Console-log breadcrumbs are dropped so log lines cannot leak session data into reports; network breadcrumbs remain. The only identifier attached is the account's internal user ID.

Payments and seller onboarding

Payment happens on the web at gocurio.app (Stripe Checkout) or in the Curio iOS app (Apple's In-App Purchase). Card details never reach our servers. Sellers set up payouts with Stripe. Stripe collects and holds the seller's legal name, date of birth, address, bank account and tax ID. We keep only the Stripe account reference, not that identity data.

For each sale, we store the buyer account ID and/or buyer email, amounts, our fee, payment status (paid, refunded or disputed), and Stripe session and payment reference IDs. Refund and dispute notices from Stripe revoke the buyer's access to the map.

Apple In-App Purchase. When you buy an Insider Map in the iOS app, Apple processes the payment. We receive a signed record of the transaction from Apple and from the app: the transaction and product identifiers, the purchase date, the App Store country or region, and a random purchase token that links the transaction to your Curio account. We do not receive your payment card details. If you ask Apple for a refund, Apple may ask us whether the map was delivered, and we answer that it was. We keep these records with your purchase for the reasons given for other transaction records.

Server logs

Request logs record account ID, endpoint, method, response status, IP address and user agent. We also count share-link opens per map per day using a one-way keyed hash of the visitor's IP address and user agent; the share-open table does not store the IP address itself. We use these records for security, abuse prevention and operating the service.

3. Why we use data and our legal bases

4. Service providers and recipients

We use the following providers for the stated purposes. Third parties that receive user data are required to protect it to the same or an equal standard as this policy describes.

• Supabase: account data, app content, database records and Insider Map covers for authentication, database, file storage and realtime features.
• Google: OAuth account data and tokens for sign-in and Data Portability; search text and coordinates for Places, Maps and geocoding; GPS location and the route taken during active turn-by-turn navigation, which Google receives as an independent controller; saved collections for a user-requested import; the position of a stay when Curio knows too few places around it; your coordinates when the introduction finds your city; and requests for places' summaries, reviews and attributes, which carry no data about you.
• Google (Gemini): the natural-language search inputs described above; public Instagram images, captions, and the frames and audio of video posts, for place extraction and transcription; and the text of notes you type about your taste or for a mode, and of the private notes you write on places you saved, so Curio can read them. We send no account identifier.
• Apple: sign-in identifiers and revocation requests for Sign in with Apple; signed In-App Purchase transaction records for Insider Maps bought in the app.
• ScrapeCreators: a public Instagram post URL so it can return the post's public media and caption.
• Stripe: checkout details, transaction identifiers and seller onboarding data for Insider Map payments and payouts.
• PostHog: account-linked product events and the limited traits described above for product analytics.
• Sentry: configured crash and network diagnostic data, with the internal user ID, for reliability.
• AWS: API traffic and server data for hosting our API servers.

5. Google Data Portability and Limited Use

The use of information received from the Data Portability API adheres to the Data Portability API user data and developer policy, including the Limited Use Requirements.

We do not transfer or sell Data Portability data to advertisers, data brokers or information resellers. We do not use it for advertising of any kind, including retargeting or personalised advertising. We do not use it for credit-worthiness or lending decisions. Our use also follows the Google API Services User Data Policy.

6. How long we keep data

We keep account and service data while your account is active and as needed to provide the features you choose. Specific rules are:

• We aim to keep natural-language search records for no more than 90 days. The retention automation is not yet in place, so this is a target, not a current deletion guarantee.
• Instagram creator media is never stored. In-memory image URLs are purged after 15 minutes. The extracted public-post result is retained indefinitely.
• Request logs and share-open counts are kept as long as necessary for security, abuse prevention and operating the service.
• Stripe transactions cannot be deleted and can only be redacted after 90 days. Stripe may retain some records longer where law requires.
• Our transaction records are retained as described under account deletion.
• Visits are kept until you delete them or your account. A stay not yet matched to a place exists only on your phone and is deleted once it is matched or given up on, after at most 7 days. Daily counts of Google lookups for visit matching are kept for 7 days.
• The log of results we showed you, with its search text, reasons and ranking-test records, is kept for 180 days. Your reactions and actions on results are kept until you delete your account. A taste note is kept until you delete it, it expires or you reset your taste; its earlier text is kept only while a change can be undone, and never longer than 90 days. What Curio read from a note on a saved place is kept until the note is changed or cleared, the place is removed or your account is deleted.
• An onboarding ID is deleted 30 days after it was created if you never sign in, or 30 days after you sign in. Its hashed IP address is removed after 48 hours. Your introduction answers are kept with your account until you delete it.
• Your home city is kept until you delete your account. A trip is forgotten 30 days after its last visit.
• The lists of people with your taste are rebuilt every night, and each rebuild replaces the one before.
• Google's text and attributes for a place are refreshed on a cycle we set, every 60 days today. A place's description and embeddings are deleted once no map, share or import includes the place.

7. Account deletion

You can delete your account from your profile in the app. You can also make a deletion request by emailing support@gocurio.app without using the app. Here is what happens:

1. Your account is locked immediately and signed out everywhere. Nothing is destroyed at that point.
2. The request is held for 30 days.
3. Signing in during those 30 days cancels the request and restores the account in full. There is no separate cancel button.
4. At day 30, erasure starts. It cannot then be reversed, and sign-in is refused.

When you request deletion, the app shows you the date the deletion will complete. Afterwards you can check the status, and confirm that it finished, from a link the app keeps on that device — without signing in, because by then there is no account left to sign in to. If you reinstall the app or change device before it completes, that link is gone and we cannot show it to you again; the deletion still completes on schedule.

We erase saved places, your own notes and tags, photos, categories, import history, search history, share links and the sign-in record. We also erase your visits, reactions, taste notes and their history, what Curio read from your notes on saved places, introduction answers, home city and trip, your list of people with your taste and every entry that names you on someone else's list, and we rebuild place descriptions without text you shared.

Information that remains

• Content another person already saved. If someone saved a place you shared, their copy remains, including the note and tags attached when it was shared. It is no longer linked to your deleted account. That person saw your name when you shared it, and we cannot undo that.
• Sold Insider Maps. Buyers keep access to what they paid for. The map is taken off sale and shown without your name or profile.
• Transaction records. Amounts, dates, the purchased item, Stripe reference numbers and records of in-app purchases remain as long as tax, accounting and anti-fraud law requires and as needed to defend legal claims. We remove the email address and account link from our copy. For a creator, the record of Apple sales credited to you and payouts made to you also remains.
• Administrative audit records. The account ID and action name for actions our operators took are append-only by design and cannot be edited or deleted.
• Backups. Copies in routine database backups are overwritten as the backups age out. Our database backups are retained for 24 hours, so a copy of deleted data can persist in a backup for up to one day after erasure.
• Counts across people. Return rates and the places liked by the same people are rebuilt every night. Your data stops counting in them at the first rebuild after you ask to delete your account.

Sign-in access

If you signed in with Apple, we ask Apple to revoke our access. If you signed in with Google, we revoke every Google token we still hold. A Google sign-in token expires by itself within about an hour, so for most accounts there is nothing left on our side to revoke. The app shows you, for each provider, whether we were able to confirm the revocation.

You can remove Curio yourself at any time: for Google, visit Third-party apps with account access; for Apple, open Settings → your name → Sign in with Apple.

8. Your privacy rights

Depending on where you live, you may ask for access to your personal data, correction, erasure, restriction of use, portability, or object to processing. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

Email support@gocurio.app to exercise a right or make any other data request. You do not have to use the app.

If the GDPR applies, you may complain to the data-protection supervisory authority where you live, work, or believe an infringement occurred. Israel's Privacy Protection Law, as amended by Amendment 13 in force since August 2025, provides applicable data-subject rights and the right to complain to the Israel Privacy Protection Authority.

We do not use automated decision-making that produces legal or similarly significant effects.

9. California disclosures

The categories of personal information we collect are identifiers and account data; location information; internet and app activity; user content; commercial and transaction information; diagnostic data; and inferences about your taste drawn from your activity, such as your home city. The sources, purposes and recipients are described above.

The visits you keep may count as precise geolocation, which California treats as sensitive personal information. We use it only to provide the features described under Places you visit and Home and trips.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. California residents may request access, correction, deletion and portability, and may exercise applicable rights without discriminatory treatment, by emailing support@gocurio.app.

10. International data transfers

Our service providers may process data outside your country. The primary hosting region is Frankfurt, Germany (AWS eu-central-1), which hosts both our API servers and our database. Where required, we use appropriate contractual or other legal safeguards for international transfers.

11. Children

Curio is for people aged 16 or older. We do not knowingly collect personal data from anyone under 16. If we learn that we have done so, we will take steps to delete the data. A parent or guardian can contact support@gocurio.app.

12. What we do not do

• We do not show advertising and do not use ad networks or ad SDKs.
• We do not track you across other companies' apps or websites. We do not show an App Tracking Transparency prompt because there is no tracking permission to request.
• We do not sell personal data.
• We do not share personal data for cross-context behavioural advertising.
• We do not make automated decisions with legal or similarly significant effects.
• We do not show anyone else your visits, your home city, your trips, or who has taste like yours.

13. Security

Security measures include the access controls and limits on provider data described above. No system is perfectly secure. Please contact us promptly if you believe your account or data is at risk.

14. Changes to this policy

We may update this policy when the service or law changes. We will update the date above and give notice in the app or by another appropriate method when a change materially affects your rights.

Your use of Curio is also governed by our Terms of Service.

15. Contact