Privacy Policy

Effective date: [DATE] Operator: [COMPANY] (the "Operator", "we", "us") Contact: dscullywebdesign@gmail.com

This Privacy Policy describes how Curio (the "Service") collects, uses, and shares information.

1. Who we are

[COMPANY] operates the Curio service at [APP_URL]. Curio is a parent-managed learning tool for young children. The account holder is always the parent or legal guardian. Children do not directly register or interact with our servers.

2. Information we collect

2.1 Information the parent provides

• Account email and password (Supabase Auth)
• Optional child profile: child's first name, birth month, birth year. These are used only to age-appropriately tune the games and are never used for advertising.
• Photos and word labels the parent uploads to build collections (the core feature of the app). Curio is designed for photographing the child's belongings and surroundings — toys, cups, rooms — not the child. A person may appear incidentally; the parent controls every photo and can delete any of them at any time.
• Parent settings: theme choice, voice on/off, learning-mode toggle

2.2 Information collected automatically

• Game session data: timestamps, score, correct/incorrect tap counts. Used to render the parent's progress charts.
• Screen-visit data: which screens of the app a signed-in account opens and when. Used only in aggregated, de-identified form to see which parts of onboarding and the app people use or drop off from — never shown per-account inside the app.
• Authentication tokens (Supabase JWTs)
• Server logs including request paths, status codes, IP address, user-agent. Retained [LOG_RETENTION_DAYS] days for security and abuse prevention.
• Error reports (if Sentry / equivalent is enabled) including a stack trace and the authenticated user's ID

2.3 Information we do not collect

• We do not show third-party advertising and do not run advertising trackers.
• We do not sell personal information.
• We do not collect microphone audio.
• Camera access (when granted) is used only to upload a photo the parent chooses; the camera stream is not transmitted.

3. How we use information

4. Sharing your information

We share information only with the following sub-processors, each contractually bound to use the data solely to provide their service:

Voice recordings. Curio's voice is recorded with ElevenLabs. To record a word from your photo library, we send ElevenLabs that word on its own — for example "kettle" — and nothing else: not the photo, not your email, not the child name on your profile, and nothing that links the word to your account. A label is sent exactly as written, so a photo labelled with a person's or pet's name has that name recorded like any other word. The recording is stored with us (Supabase) and keyed by the word alone, so it can be played back to any account whose own library holds the same word, and to no other account. Words for which no recording exists are spoken by your device's built-in voice, which does not leave your device.

Account sharing inside the Service: a parent may invite up to three secondary email addresses to view (or edit) their account. The secondary user can see all collections, items, photos, and progress under that account. Secondary users do not see the primary user's account email beyond that one invitation message.

We will disclose information when required by law, valid legal process, or to protect the rights, property, or safety of users or the public.

5. Children's privacy

Curio is designed to be used by a parent or guardian alongside a young child. Our policy is that the account holder must be 18 or older (or the age of majority in their jurisdiction). We do not knowingly create accounts for children.

When a parent uses the Service with their child:

• The child does not have an account, password, or any independent identifier on our servers.
• The optional first name and birth month/year of the child are used only to age-tune the games and are never used for advertising, profile-building, or sharing with third parties.
• Photos uploaded by the parent are intended to show the child's belongings and surroundings, not the child. The parent controls what is uploaded and can delete photos at any time.
• We may analyze game-session data (accuracy, number of uses, etc.) in aggregated, de-identified form — combined across the user base so it cannot be traced back to your account or child — to understand usage patterns and improve the Service. This aggregate analysis is never used for advertising, individual profiling, or contacting any child, and is never shared with third parties.

Data Protection Officer / privacy contact. Questions, access requests, or complaints about children's data may be sent to our privacy contact at dscullywebdesign@gmail.com.

If you are a parent or guardian and you believe we have inadvertently collected information from a child without proper parental consent, please contact dscullywebdesign@gmail.com and we will delete it.

This product is not currently certified by a COPPA Safe Harbor program. See COPPA.md for additional notes.

6. Data retention

• Account data: retained until the parent deletes their account.
• Photos: deleted when the parent deletes the item or collection, or when the account is deleted.
• Inactive-account photos: if an account is not used for 90 consecutive days, all of its uploaded photos are automatically and permanently deleted. Profiles, collections, and settings remain so the account still works on return, but the images must be re-added. An account counts as "used" when the primary holder or any invited caregiver signs in or opens the app, so a shared library stays intact as long as anyone on it is active.
• Game session analytics: retained until the parent clears history, or until account deletion.
• Voice recordings of library words: a recording holds only the word, not who added it, so it is not deleted with any one account. It stops being playable to you the moment no photo in your library carries that word. Ask us and we will delete the recording of any word outright.
• Logs: [LOG_RETENTION_DAYS] days.
• Backups: rolling [BACKUP_RETENTION_DAYS] days.

7. Your rights

You may at any time:

• Access / Portability — Settings → "Download my data" returns a JSON file with every row associated with your account (collections, items, settings, game sessions, share invites). Photos are referenced by Supabase Storage URL, not inlined.
• Correct inaccuracies — edit collections, items, profile, etc.
• Delete your account and associated data — Settings → "Delete account". Deletion is immediate for primary data (collections, items, settings, sessions, photos, auth row); backups age out within [BACKUP_RETENTION_DAYS] days.
• Restrict / object to processing — contact dscullywebdesign@gmail.com.
• Lodge a complaint with your data-protection authority. EU/EEA residents may contact their national DPA. UK residents may contact the ICO.

8. International transfers

Data is processed in the regions listed in §4. Where data is transferred outside the EEA/UK, transfers rely on Standard Contractual Clauses with the sub-processor.

9. Security

• All traffic is served over TLS.
• Account passwords are stored hashed by Supabase Auth.
• Database access is gated by row-level security policies; user data is isolated per account.
• Photos are stored in private-by-default buckets keyed to the user's ID.
• Server-only secrets (service role keys) are never sent to the browser.

No system is perfectly secure. If you believe you have found a vulnerability, please email [SECURITY_EMAIL].

10. Cookies & local storage

We use:

• Auth cookies set by Supabase to keep you signed in.
• localStorage to cache your collections and photos for offline use.

We do not use third-party advertising or analytics cookies.

11. Changes to this policy

When we make material changes we will update the "Effective date" at the top of this document and, where required, notify account holders by email.

12. Contact

[COMPANY] [ADDRESS] dscullywebdesign@gmail.com

This is an unverified draft.