1. Introduction
Curiate LLC ("we," "our," or "us"), an Oregon limited liability company, respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your information when you use our content curation service.
Important: Curiate uses YouTube API Services to provide video content. By using our service, you acknowledge that you have read and agree to Google's Privacy Policy at https://policies.google.com/privacy.
2. YouTube API Services
Our service uses YouTube API Services to display video content and metadata. This section explains how we handle YouTube-related data:
2.1 YouTube Data Access
- We access publicly available YouTube video information (titles, descriptions, thumbnails)
- We do not access private YouTube user data or account information
- We do not store YouTube authentication tokens
- Video playback occurs directly through YouTube's embedded players
2.2 Data Usage and Limitations
- YouTube video data is used solely to provide content recommendations
- We do not modify, alter, or misrepresent YouTube content
- Video data is not shared with third parties beyond what's necessary for service operation
- We comply with YouTube's terms of service and community guidelines
2.3 User Controls
You can control your interaction with YouTube content through our service:
- Remove saved video content from your profile
- Adjust content preferences to exclude video recommendations
3. Information We Collect
3.1 Information You Provide
- Google account information (name, email, profile picture) when you sign in. We request only the standard "email" and "profile" permissions.
- Apple account information (name, email) if you use Sign in with Apple. If you choose Apple's private email relay, we receive only the relay address rather than your real email address
- A username, if and when you first publish or comment publicly. You choose this separately from your real name
- Content preferences and interests you select
- Articles, videos, and books you save or interact with
- Curations, comments, and votes you publish, and messages you send to friends through the service
- Search queries and browsing behavior within our service
- Video interaction data (clicks, views, saves) for recommendation purposes
3.2 Information We Collect Automatically
- Device information (browser type, operating system)
- Usage data (pages visited, time spent, features used)
- Your device's time zone. We use it to derive your approximate region — at the country level — so that we apply the correct email consent rules for where you live. We do not use location services, GPS, or your IP address to determine your location, and we never derive anything more precise than a country
- A device push notification token, if you enable notifications in the mobile app. We use it only to deliver notifications to your device
- Crash reports and diagnostic data from the mobile app, which may include device model, OS version, and the state of the app at the time of an error
- Subscription status and transaction metadata, if you subscribe. We never receive or store your full payment card number — payment details go directly to Apple or Stripe
4. How We Use Your Information
We use your information to:
- Provide personalized content recommendations
- Improve our recommendation algorithms
- Maintain and improve our service
- Analyze usage patterns and trends
- Communicate with you about the service
- Send you product news, feature updates and curation highlights by email, where you have not opted out (or, in the EEA and UK, where you have opted in)
- Send push notifications to your device, if you have enabled them
- Enable the social features you choose to use (friends, comparisons, messaging, and publishing curations)
- Operate subscriptions and billing
- Diagnose crashes and fix bugs
- Ensure security and prevent fraud
- Comply with legal obligations
5. Data Storage and Security
We use Google Firebase as our primary data storage and authentication platform. Your data is stored securely in Google's cloud infrastructure with industry-standard security measures.
- Data is encrypted in transit and at rest
- Access is restricted to authorized personnel only
- Access to our systems requires multi-factor authentication
- We monitor for errors and unusual activity, and apply security updates to our dependencies
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
6. Data Sharing and Third Parties
We work with the following third-party services:
- Google: Firebase Authentication, Firestore and Google Cloud (data storage and hosting), Firebase Cloud Messaging (push notifications), YouTube API Services
- Open Library: book metadata and cover images
- Apple: Sign in with Apple, and the App Store for in-app purchases
- Stripe and RevenueCat: subscription purchases and management (web and Android via Stripe; iOS via Apple In-App Purchase managed through RevenueCat)
- Firebase Crashlytics: crash and error diagnostics for the mobile app. Collects crash reports, device model, operating system version and a randomly generated installation identifier — not your name or email address
- AI service providers: automated content categorization and recommendations. We send content metadata only — never your name, email address, or account identifier
These providers process data on our behalf, only as needed to run the service, and are bound to handle it consistent with this policy.
6.1 YouTube Data Sharing
Regarding YouTube data specifically:
- YouTube video data is only displayed to you, the user who requested it
- We do not share YouTube content data with other users or third parties
- Video interaction data (views, saves) is used only for your personalized recommendations
- No YouTube user authentication data is stored or accessed by our service
- All YouTube content is subject to Google's Privacy Policy and YouTube's Terms of Service
6.2 General Data Sharing Principles
We do not sell, rent, or trade your personal information to third parties for marketing purposes. We only share data as necessary to provide our service or as required by law. Any data sharing is done in accordance with this privacy policy and applicable laws.
We do not use your information to track you across other companies' apps or websites for advertising, and we do not share it with data brokers or advertising networks.
6.3 Information Visible to Other People
Some parts of Curiate are social by design. What you share depends on what you choose to use:
- Friends. If you connect with someone, they can see your display name and profile picture (including the picture from your Google account), and the content you share or compare with them. Messages you send are visible to their recipients
- Public curations. If you publish a curation or post a comment, it is public. It is shown to anyone on the internet, attributed to your chosen username, and its page can be indexed by search engines. Your real name and email address are not attached to public posts
- Everything else is private by default. Your saved articles, interests, knowledge map, and reading levels are not visible to other users unless you share them
User-submitted public text is screened for abusive content before it is stored. You can delete curations and comments you have published; once deleted they are removed from the service, though search engines may retain cached copies for a period outside our control.
7. Your Privacy Rights
You have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate or incomplete data
- Deletion: Request deletion of your personal data
- Portability: Receive your data in a structured format
- Restriction: Limit how we process your data
- Objection: Object to certain processing activities
- Marketing opt-out: Unsubscribe from product and marketing emails at any time, using the link in any such email. You will still receive essential service messages (for example friend requests, account and security notices), which are not marketing and are not affected by unsubscribing.
- Push notifications: Turn them off at any time in your device settings, or in the app's notification settings
- Public content: Delete any curation or comment you have published, at any time
To exercise these rights, please contact us through the service or delete your account directly through your profile settings.
8. Data Retention
We retain your personal data only as long as necessary for the purposes outlined in this policy:
- Account data: Until you delete your account
- Usage data: Up to 2 years for analytics purposes
- Saved content: Until you remove it or delete your account
- Security logs: Up to 1 year
- YouTube video interaction data: Until you delete your account or remove specific content
- Push notification token: Until you disable notifications, sign out, or delete your account
- Crash and diagnostic reports: Up to 90 days
- Subscription and transaction records: Retained as required for tax, accounting, and dispute-resolution obligations, even after account deletion
8.1 Account Deletion and Data Removal
When you delete your account or revoke authorization:
- Your personal data is deleted within 7 calendar days, except for the limited records described below that we are required to keep
- YouTube video interaction data is immediately removed from recommendations
- Cached video metadata may persist for up to 30 days for service stability
- Your stored push notification token is deleted and we stop sending notifications
- Curations and comments you published publicly are removed. Search engines may retain cached copies of those pages for a period outside our control
- Messages you sent to other users may remain visible in those recipients' copies of the conversation
- Limited subscription and transaction records are retained where we are legally required to keep them (see above)
- You can request immediate deletion of all data by contacting us
9. Local Storage
We use local storage on the device — browser local storage on the web, and the equivalent on-device storage in the mobile app. We do not use cookies for tracking. It holds:
- Authentication state: Keeps you signed in between sessions
- Content cache: Stores recently loaded content to improve performance
- Preferences: Remembers your settings and interests locally
You can clear it at any time — through your browser settings on the web, or by signing out or deleting the app on mobile. Doing so will sign you out and reset your locally cached preferences.
10. Children's Privacy
Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.
11. International Data Transfers
Your data may be processed in countries other than your own, including the United States where Google's servers are located. We ensure appropriate safeguards are in place for international data transfers in compliance with applicable laws.
12. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes through the service or via email. Your continued use of the service after such changes constitutes acceptance of the updated policy.
13. Governing Law
This Privacy Policy is governed by the laws of the State of Oregon. Any disputes relating to this policy shall be subject to the exclusive jurisdiction of the courts located in Oregon.
14. Contact Us
If you have any questions about this privacy policy or our data practices, please contact Curiate LLC at:
Curiate LLC
Email: info@curiate.app
15. Legal Basis (EU Users)
For users in the European Union, our legal basis for processing your data includes:
- Consent: When you agree to data processing
- Contract: To provide our service to you
- Legitimate interests: To improve our service and ensure security
- Legal obligation: To comply with applicable laws