Privacy Policy

CurioFlow · curioflow.app
Last updated: 27 September 2026
Operator: Justin Pilon, operating as CurioFlow, Tainan, Taiwan
Contact: admin@curioflow.app

CurioFlow is a personal cabinet for the movies, books, games, music and other things a person loves. This policy explains what information CurioFlow collects, why, where it is kept, and what we will never do with it. It is written to be read, not skimmed. If anything here is unclear, write to admin@curioflow.app and a person will answer.

Where things stand. CurioFlow is in pre-launch. Today the only public part of the service is this website and its founding-list form. The application itself — accounts, sign-in, and your cabinet — is not yet open to the public. This policy describes how the application handles your information when you use it, and it will be reviewed and re-dated before public launch.

1. What we collect, and why

We collect the minimum needed to give you an account and keep your cabinet.

The founding list. If you enter your email address on this website's "Join" form, we store that address, the date, and — if you arrived through a link that carried one — a short tag naming where the link came from (for example, a newsletter or a social post). We use the list for one purpose: to tell you when CurioFlow opens. We do not send anything else to it. To be removed from the list, write to admin@curioflow.app from that address.

Account information. When you create an account we store your email address and, if you choose one, a display name and a profile picture. You can sign in by email (a one-time link or a password) or with your Google account (see section 2).

Your cabinet. The items you place in your cabinet — the titles you add, the notes and marks you attach to them, the flows and collections you build, and what you choose to share — are stored so that they are there when you come back. This is the service.

What you actively do. CurioFlow records the actions you deliberately take in the app: placing an item, writing a note, marking something, sharing something. We do not record passive behaviour — what you hovered over, how long you looked at a page, where your cursor went. Our rule, from the first design session, is active gestures only, not surveillance. We keep to it.

Technical information. Like any web service, our servers receive the standard technical data a browser sends with every request — IP address, browser type, the page requested, and the time. We use it to keep the service running and secure. We do not build profiles from it.

We do not collect payment information. CurioFlow has no paid features today. If that changes, payments will be handled by a payment processor, this policy will be updated before it happens, and your card details will never touch our servers.

2. Signing in with Google

If you sign in with Google, we ask Google for the basic profile scopes only: your name, your email address, and your profile picture (the openid, email and profile scopes). We do not request access to your Gmail, Drive, Calendar, Contacts, or any other Google data, and we never will without updating this policy and asking you again.

Here is exactly what we do with the Google data we receive:

Access: we receive your name, email address and profile-picture URL from Google when you sign in, and nothing else.
Use: we use them to create and identify your CurioFlow account and to show your name and picture inside your own cabinet. If Google gives us a default, auto-generated avatar, we do not use it.
Storage: your name and email are stored in our user database (section 4). Your profile picture is displayed from Google's URL; we do not copy the image to our servers.
Sharing: we do not share your Google data with anyone. We do not sell it, use it for advertising, or use it to train any machine-learning model.

CurioFlow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove CurioFlow's access to your Google account at any time at myaccount.google.com/permissions. Doing so does not delete your CurioFlow account; see section 7 for that.

3. Cookies

CurioFlow uses a session cookie to keep you signed in. That is the only cookie the application sets. We do not use advertising cookies, tracking pixels, or third-party analytics on the application.

This website does not use analytics or tracking cookies.

4. Where your information is kept

The founding list, accounts and sign-in are handled by Supabase, an authentication and database provider. Supabase stores the founding-list addresses, your account email address, your sign-in credentials (passwords are hashed; we never see them), and the name and picture Google provides if you sign in with Google. Supabase's own privacy policy is at supabase.com/privacy.
Your cabinet is stored in a database operated by CurioFlow. Before public launch this policy will name the hosting provider and the region where that database runs.
This website is served by Vercel. Vercel's servers receive the technical information described in section 1 for every visit.
Sign-in emails (one-time links, confirmations) are sent through Supabase's email service.
Profile pictures you upload yourself will be stored with Cloudflare R2 once uploads are available.

We use these providers to run the service, not to share your information with them for their own purposes.

5. Where the catalogue comes from

The titles, posters, covers and artwork you see in CurioFlow come from public catalogue services — among them The Movie Database (TMDB), AniList, IGDB, RAWG, Open Library, TheSportsDB, Scryfall, TCGdex and PokéAPI. When you search for or open an item, your browser may request artwork directly from those services, which means they receive the standard technical data described in section 1. None of them receive your account information or your cabinet. CurioFlow is not endorsed or certified by any of them. Attribution for each source appears in the app where its data is shown.

6. What we share, and what we never share

We share your information only:

with the service providers named in section 4, so the service can run;
with the people you choose to share with — if you share an item or a cabinet page, the person who opens your link sees what you chose to show them, and nothing else;
if the law requires it, or to protect the service or its users from abuse.

We do not sell your information. We do not share it with advertisers. We do not use it to train machine-learning models. We do not send marketing email. If we ever want to send you something that isn't about your account, we will ask first.

7. Your choices and your rights

See and change your account information at any time in the app.
Export your cabinet: write to admin@curioflow.app and we will send you your data in a readable format.
Delete your account: write to admin@curioflow.app. We delete your account and your cabinet within 30 days, apart from any copy we are legally required to keep. Deleting your CurioFlow account does not remove CurioFlow from your Google account's permissions; do that at the link in section 2.
Withdraw Google access at any time, as described in section 2.

Wherever you live, you may ask us what information we hold about you, ask us to correct it, or ask us to delete it. Write to admin@curioflow.app.

8. Children

CurioFlow is not directed at children under 13, and we do not knowingly collect information from anyone under 13. If you believe a child under 13 has created an account, write to admin@curioflow.app and we will delete it.

9. Security

We use HTTPS everywhere, store passwords only as hashes, and limit who can reach the database to the operator. No service can promise perfect security; if we ever learn of a breach affecting your information, we will tell you.

10. Changes to this policy

When this policy changes, the date at the top changes with it. If a change affects what we do with your information in a way you would want to know about, we will tell you in the app or by email before it takes effect. The public launch of CurioFlow will be one such change.

11. Contact

Justin Pilon, operating as CurioFlow
Tainan, Taiwan
admin@curioflow.app