Privacy Policy

Our guiding principle is to collect only what we need. Here's what that means in practice:

Identity and access

When you sign up for Curve, we ask for an email address, a username, and a password, which we store hashed. If you sign in with Apple or Google instead, we store the identifier and email address they share with us. That's so you can sign in, sync across devices, and receive essential account email such as verification and password resets. We'll never sell your personal information to third parties, and we won't use your name in marketing statements without your permission.

Billing information

If you subscribe to Pro or buy a top-up on the web, your payment details are submitted directly to our payment processor, Stripe, and don't hit Curve's servers. We store a reference to your Stripe customer record, your subscription status, and your top-up and charge history for purposes of account history and billing support. Purchases made through the Apple App Store are handled by Apple; we receive only what we need to recognise your subscription status.

Your content

We store the decks, explainers, cards, and images you create, upload, or generate, and the topics and prompts you submit to generate them. This is so you can use Curve as intended. We keep this content as long as your account is active.

Study activity

We record review events: which card you reviewed, when, and how you rated it. This is the core of spaced repetition. It is how Curve schedules your next reviews, and it is never shown to anyone else.

Request logs

We log requests to our servers, including the IP address they come from, for reliability, security, and fraud and abuse prevention. See "Data retention" for how long we keep them.

Cookies

We use a single first-party cookie to keep you signed in on the web. We do not use third-party cookies, advertising cookies, or cross-site tracking, and we do not run third-party analytics trackers in the app or on the web. There are no ads. Because we do not track you across other websites, we treat every visitor the same and do not change our behaviour in response to "Do Not Track" or Global Privacy Control browser signals.

Support correspondence

When you email Curve with a question or to ask for help, we keep that correspondence, including your email address, so that we have a history of past correspondence to reference if you reach out in the future.

Mobile app permissions

The Curve iOS app asks for permission to send push notifications the first time you turn them on; if you accept, we store the device push token needed to send them. The app asks for access to your photo library only when you choose to attach an image to a card or explainer. Both permissions are optional and the app works without them.

Artificial intelligence

When you generate content, the topic, the related prompts, and any content needed to generate it are sent to our AI providers, Anthropic and OpenAI, to produce your explainers and cards. Under their API terms, these providers do not use data sent through the API to train their models, and we do not use your content to train AI models either. They may retain the inputs we send for up to 30 days to monitor for abuse, after which they delete them.

You may bring your own AI provider API key. If you do, we store it encrypted and use it only to run your generation requests on your provider account, under your own agreement with that provider.

You may also connect your own AI agent to Curve through our MCP server. When you do, the agent acts with your account's permissions, using the scopes you granted, and under your own agreement with the agent's provider. You can revoke an agent's access at any time.

Our legal bases (EU and UK)

Where the GDPR or UK GDPR applies, we process your account, content, study activity, and billing information because it is necessary to perform our contract with you. We keep request logs, run security measures, and keep support correspondence under our legitimate interest in running a secure and reliable service. We send push notifications, and run any other optional feature you switch on, with your consent, which you can withdraw at any time in the app's settings.

To provide the service you've requested. We use third-party processors to run Curve. They are: Amazon Web Services (hosting, storage, and logs, in the United States), Stripe (payments), Anthropic and OpenAI (content generation), SendGrid (transactional email), Expo (push notifications), and Apple and Google (sign-in, if you use it). Each receives only what its function requires.

At your direction. If you connect an AI agent to Curve over MCP, that agent, and whoever operates it, receives the data it requests from your account within the scopes you granted.

No Curve human looks at your content except for limited purposes with your express permission, for example, if an error occurs that stops an automated process from working and requires manual intervention to fix. These are rare cases, and when they happen, we look for root cause solutions as much as possible to avoid them recurring. We may also access your data if required in order to respond to legal process (see "When required under applicable law" below).

To help you troubleshoot or squash a software bug, with your permission. If at any point we need to access your content to help you with a support case, we will ask for your consent before proceeding.

To investigate, prevent, or take action regarding restricted uses. Accessing an account when investigating potential abuse is a measure of last resort. We want to protect the privacy and safety of both our users and the people reporting issues to us, and we do our best to balance those responsibilities throughout the process. If we discover you are using Curve for a purpose restricted by our Terms of Service, we will take action as necessary, including notifying appropriate authorities where warranted.

Aggregated and de-identified data. We may aggregate and/or de-identify information collected through the service, and use that aggregated or de-identified data to understand, improve, and report on how Curve is used.

When required under applicable law. Curve is a U.S. company and all of our data infrastructure is located in the U.S. Our policy is to not respond to government requests for user data unless we are compelled by legal process, or in limited circumstances in the event of an emergency request. If U.S. law enforcement authorities have the necessary warrant, criminal subpoena, or court order requiring us to disclose data, we must comply. We will only respond to requests from government authorities outside the U.S. if compelled by the U.S. government through procedures outlined in a mutual legal assistance treaty or agreement. It is our policy to notify affected users before we disclose data unless we are legally prohibited from doing so, and except in some emergency cases.

Finally, if Curve is acquired by or merges with another company, we don't plan on that, but if it happens, we'll notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.

Decks are private unless you share them. When you share a deck by link, anyone with the link can view its explainers and cards. When you make a deck public, it can also appear in Explore, and Curve may list it in the Explore catalog. Public and shared decks do not show your username, and your study activity is never visible to anyone else. You can unshare or unpublish a deck at any time.

We strive to apply the same data rights to all users, regardless of location. Some of these rights include:

• Right to know. You have the right to know what personal information is collected, used, shared, or sold. We outline both the categories and specific bits of data we collect, as well as how they are used, in this privacy policy.
• Right of access. This includes your right to access the personal information we gather about you, and your right to obtain information about the sharing, storage, security, and processing of that information.
• Right to correction. You have the right to request correction of your personal information.
• Right to erasure / "to be forgotten". This is your right to request, subject to certain limitations under applicable law, that your personal information be erased from our possession and, by extension, from all of our service providers. You can exercise it directly by deleting your account in Settings.
• Right to complain. You have the right to make a complaint regarding our handling of your personal information with the appropriate supervisory authority.
• Right to restrict processing. This is your right to request restriction of how and why your personal information is used or processed, including opting out of sale of your personal information. (Again: we never have and never will sell your personal data.)
• Right to object. You have the right, in certain situations, to object to how or why your personal information is processed.
• Right to portability. You have the right to receive the personal information we have about you and the right to transmit it to another party. Contact us and we will provide an export of your data.
• Right to not be subject to automated decision-making. You have the right to object to and prevent any decision that could have a legal or similarly significant effect on you from being made solely based on automated processes. This right is limited if the decision is necessary for performance of any contract between you and us, is allowed by applicable law, or is based on your explicit consent.
• Right to non-discrimination. We do not and will not charge you a different amount to use Curve, offer you different discounts, or give you a lower level of customer service because you have exercised your data privacy rights. However, the exercise of certain rights may, by virtue of your exercising those rights, prevent you from using the service.

Many of these rights can be exercised by signing in and updating your account information. Please note that certain information may be exempt from such requests under applicable law. For example, we need to retain certain information in order to provide our services to you.

In some cases, we also need to take reasonable steps to verify your identity before responding to a request, which may include, at a minimum, verifying your email address. If we are unable to verify you, we may be unable to respond to your requests. If you have questions about exercising these rights or need assistance, please contact us at support@curvememory.com or by mail at Sane Projects, LLC, 10900 Research Blvd, Ste 160C, Unit #2744, Austin, TX 78759, USA. If an authorised agent is corresponding on your behalf, we will need written consent with a signature from the account holder before proceeding.

Depending on applicable law, you may have the right to appeal our decision to deny your request. We will provide information about how to exercise that right in our response denying the request. You also have the right to lodge a complaint with a supervisory authority. If you are in the EU or UK, you can contact your data protection authority to file a complaint or learn more about local privacy laws.

All data is encrypted via TLS when transmitted between our servers and your browser or app. Database backups are encrypted. Any AI provider API key you store with us is encrypted at rest. Payment card details are held by Stripe, not by us.

You can delete your account from Settings on the web or in the iOS app. Deletion is immediate: your account, content, study history, and any stored API keys become inaccessible and are removed from our active systems. Residual copies are purged from our encrypted database backups within 7 days and from operational logs within 30 days. Retrieving content for a single account from a backup isn't possible, so if you change your mind you'll need to create a new account. Content can't be recovered once it has been deleted.

We keep your information for the time necessary for the purposes for which it is processed. The length of time for which we retain information depends on the purposes for which we collected and use it and your choices, after which time we may delete and/or aggregate it. We may also retain and use this information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Server request logs, including IP addresses, are kept for 30 days. Encrypted database backups are kept for 7 days.

Curve is operated from the United States and your data is stored there. When you use Curve you provide your data directly to us in the US. Where we pass data to the processors listed above, we rely on their certification under the EU-US Data Privacy Framework and its UK extension, or on the European Commission's standard contractual clauses in our agreements with them.

Curve is not directed at children under 13, and we do not knowingly collect their data. If you believe a child under 13 has created an account, contact us and we will delete it.

We may update this policy as needed to comply with relevant regulations and reflect any new practices. Whenever we make a significant change to this policy, we will refresh the date at the top of this page and take appropriate steps to notify users.

Have any questions, comments, or concerns about this privacy policy, your data, or your rights with respect to your information? Please get in touch by emailing us at support@curvememory.com and we'll be happy to try to answer them.

Use of Curve is also covered by our Terms of Service.