Privacy Policy

Part A — the curator app and app.curator.so

1. What data we process

• Account: e-mail address or Apple ID identifier (Sign in with Apple), passkey public keys, display name. Accounts created anonymously carry a technical placeholder address until you add a login.
• Media: the photos and videos you actively upload for curation, including their metadata (capture time, camera data, GPS position, file name).
• Reduced copies, not your originals (app version 1.1 and later): the app uploads a smaller copy of each photo (at most 2048 pixels on the long side) and of each video (720p) instead of the camera's original file; the originals stay in your photo library. When you share or export a post, the app takes the original from your library on your phone.
• Curation data: suggestions, your decisions (accept/reject), notes and markings, learned preference rules.
• AI assessments: a machine assessment of each item with a short description and a numeric image vector used to group similar shots.
• Usage: technical events (e.g. "post viewed") for debugging and product improvement — no third-party tracking, no advertising IDs.
• Sign-ins: time, IP address and device identifier ("user agent") of each sign-in and sign-out, to protect your account; IP and device identifier are removed automatically after 90 days.
• Push: device tokens, if you allow notifications.
• Device key: a random identifier the app creates once and keeps on your device; it is sent when an account is created and used to grant the free trial and the welcome gift once per device. It contains no hardware identifiers.
• Diagnostics and feedback: crash reports and problem reports you send from the app (app and iOS version, device model, the report text), and ratings or feedback you submit.
• Credits: a transaction history of every credit movement on your account (grants, purchases, spends, refunds), which you can inspect in the app.

2. Why (purposes and legal bases)

The core of the service is the AI-assisted selection and preparation of your photos into post suggestions (Art. 6 (1) (b) GDPR — performance of contract). Operation, security and abuse prevention rest on our legitimate interest (Art. 6 (1) (f)). We also process your photos, videos and their metadata to help you when you contact support and to improve the app and the quality of our curation (legitimate interest, Art. 6 (1) (f) GDPR). Push notifications are sent only with your consent (Art. 6 (1) (a)), revocable in your system settings.

3. AI processing by processors

For analysis and composition, your media are transmitted in reduced form (downscaled copies, never the originals) to AI providers and processed there exclusively to provide the service — this is the core of what curator does, and it cannot be done without it. Current providers, each of which may carry out any step of the curation (scoring your photos, selecting and arranging posts and stories, writing and checking titles and captions, crops, and the refinements you ask for): Google (Gemini models via the paid Gemini API, USA/EU) and Anthropic (Anthropic Ireland, Limited, with processing by Anthropic, PBC in the USA; Claude models via the Anthropic API). Both receive the same kind of input: reduced versions of your photos (never the originals; for videos a few still frames), their capture times, our short assessment of each picture, the curation preferences, notes and markings you have set, and — for titles, captions and refinements — the place name we derive from your location data (see the next paragraph); never your GPS coordinates. Google acts as our processor under its Gemini API terms and data processing addendum; transfers to the USA rest on the EU standard contractual clauses that form part of those terms. Under the paid API terms, Google does not use inputs to train its models and retains them only briefly for abuse monitoring. Anthropic acts as our processor under its commercial terms and data processing addendum; transfers to the USA rest on the EU standard contractual clauses (with the Swiss addendum) that form part of that addendum. Under these terms Anthropic does not train its models on our data and deletes inputs and outputs within 30 days; content flagged for a possible usage-policy violation may be kept for up to 2 years (and the resulting safety scores for up to 7 years), and longer where the law requires. The files we hold — reduced copies from app version 1.1 on, the original files from earlier versions — remain on our own infrastructure. Should we add or replace a provider, we will name it here before it processes your media.

Two further recipients, each strictly purpose-bound and never receiving media content: the OpenStreetMap Foundation (Nominatim, United Kingdom) receives, for photos with location data, a deliberately imprecise coordinate (rounded to roughly one kilometre) to derive a place name for titles and captions — never your exact position; that place name, not the coordinate, is what the AI providers above receive. Resend (USA) sends, on our behalf, transactional e-mails (account mail, and the legally required confirmations for withdrawal and cancellation declarations) and receives your name, e-mail address and the content of the message for that purpose. Resend also records whether our e-mails were opened and which links were clicked (using a small image in the e-mail), with time, IP address and device type; you can prevent this by not loading images in your mail client.

4. Hosting and storage

Storage and processing take place on self-operated infrastructure in Switzerland. Backups are created regularly and overwritten in rotation. Your media and curation data remain stored until you delete them or give up your account. To save space, we may replace a stored video that is not part of any of your posts with a smaller 1080p version of itself; nothing else about it changes.

What deleting actually does: the image file and every version derived from it are removed from storage, along with location, capture time, file name, the image vector and all AI assessments. The only thing left behind is a contentless marker that a file once existed at that spot — it prevents the same file from being uploaded again on the next sync. Deleting your account removes that marker too. Backups age out on their own.

What we cannot undo: reduced copies already transmitted to the AI providers are subject to their own deletion schedules; we cannot remove them ourselves.

Deleting your account: when you delete your account in Settings, we immediately remove your photos and videos and everything derived from them, together with your e-mail address and sign-in data. Three things remain: app usage events (and your reason for leaving, if you gave one) under a random identifier that no longer names you, deleted after 12 months (legal basis: our legitimate interest in improving the app, Art. 6 (1) (f) GDPR; you can object at hi@curator.so); purchase and legal records for as long as the law requires; and our backups, which age out on their own within at most 3 months. Copies already sent to our AI provider follow its deletion schedule (see section 3).

5. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority (in Switzerland: the FDPIC). In the app you can delete individual media or whole time ranges at any time; a machine-readable export of all your data is available in Settings ("Export data"). For everything else: hi@curator.so.

6. Cookies

Only one technically necessary session cookie is set, for login on app.curator.so. No tracking, no third-party cookies, no advertising. Fonts and all other parts of the web app are served by us — nothing is loaded from third-party servers when you visit.

7. Purchases & billing

Purchases (subscriptions, credits) run exclusively through Apple's in-app purchase. We receive no payment data — no card numbers, no bank details — only signed transaction confirmations from Apple (product, transaction ID, expiry date of a subscription). We store these to maintain your balance and subscription status, to rule out double crediting, and to meet statutory retention duties. Purchase events flow into our product statistics in anonymised form.

Withdrawal and cancellation: if you send us a withdrawal or cancellation declaration, we store your details (name, contract reference, e-mail, optional reason) together with the time of receipt, in order to send the legally required confirmation of receipt and to process the declaration. Legal bases: Art. 6 (1) (b) and (c) GDPR.

Part B — the curator.so website

8. What the website collects, and why

9. Where it lives and how long we keep it

Website analytics data is stored on our own server in Switzerland and kept for at most 24 months. If you signed up for early access before the App Store launch, we keep your e-mail address on our update list and write to you when something big ships, a few times a year at most (legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in informing people who asked to hear from us). Our update e-mails are sent through Resend, which records whether a message was opened (using a small image in the e-mail) and which links were clicked, together with the time, IP address and device type. We use this to see whether our news reaches you (legal basis: Art. 6 (1) (f) GDPR). You can prevent it by not loading images in your mail client. Every such mail has an opt-out: reply "stop" or write to hi@curator.so and you are removed. Nothing is sold, rented, or shared with anyone beyond the services named above.

10. Changes

If this policy changes materially, we update this page and the date above.