Curio privacy policy

Last updated: 7 October 2026

Curio is a personal library for links, articles and videos. This policy covers the Curio app and the Curio service behind it: your account, your library and the suggestions Curio makes. The same account also works in the Curio web app at https://curio-resource-hub.pages.dev.

Curio is made by Hesperia Labs Mobile, the mobile app brand of SDD SL, which is responsible for the information described here. For any question about privacy, or to use any of your rights, write to info@hesperialabs.com.

What Curio keeps in your account

Curio keeps your library in your account, so it is the same on every device where you sign in.

• Your sign-in details. Your email address and password. The password is stored only in hashed form. If you sign in with Google or Apple, the account also receives the email address and basic profile details that provider shares, such as your name.
• Your profile. Your username, and, if you add them, a display name, a bio and a link to an avatar image. Your profile page is public, and your username can't be changed.
• Your library. The links you save, with their titles, descriptions, tags, preview images, read or archived status and save dates. It also holds your collections and the collections you follow.
• Your notes. The notes you write on your links. Notes are private: only you can read them, and they never appear on a shared page, in a feed, or in a copy someone else imports.

A collection is private until you make it public. A public collection has its own web page and RSS feed that anyone with the link can open, and other Curio users can follow it or import a copy of it. Your public profile lists your public collections. When someone opens one of your public pages, Curio counts the visit without storing anything that identifies the visitor. Only the name of the site they came from is kept.

What stays on your phone

The app keeps a copy of your library on your phone, so it opens quickly and can be read without a connection. It also keeps your settings there, such as the theme and the privacy switches, and the people you blocked: blocks stay on the phone, and Curio's server doesn't know about them. This copy is left out of device backups. It is removed when you uninstall the app or clear its storage.

What the app sends, and to whom

• Your account and library go to Supabase, which hosts Curio's database, sign-in and account emails (confirmation and password reset). Every connection is encrypted.
• Suggestions. When you add a link, ask for new details, or import links with suggestions switched on, the link goes to Curio's server, which runs on Google Cloud. The server reads the page and sends its text to an AI model through Ollama's cloud service. The model writes a title, tags and a short description, which come back to the app for you to edit. For YouTube links, the server looks up the video's details with Google's YouTube Data API. Curio's server keeps a count of your requests to apply the limit of 20 a minute. It does not keep the pages or the suggestions.
• Dead-link checks. Curio's server may request your saved links from time to time, reading only whether the page still answers, to flag links whose page is gone.
• Crash reports. If the app closes unexpectedly, it sends a technical report through Firebase Crashlytics, a Google service. The report holds the device model, the system version, the app version, where the error happened and a random installation identifier. It holds no account details, links or notes. Crash reports are on by default. You can switch them off in Me → Privacy → Send crash reports.
• Usage statistics (optional). Only if you switch on Me → Privacy → Share anonymous usage, the app sends events about which features are used through Google Analytics for Firebase. For example: a tab was opened, a link was saved, a search was made, a library was imported. With them, Google Analytics records the device model, the system version and an approximate location, such as the country. The events never include your links, notes, collections or account. They are off until you switch them on.
• Sign-in providers. If you choose Continue with Google or Continue with Apple, that provider handles the sign-in under its own privacy policy.
• Reports. If you report someone's public collection or profile, your mail app sends the report from your own email address to info@hesperialabs.com. It holds the page's link, the reason you chose, your username and anything you add. It is used only to review the report, act on it and reply to you.

When you open a saved link, it opens in your browser or in the app it belongs to, such as YouTube, and that site sees the visit as it would any other.

Curio shows no ads and does not use your advertising ID. Your information is not sold or shared with anyone for their own purposes. The services named above process it only to run Curio, on SDD SL's behalf. Their privacy policies: Supabase, https://supabase.com/privacy; Google, https://policies.google.com/privacy; Ollama, https://ollama.com/privacy.

Legal basis and transfers (EU, EEA and UK)

• Your account, library, notes, suggestions and the dead-link check are needed to provide the service you signed up for (GDPR art. 6(1)(b)).
• Crash reports rely on the legitimate interest in keeping the app working (GDPR art. 6(1)(f)). You can object at any time by switching them off.
• Reports rely on the legitimate interest in keeping Curio free of content that breaks its terms of use (GDPR art. 6(1)(f)).
• Usage statistics rely on your consent (GDPR art. 6(1)(a)). You give it by switching them on and withdraw it by switching them off.
• Supabase, Google and Ollama may process information outside your country, including in the United States. They do so under safeguards such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

Security

Everything the app sends travels encrypted (HTTPS). In the database, access rules let only you read your private collections and notes. On your phone, the copy of your library is protected by the phone's own security and is not included in device backups.

How long information is kept, and deleting it

• Your account and library are kept while your account exists. A link you delete is kept for 30 days, then removed for good. A deleted collection is removed straight away.
• Deleting your account. In the app, Me → Delete account deletes your account, profile, library, notes and collections straight away, and your public pages stop working. Without the app, write to info@hesperialabs.com from the email address of your account, and it is deleted within 30 days. Both ways are described at https://curio-66f0b.web.app/delete-account
• Reports are kept while they are being dealt with, and then for up to a year, in case the same content or account is reported again.
• Crash reports are kept by Firebase Crashlytics for 90 days.
• Usage statistics are kept by Google Analytics for the retention period set for the project, at most 14 months.
• The copy on your phone stays until you uninstall the app or clear its storage.

Your rights

You can ask for access to your information, a copy of it, correction, deletion, restriction, or object to its use, by writing to info@hesperialabs.com. You can also act yourself at any time: in the app, Me → Export as JSON takes a copy of your whole library and notes, and Me → Delete account deletes it all. If you think your information is mishandled, you can complain to your data protection authority.

Children

Curio is not directed at children under 16 and does not knowingly collect their information.

Changes

If this policy changes, the new version will be published at this address with a new date. If a change is significant, the app will mention it too.

Contact

Hesperia Labs Mobile (SDD SL), info@hesperialabs.com