Privacy Policy

1. Introduction

This Privacy Policy (the "Policy") describes how Curio Design ("Curio", "we", "our", or "us") collects, uses, and discloses information about you in connection with your access to and use of the website at designbycurio.com and related applications, APIs, and tools (collectively, the "Service"). It supplements and forms part of our Terms of Service.

2. Information we collect

We collect the following categories of information in the course of operating the Service:

Category	Examples	Source
Account information	Email address, display name, the sign-in methods you have used (email code, Google, GitHub) and their provider identifiers, profile image, sign-up date. When you sign in with Google or GitHub, a copy of your profile image is stored on our servers.	Provided by you or by your selected sign-in provider
Credit and unlock records	Credit purchases, gifts, refunds and adjustments, Credits spent, the Design Packages you have unlocked, and the resulting balance	Curio
Payment records	Payment identifier, Credit Pack, amount and currency, payment method type (card, WeChat Pay, AlipayHK), billing country, and payment status. Card numbers, security codes and wallet credentials are handled by Dodo Payments; Curio does not receive or store them.	Dodo Payments
Usage events	Downloads, share-link generations, and retrievals through the MCP server (including the name of the AI client), each with a timestamp	Our servers, when you perform these actions
Connected apps	The AI clients you have authorized over MCP and when you authorized them	Provided by you
Sign-in and security data	One-time sign-in codes (stored only as hashes and valid for a few minutes), session records, and rate-limit counters. When you request a sign-in code, Cloudflare Turnstile processes your IP address and browser signals to check that the request is not automated.	Curio and Cloudflare
Technical and access information	IP address, browser type and version, operating system, referrer URL, language preference	Automatically collected via Cloudflare

3. How we use information

We use the information described above for the following purposes:

to provide, maintain, and operate the Service, including authenticating you, keeping your Credit balance and unlocks, and delivering the Design Packages you have unlocked;
to process payments and issue receipts;
to detect, prevent, and respond to fraud, abuse, scraping, or violations of our Terms of Service;
to communicate with you about your Account, billing, service announcements, and material policy updates;
to analyze aggregate usage patterns in order to improve the Service and decide which Design Packages to produce next; and
to comply with applicable legal obligations.

We do not use your personal information for behavioral advertising, and we do not sell your personal information to third parties.

4. Legal bases for processing

Where the EU or UK General Data Protection Regulation applies, our legal bases for processing your personal data are:

Performance of a contract — to provide the Service you have requested and to fulfill our obligations under the Terms of Service.
Legitimate interests — to operate, secure, and improve the Service, prevent abuse, and pursue commercially reasonable analytics.
Compliance with legal obligations — where retention or disclosure is required by law.
Your consent — where we ask for it specifically, for example for optional communications.

5. Cookies & local storage

We use a small number of strictly necessary cookies and browser local-storage entries to operate the Service — including our own sign-in cookie; sign-in tokens are never stored in your browser's local storage — a first-party attribution note kept in your browser's local storage (the referrer and campaign parameters of your first visit), plus a single first-party analytics cookie set by Google Analytics 4 to measure aggregate site usage. We do not place third-party advertising cookies, and we do not track you across other websites.

Name	Type	Purpose	Lifetime
`__Host-curio_sid`	HTTP cookie (HttpOnly)	Keeps you signed in. It holds a random token; we store only a hash of it. Scripts on the page cannot read it.	30 days, extended each time you use the Service
`curio_li`	HTTP cookie	Tells the page that this browser has signed in, so it can show the right header straight away. It is not a credential.	Same as the sign-in cookie
`curio-lang`, `curio.lang`	HTTP cookie / localStorage	Remembers the interface language you picked (en / zh).	2 years (cookie); until cleared (localStorage)
`curio.auth.*`	localStorage	Remembers where to take you after you sign in, and keeps your sign-in state in step across open tabs. Contains no sign-in token.	Until you sign out or clear it
`__cf_*`	HTTP cookie	Set by Cloudflare for abuse mitigation and DDoS protection.	Up to 30 days
`_ga`, `_ga_*`	HTTP cookie (first-party)	Google Analytics 4 — distinguishes unique browsers + sessions for aggregate usage analytics (page views, referrers, geographic region at country level). No individual user is identified.	Up to 2 years
`curio.acq*`	localStorage (first-party)	First-visit attribution — remembers the referring page, landing page, and campaign (UTM) parameters of your first visit, so that if you later create an account we can tell which channel introduced you. Kept only in your browser; written once into your account profile when you sign up.	90 days, or cleared when written to your profile at sign-up

All entries other than the Google Analytics cookie and the first-visit attribution note are strictly necessary under the EU ePrivacy Directive and therefore do not require a consent banner. The Google Analytics cookie is the only analytics cookie we set; to opt out, install Google's Analytics Opt-out Browser Add-on or block the third-party request to googletagmanager.com at the browser / extension level. You may also clear cookies and local storage through your browser settings at any time; doing so will sign you out of the Service.

6. Service providers

We engage a limited number of third-party service providers (sometimes called "subprocessors") to operate the Service. Each provider receives only the data needed for the function described below, and is contractually required to protect that data.

Provider	Function	Data shared
Cloudflare	Website hosting and content delivery; database (accounts, sign-in methods, Credit records, unlocks, usage records, sessions); file storage (paid design files and profile images); Turnstile bot checks when a sign-in code is requested; DNS and abuse mitigation	Account, Credit, unlock and usage records; profile images; request metadata (IP address, user agent) and browser signals for Turnstile
Resend	Sending sign-in code emails and service notices	Email address and the content of the email
Dodo Payments	Reseller and merchant of record for Credit Packs: processes card, WeChat Pay and AlipayHK payments, and issues receipts and handles tax	Email address, Credit Pack and amount, and the payment and billing details you enter at checkout
GitHub and Google	Sign-in (only if you choose to sign in with these providers)	We receive your verified email address, provider identifier, display name and profile image
Google Analytics	Aggregate site usage measurement (page views, sessions, referrers, country-level geography)	Pseudonymous cookie identifier, IP address (truncated by Google), page URL, user agent
Ahrefs Web Analytics	Cookie-free aggregate website analytics	Page URLs, referrers, and aggregate traffic statistics; no cookies or persistent identifiers

Each provider processes your data in accordance with its own privacy policy, which applies in addition to this Policy.

7. Disclosure of information

We disclose your personal information only in the following circumstances:

to the service providers listed in Section 6, for the purposes described;
where required to comply with valid legal process, applicable law, or a binding governmental request;
to protect the rights, property, or safety of Curio, our users, or the public;
in connection with a merger, acquisition, financing, or sale of assets, provided that the recipient is bound by terms no less protective than this Policy; and
with your consent or at your direction.

8. Data retention

We retain personal information only for as long as necessary for the purposes for which it was collected, or as required by law:

Account, Credit, unlock and usage records, connected apps, and profile image — for as long as your Account exists; deleted when you delete your Account.
Sign-in codes and sessions — sign-in codes expire within minutes and sessions after 30 days without use; expired entries are cleared automatically every hour.
Payment records — retained for at least seven (7) years, or longer if required by applicable tax, accounting, or audit laws. If you delete your Account, these records are kept but are no longer linked to you.

9. Your rights

Subject to applicable law (including the EU/UK GDPR, the California Consumer Privacy Act and California Privacy Rights Act, and the mainland China Personal Information Protection Law), you may have the right to:

access the personal information we hold about you;
request correction of inaccurate or incomplete information;
request deletion of your personal information, subject to any retention required by law;
object to, or restrict, certain processing of your personal information;
receive a portable copy of your personal information in a structured, machine-readable format;
withdraw consent, where processing is based on consent; and
lodge a complaint with a competent data protection authority.

You can delete your Account yourself from Account settings; this deletes your Account, Credit balance, unlocks, usage records, sessions and profile image, and revokes every connection you have authorized over MCP (while your Credit balance is negative, deletion is unavailable until it is settled). To exercise any other right, send a request from the email address registered to your Account to [email protected]. We will respond within thirty (30) days, and may extend this period by up to a further two (2) months where necessary for complex requests, in which case we will notify you of the extension and its reason within the initial 30 days. We may request additional information to verify your identity before proceeding.

California residents: Curio has not sold personal information in the preceding twelve (12) months and does not currently share personal information for cross-context behavioral advertising. You have the additional right under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA") to opt out of any future sale or sharing — should our practices change, an opt-out link will be added to this Policy and made available via the request channel above.

10. International transfers & EU representative

Our service providers operate globally. Your personal information may be processed in jurisdictions other than the one in which you reside, including the United States. Where required by law (for example, the Standard Contractual Clauses under the GDPR), we put appropriate safeguards in place to protect cross-border transfers of personal data.

If you are located in the European Economic Area, United Kingdom, or Switzerland and wish to raise a data-protection matter, you may contact us at [email protected]. Where required under GDPR Article 27, we will designate a representative in the Union and publish their contact details in this Section once Service availability to EEA users commences.

11. Children's privacy

The Service is not directed at children under the age of thirteen (13), and we do not knowingly collect personal information from children under that age. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will delete such information promptly. If you believe that a child has provided personal information through the Service, please contact us at [email protected].

12. Security

We apply technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include transport-layer encryption (HTTPS) for all traffic, encryption at rest through our hosting provider's standard mechanisms, and access controls based on the principle of least privilege. No method of transmission or storage is entirely secure; in the event of a personal-data breach affecting you, we will notify you without undue delay where required by law.

13. Changes to this Policy

We may update this Policy from time to time. For material changes, we will update the "Last updated" date at the top of this document and notify active users by email at least seven (7) days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

14. Contact

For questions about this Policy, data-subject requests, or any other privacy-related matter, contact us at [email protected]. See also our Terms of Service.