PRIVACY

Privacy policy

This policy explains what CurveMora processes and how it is used.

Effective July 13, 2026

1. Information we process

We process account identifiers, display name, email and avatar when supplied by Google, passkey public-key credentials and usage counters, preferences, Sources, Learning Items, Reviews, notes, Breaks, exports, and limited technical usage information.

2. Passkeys

Passkeys use WebAuthn. CurveMora stores a credential identifier, public key, counter, device type, backup status, name, and timestamps. We do not receive or store fingerprints, face data, device PINs, or private keys.

3. How information is used

Information is used to authenticate you, keep each account's data separate, calculate deterministic Review schedules, synchronize data, provide exports, prevent abuse, diagnose failures, and improve the service.

4. AI-assisted capture

Raw capture text is sent to OpenAI only when you request an AI draft. It is not stored in CurveMora's AI run table. The resulting structured draft is shown for confirmation before any Source or Learning Item is saved.

5. Service providers

CurveMora uses Neon for PostgreSQL data storage, Vercel for hosting, Google for optional sign-in, and OpenAI for optional AI-assisted capture. Each provider processes data under its own terms and privacy commitments.

6. Sharing

Learning content is private to the authenticated account by default. CurveMora does not sell learning content or send Source titles, notes, or raw capture text in product analytics events.

7. Retention and deletion

Data remains until you delete it or the account. Account deletion removes account credentials, Sources, Learning Items, Reviews, Breaks, preferences, and stored AI run records from the active database, subject to limited infrastructure backup retention.

8. Security and choices

We use HttpOnly session cookies, user-scoped database access, input validation, encrypted session payloads, and short-lived WebAuthn challenges. You can export data, manage passkeys, disconnect by signing out, or delete the account from Account settings.

9. Changes

Material changes will be reflected by updating this page and the effective date. Region-specific legal rights may apply in addition to this policy.