Privacy Policy
Curipouch is a pouch for anything you want to keep: links, notes, screenshots, PDFs, newsletters and posts. This policy explains what we keep, why, and who else handles it. We don't sell your data, we don't show ads, and we don't train AI models on what you keep.
What we keep
- Your account: your email address and your time zone. You sign in with a one-time code; there is no password.
- What you drop in: your notes and tags, the links you save and the text we read from them (a page's text, a video's transcript, a post and its thread), the images and PDFs you upload, and email sent to your Curipouch address, kept as the original message and its text.
- Subscriptions: the newsletters, sites and channels you subscribe to.
- AI connections: which AIs you connected and what you let each one read and change.
- Billing: your plan and your Stripe customer and subscription IDs. Card details go to Stripe and never reach us.
- Operational data: counters that protect the service from abuse, and error logs that leave out email addresses, codes and content.
What is public
Nothing. What you keep is seen only by you and the AIs you connect, within what you allowed them.
Who handles data for us
- Cloudflare: hosting, the database, file storage, and receiving and sending email.
- Stripe: payments and subscriptions.
- twitterapi.io: reading a single X post you save, and its thread. It receives the post's address, not who saved it.
- Supadata: YouTube transcripts, for those with the transcripts add-on. It receives the video's address, not who saved it.
We read the links you save ourselves, without your sign-in to any site, so the text we keep is what anyone could see. Pictures in the newsletters you receive are fetched by our server, not your browser, and kept with the email, so senders can't see when you open it.
When you connect an AI such as Claude or ChatGPT, it can read only what you allowed when connecting (everything, or records with the tags you chose), and save or change notes only if you allowed that. What it reads from your pouch is then handled by that AI's provider under its own policy. You can see each connected AI in Settings and disconnect it any time, which ends its access at once.
Cookies
We use one cookie to keep you signed in. There are no advertising or tracking cookies.
How long we keep it
We keep your data while your account exists. Something you delete stays in Recently deleted for 30 days and is then erased, files included. When you delete your account, we delete everything it holds and your Stripe customer, which ends any subscription. Only the name of your Curipouch address stays reserved, linked to nothing, so no one else can ever receive mail meant for you. Stripe keeps billing records as the law requires.
Your choices
You can edit or delete anything at any time, disconnect an AI, export everything as Markdown, and delete your account yourself. You can also ask us what we hold about you or to correct it at hello@curipouch.com.
Changes
If we change this policy in a way that matters, we'll tell you in Curipouch or by email before it takes effect.