Privacy Policy

1. Scope and operator

This notice describes CuriSnap at curisnap.app, including the hosted Studio. Service operator: CuriSnap. For service, privacy and account inquiries, contact support@curisnap.app.

2. Information processed

Google or email sign-in provides a verified account identifier, name where supplied and email address. CuriSnap never receives your Google or email password. When you request analysis, we process your selected photos, category and notes. Generated reports may include information from your notes. When you start a membership checkout, Creem receives the account email and payment details needed to provide checkout and subscription billing; CuriSnap receives customer, product, checkout, order and subscription identifiers and lifecycle status, but does not receive or store the full payment-card number. When you submit feedback, we store the text you submit, your interface language, account identifier, email address and submission time for operator review. We do not automatically attach your photos, reports or conversations to feedback. In-app notifications store event references, creation times and read status linked to your account; they do not copy chat message bodies. Hosting and identity services receive network information such as IP addresses and request headers. Remove personal documents, faces and addresses before submission.

3. When photos leave your device

Selecting a photo does not submit it. After sign-in and your explicit analysis confirmation, the browser prepares JPEG images and sends them to our Cloudflare-hosted service and automatically selected analysis services. If you also enable Numista coin research, up to two photos are sent to Numista when image search is configured and the item is classified as a coin. Completed reports are saved privately to your account. When you confirm photo storage, the JPEG copies prepared for analysis are saved privately with your report; original full-resolution files are not retained. Older reports may have no saved photos and allow you to attach copies without re-running analysis.

4. Service operation and usage records

We use account information to provide access and maintain your saved collection. We keep first-party operational records of sign-ins, report generation, report retrieval, report viewing, export and print requests, report changes, and external service calls to operate the service, diagnose failures and understand report use and returning account activity. These records are linked to an internal account identifier. On successful sign-in, we also store the country or region of the login network supplied by Cloudflare for first-party account statistics. This is not nationality or residence and may reflect a proxy or VPN. We do not store the raw IP in these usage tables; historical country data is not inferred. Client viewing/export events are signals, not proof that a person read a report or saved a file. These first-party operational records are separate from public-page advertising described below; we do not use fingerprinting for these records. Usage tables do not contain uploaded photos, notes, prompts, full request URLs, provider response bodies, IP addresses or browser fingerprints.

5. Services that receive information

CuriSnap automatically routes report photos and notes according to the item category. Report processing may use OpenAI or Claude through fal and OpenRouter, including an initial category classification. Promotional image and video generation uses Volcengine when configured and sends your creative prompt and selected reference images to that provider. Coin research uses Numista when applicable. Google handles Google sign-in, Cloudflare hosts the website, sessions and saved reports, and Creem provides checkout, subscription billing, tax and payment-related services. Before promotional image or video generation, the user-supplied creative prompt is also sent to Creem for content-policy screening. Reference photos are not sent in this prompt-screening request. Requests are blocked when screening denies or flags the prompt, or when screening is unavailable. Providers have their own terms and retention practices. Temporary AI failures may be retried through a configured fallback model or processor. Every report includes online reference research using the proposed candidate name and category through fal and OpenRouter search services; uploaded photo files and the notes field are not sent in this additional step. The proposed name can contain information derived from your submission. Linked excerpts are checked against accessible source pages, not treated as authentication. OpenAI requests use store:false; this does not promise zero upstream retention.

6. Sessions, saved reports and retention

We use the essential __Host-curisnap cookie with Secure, HttpOnly and SameSite=Lax settings for a session lasting up to 7 days. Signing out invalidates that session but does not delete your account profile, subscription record or reports. Account profiles, subscription status and Creem customer, product and subscription references are stored in Cloudflare Durable Objects; reports and consented analysis photo copies remain privately in Durable Objects until you delete them. D1 stores a report index and operational statistics separately. Deleting a report removes its saved content and photos, while a minimal deletion/index record and operational records may remain for the retention periods below. Detailed events and external-call metadata are kept for up to 90 days, and daily account-activity records and generation summaries for up to 400 days, with daily cleanup. Account profiles, subscription references and current report indexes remain while needed to provide the account, meet legal obligations or resolve payment issues. Request account-data deletion or access through support@curisnap.app. Billing records retained by Creem are subject to its legal and operational obligations. Downloaded exports and provider retention are separate.

7. Sharing and international processing

Data may be processed outside your country by the hosting, identity and AI services used for your request. This notice does not represent that a particular international-transfer safeguard is in place. Information may also need to be disclosed where required by applicable law or to address a genuine security incident. CuriSnap has not implemented advertising data sales or ad-targeting features in this preview.

8. Your choices and rights

You can browse guides without signing in, prepare or remove photos before submission, decline analysis, export a report, delete saved reports and sign out. To request account-data access, correction or deletion, contact support@curisnap.app using your account email. Do not send passwords, keys or identity documents. Applicable rights may include access, deletion, correction, portability, objection, restriction and complaints to your data protection authority. Requests already sent to providers cannot necessarily be recalled.

9. Security and age requirements

We use server-verified Google credentials, secure session cookies, same-origin and CSRF checks, account-scoped report access and server-side provider keys. No system can guarantee complete security. The service is intended for adults; do not upload children’s personal information or sensitive documents. Material changes to processing will be described in an updated notice.

10. Contact

CuriSnap · Service and privacy contact: support@curisnap.app.

Verified sign-in methods

Email sign-in uses a one-time code. Google and email sign-ins for the same verified mailbox can be linked so existing reports remain available together. A Google account using a third-party email address may require a fresh email code before linking. Existing photo and report storage is preserved; existing conversations from both accounts remain separate, with additional history available in a collapsed section. Starting a new conversation clears the linked histories for that expert. Linking also combines the daily analysis allowance; it does not create additional credits.

Public-site analytics

Public content pages use Ahrefs Web Analytics to measure website traffic. Ahrefs describes this service as cookie-free. Loading the third-party script involves a connection to Ahrefs and processing of visit and network information. We do not install it on administrator, login, Studio, private report or chat pages, and do not deliberately send account identities, chat text, photos or report contents to this integration. See Ahrefs Web Analytics and Ahrefs Privacy Policy.

CuriSnap also records a limited first-party public-page event using a random identifier kept only for the browser session. It contains the page path, broad traffic-source category, country code supplied by our hosting provider and event time. Public-page events do not store an account identity, raw IP address, full referring URL, search query, photos, chat text or report content, and are deleted after 90 days.

Google Analytics for Firebase collection remains disabled. The former analytics notice and footer control have been removed. Public-page visits remove the former local consent preference and accessible Google Analytics cookies. Previously collected data is not automatically deleted by this change. First-party account operational records described above and Google AdSense advertising remain separate.

AI expert conversations

After you confirm sending, expert chat processes your message, selected attachments and linked report using models such as Claude and Google Gemini through fal and OpenRouter. Intent classification receives limited recent conversation text, not attachment files. When your question requires online research, limited recent conversation text and the linked item title are supplied to the research model; object-related searches use third-party search services including Exa. Chat attachments are not included in that search step. You can request no online search in your message. Search availability and source verification are not guaranteed.

Each expert has a separate account-scoped conversation. Up to 20 recent messages are retained, further limited by size; older turns may be removed. Saved messages include attachment names and sizes, references and response metadata, but chat attachment originals are used transiently for the current response and are not saved by CuriSnap. Provider retention is separate. Clear a conversation using the new-conversation control. Browser speech recognition is optional, requires permission and may process audio using your browser vendor or its service; CuriSnap receives the recognized text. This is not a two-way voice call.

Advertising on public pages

CuriSnap integrates Google AdSense on public content pages using publisher ca-pub-4560723864445829. AdSense may load third-party resources and process network information, browser/device information, page URLs and advertising identifiers or cookies to deliver, measure and protect advertisements, subject to applicable consent and Google settings. We do not install this advertising code on Studio, login, private reports or expert conversations, and do not deliberately send their contents or account identities to AdSense. Privacy and terms pages do not load the advertising code.

Firebase analytics is disabled; advertising is a separate integration. Where an advertising privacy message is provided, use its consent and privacy controls to manage advertising choices. Ad availability and personalization depend on Google approval, publisher settings and applicable consent requirements. See Google advertising information and Google Privacy Policy. Contact support@curisnap.app with questions.