Privacy policy

This policy covers curiomancer.com and the Curiomancer apps for iOS and Android. Curiomancer is a brand of Playsthetic LLC, a company registered in the United States. Playsthetic LLC ("we", "us") runs it and is the controller of your personal data. For anything in this policy, email [email protected]. You can also reach us by post at 2108 N St #6842, Sacramento, CA 95816, United States, or by phone at +1 (510) 337-4660.

What we collect

• Account. Your name, email address, password (stored only as a salted hash), profile photo if you add one, the invitation you used, and when you accepted the Terms and this policy, and which version.
• Ratings. The places you like, dislike, have been to, or want to go to, including ones you import or add to the map.
• Messages. What you send other members, with reactions and edits.
• Settings. Your Incognito choice, share link, blocks, and API tokens.
• Location. Only if you allow it, rounded to about 1 km. See Location below.
• Invitations and reports. The email address of anyone you invite. When you report someone, the reason, any details you add, a copy of the reported message, and the link of a reported shared map.
• Waitlist and messages to us. Your email address and city if you join the waitlist, and whatever you send us.
• Devices. The IP address and browser a web session was created from, and when you were last active. When you sign in, the apps send an install identifier and your device model so each phone keeps one sign-in. It is not an advertising identifier, and the apps contain no analytics or tracking code.
• Activity. The recommendations we showed you, the places you skipped while rating, and the analytics and error reports described below.
• From others. Members who message, report, or invite you. Stripe, which tells us whether your World subscription is active, its price and renewal date, and your Stripe customer id. Apple Maps, for the venue behind each rating.

Location

Location is optional and keeps recommendations close to you. The apps round your position to about 1 km before it leaves your phone, and our server rounds every position the same way before storing it. From it we derive your city, country, and timezone. Other members see your city and country and a distance in whole kilometres, never your coordinates. We also keep your hometown, rounded the same way and first taken from where you signed up. We offer places to rate around it, and its country tells us when you're travelling.

On the website, Detect sends the rounded position to Apple Maps to name your city. In the apps, it uses your phone's geocoder, which is Apple on iOS and usually Google on Android. You can update your location in Settings, or turn off location access in your browser or device settings.

How we use it, and on what basis

• Running Curiomancer. Your account, ratings, recommendations, twin matching, messaging, share links, API access, and the emails you need, such as verification, password resets, and World confirmations. The basis is our contract with you, the Terms. Location is your choice, and you can withdraw it at any time.
• Billing World. The basis is our contract with you, and legal obligation for the records the law requires us to keep.
• Invitations. Emailing the people you invite. The basis is your and our legitimate interest in letting you invite a friend.
• Safety. Handling reports, blocking, rate limits, preventing abuse, enforcing the Terms, and keeping reports for repeat abuse and legal claims. The basis is our legitimate interest in a safe service, and legal obligation where the law requires us to act.
• Improving the product. Analytics and error reports. The basis is our legitimate interest in understanding how Curiomancer is used and fixing what breaks. You can object at any time.
• The waitlist. Inviting you when there's room. The basis is your consent, which you can withdraw by asking us to remove you.
• The law. Answering lawful requests. The basis is legal obligation.

We don't use your data for advertising. Matching and recommendations are automated, but they don't make decisions with legal or similarly significant effects on you.

What other members see

• Your twins. Apart from us, only your taste-twins can see your profile. They see your name, photo, city and country, approximate distance, match score, how many places you like, and the places you both rated the same way, but not the rest of your ratings.
• Recommendations. A recommendation never reveals whose ratings produced it.
• Incognito. You don't appear as anyone's twin, no one can view your profile or message you, and your share link stops working. Your ratings still feed recommendations, without revealing you.
• Your share link. Anyone with it can see a map of the places you like, with your name, without signing in. Search engines are asked not to index it. Reset it in Settings and the old link stops working.
• Blocking. You and the person you block disappear from each other.

Messages

Messages are not end-to-end encrypted, so we can technically read them. We only look at a message to handle a report, to comply with the law, or when you ask us for help with it. Editing a message replaces its text, and deleting it erases the text. Either person can delete a conversation, which removes it for both. A report keeps its own copy of the reported message.

Analytics and error reports

We use PostHog, on its US servers, for product analytics. On the website it sets no cookie and stores nothing on your device, and autocapture, session recording, heatmaps, and surveys are off. Your browser sends page views, with query strings and ids removed, and the only other event it sends is skipping a place while rating. If your browser sends Do Not Track, it sends no analytics at all.

Our server also records key actions, such as signing up, rating a place (its category, never which place), or deleting your account, whatever your browser settings and in the apps too. Events carry your account id when you're signed in, never your name or email address. Analytics from your browser pass through our own domain, which forwards your IP address to PostHog, but never your cookies.

We use Sentry to find and fix errors. A report carries the error, where it happened, and the page address without its query string. Cookies and authorization headers are removed, and Sentry is set not to attach your IP address.

Cookies and storage

We use cookies only to keep you signed in. Cloudflare, which sits in front of the site, may set one to filter out malicious traffic. Your browser's local storage keeps your theme, places you like before signing up, and whether you dismissed the import prompt. There are no analytics or advertising cookies.

Who we share it with

We don't sell your personal information or share it for advertising. These providers help us run Curiomancer, and each gets only what it needs.

• Hetzner Online GmbH hosts our servers and database, in the United States.
• Cloudflare sits in front of the website, sends our emails, and stores profile photos.
• Stripe, through its Link service, sells World as merchant of record and handles payment, tax, and receipts under its own privacy policy. It gets your email address and account id. We never see your card number.
• PostHog and Sentry receive the analytics and error reports above.
• Apple provides the map and place data. Your browser loads the map from Apple, so Apple sees your IP address, the area you view, and what you search. Our server sends Apple the place names you import or add, cities you type, and rounded coordinates.
• OpenStreetMap's Nominatim service receives rounded coordinates from our server, to name a city.
• Venue websites. Place photos load straight from the venue's website, which sees your IP address as with any image.

We also disclose data when the law requires it, to protect someone's safety, or to establish or defend legal claims. If Curiomancer is sold, merged, or moved into a company formed to run it, your data passes to the new owner, who must honour this policy.

International transfers

Curiomancer is run from the United States, where our servers are, so data from the EU, the UK, or Switzerland is transferred there. We rely on the EU-US Data Privacy Framework and its UK and Swiss extensions where a provider is certified, and otherwise on the European Commission's Standard Contractual Clauses, with the UK addendum where it applies. Ask us for a copy.

How long we keep it

• Your account. Your details, ratings, location, settings, and share link stay until you delete them or your account. Sessions end when you sign out or they expire.
• Messages. Until the sender deletes them, either person deletes the conversation, or either account is deleted.
• Reports. Kept after the accounts involved are deleted, unlinked from them, for as long as we need them to deal with repeat abuse and legal claims.
• Invitations. Kept with the invited email address, and unlinked from you if you delete your account. Cancelling an unused invitation in Settings deletes it.
• Waitlist. Until you ask us to remove you.
• Messages to us. For as long as we need to answer and follow up.
• Analytics and error reports. For PostHog's and Sentry's retention periods. Deleting your account leaves events already sent with an id that no longer points to anyone.
• Billing. Stripe keeps its records as tax law requires.
• Copies. A database copy taken before maintenance can hold deleted data until the copy is deleted.

Security

Passwords and API tokens are stored only as hashes, everything travels over HTTPS, and sign-in and other sensitive actions are rate-limited. Only we can access the servers and database. To work on matching, we sometimes copy names, ratings, blocks, and rounded locations to our development computer, with email addresses replaced and never messages, passwords, or sessions. If a breach affects your data, we'll tell you and the authorities as the law requires.

Your rights

In Settings you can change your details and location, turn on Incognito, reset your share link, unblock people, revoke API tokens and app sign-ins, export or reset your ratings, and delete your account.

You can also ask for a copy of your data, ask us to correct or delete it, receive it in a portable format, restrict or object to how we use it, and withdraw consent at any time. Email us from your account's address so we know it's you. We answer within 30 days. In the EU, the UK, or Switzerland, you can also complain to your data protection authority.

California residents

Under the California Consumer Privacy Act, in the past 12 months we collected identifiers (name, email address, account id, IP address, app install identifier), customer records, commercial information (World), internet activity (analytics and sessions), approximate geolocation, photos, inferences (your taste profile and twin matches), and sensitive personal information (your login and the content of your messages). Their sources, purposes, recipients, and retention are set out above. We don't sell or share personal information, haven't in the past 12 months, and use sensitive personal information only to provide the service.

You can ask to know, delete, or correct your personal information, or have an authorised agent ask for you, by emailing us, and we won't treat you differently for it. We don't share personal information with third parties for their own direct marketing.

Children

Curiomancer is only for people 18 and older. If we learn we have data from anyone younger, we delete it.

Changes to this policy

When we change this policy we update the date at the top, and we'll tell you by email or in the app before a material change takes effect.