Privacy Policy for Curatimo
Last Updated: June 20, 2026
Welcome to Curatimo! This Privacy Policy explains how we collect, use, and protect your personal information when you use our application.
Curatimo is operated from Denmark. Under the General Data Protection Regulation (GDPR), we act as the "Data Controller" for the information you provide.
1. What Information We Collect
When you use Curatimo, we collect the following data:
Authentication Data: Authentication is handled via Clerk, supporting Google Sign-In and email magic link. We receive only the profile data Clerk forwards to us — typically your email address and name — for account creation, login, and service-related communications.
Demographic Data: We collect your gender, birth year, and country.
Usage Data: We store your ratings of TV series (and potentially other media in the future), your watchlists, and the groups you join.
2. How We Use Your Information
We use your data for the following purposes:
To Provide the Service: To manage your account, save your ratings, and calculate collective group rankings based on your trusted networks. (Legal basis: Performance of a Contract).
For Service Communications: We may use your email address to send you service-related messages — such as product updates, important feature announcements, or notifications about your account or groups. We will only send emails where we have a legitimate interest in keeping you informed about the service, or where you have given explicit consent. You can opt out at any time by contacting us. (Legal basis: Legitimate Interest / Explicit Consent).
For Broad Statistical Analysis: We use your demographic data (gender, birth year, country) combined with your ratings and viewing habits to generate highly aggregated, completely anonymized datasets. Once this data is anonymized, it can no longer be linked to you or identify you as an individual. We reserve the right to use, distribute, sell, or leverage these anonymized statistics for any analytical, research, commercial, or other purpose we may determine now or in the future. (Legal basis for the initial processing: Legitimate Interest / Explicit Consent).
3. How Your Data is Shared
Within Your Groups: Curatimo is a social experience. By joining a family, friend, or coworker group, you understand that your ratings and watchlists will be visible to other members of that specific group.
Third-Party Service Providers: We do NOT sell your personal, identifiable data to anyone at any time. We use the following processors, each operating under a data processing agreement:
Replit — cloud hosting provider that runs the application servers and stores the PostgreSQL database on our behalf.
Clerk — authentication provider that handles sign-in and session management on our behalf. See clerk.com/privacy for Clerk's privacy policy.
Resend — transactional email provider used solely to deliver messages you submit via the contact form. Your name and email address transit through Resend's infrastructure only when you actively send a message. See resend.com/legal/privacy-policy for Resend's privacy policy.
4. Cookies & Browser Storage
Curatimo uses a small number of strictly necessary cookies and browser storage items. No consent is required for these because they are essential for the service to function.
__session (cookie): Set by Clerk. Contains your encrypted session token and is used to authenticate requests to the server. Expires when the session ends or is explicitly signed out.
__client_uat (cookie): Set by Clerk. A short-lived timestamp cookie used to detect whether an active Clerk session exists before loading the full session token, reducing unnecessary network requests.
inviteGroup / invitedBy (localStorage): Temporarily stores the group ID and inviter ID from an invite link so the invite can be claimed after you complete sign-up, even if you navigate away during the process. Cleared immediately once the invite is accepted or declined.
install-nudge-ratings (localStorage): Counts how many items you have rated in the current browser. Used to decide when to show the PWA install prompt (shown after a minimum number of ratings). Contains no personal data.
install-nudge-dismissed (localStorage): Records whether you have permanently dismissed the PWA install prompt. Set to “true” when you dismiss the prompt; checked on subsequent visits so the prompt is not shown again. Contains no personal data.
5. International Data Transfers
Curatimo is based in Denmark. The application and database are hosted by Replit, whose infrastructure is located in the United States. Authentication and session data are processed by Clerk, also a US-based processor. By using Curatimo, your data is transferred to the US. We ensure these transfers are lawful under GDPR by relying on Standard Contractual Clauses (SCCs) or equivalent safeguards provided under each processor's data processing agreement. For details, see Replit's privacy documentation at replit.com/site/privacy and Clerk's privacy policy at clerk.com/privacy.
6. Your GDPR Rights
If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:
- Right to Access: You can request a copy of the data we hold about you.
- Right to Rectification: You can ask us to correct inaccurate data.
- Right to Erasure ("Right to be Forgotten"): You can request that we delete your account and all associated personal data.
- Right to Data Portability: You can request to export your rating data.
To exercise any of these rights, please contact us via the contact form.
7. Changes to This Policy
We reserve the right to update or modify this Privacy Policy at any time without prior notice to reflect changes in our practices or the law. However, in accordance with EU regulations, if we make material, significant changes to how we process your personal, identifiable data, we will provide prominent notice within the app or via email prior to the change taking effect. Your continued use of Curatimo after any updates constitutes your acceptance of the revised policy.