Privacy Policy

Curae is operated by Curae Collective, ABN 41 749 032 735, based in Sydney, Australia ("Curae", "we", "us", "our"). We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). If you are in the UK, the European Economic Area or the United States, the additional rights in section 14 apply to you as well.

01A quick summary

• Curae is built for adults 18 and over. Parents and guardians can create profiles for children inside their own account.
• We collect only what we need to give you styling and gift suggestions, run your subscription, and keep the app working.
• Your stored data is kept in Sydney, Australia, and encrypted at rest and in transit. During early access, our app servers run in the United States.
• We use a small number of trusted providers and send them the minimum they need. We never send your photos to our AI provider.
• Push notifications are off unless you turn them on.
• You can view, correct, export or delete your data from inside the app, or by emailing us.
• We do not sell your personal information, and we do not show third-party ads inside the app.

02Information we collect

Account information

Your email address and a securely hashed password. We never store your password in plain text.

Profile information

For each person you set up a profile for, you may provide a name, gender, age or age band, colour season, body shape, clothing sizes and country, body measurements, favourite brands, and gift interests or dislikes. You choose what to enter. Most fields are optional.

Photos

If you add a photo to a profile or wardrobe item, or use try-on, that image is stored in your Curae account so we can display it back to you. Photos are used only to power your styling experience. We do not share your photos with our AI provider or with advertisers.

Wardrobe, looks, gifts and lists

Items you add, looks and gift ideas you save, and wishlist or shopping list entries.

Chat history

Messages you send to the in-app stylist and its replies, so you can leave and resume a conversation. You can clear this anytime in Settings.

Subscription and payment information

If you become a member or buy a look pack in the iPhone app, Apple processes your payment through the App Store. Our subscription provider, RevenueCat, tells us your plan, status and renewal date. We never see or store your card details.

Calendar information (only if you turn it on)

If you enable Calendar Sync, Curae reads upcoming event titles and dates from your device to suggest outfits. Calendar data stays on your device unless you explicitly ask Curae to generate a look from a specific event. You can revoke access anytime in your device settings.

Push notification token (only if you turn it on)

If you allow notifications, your device gives us a push token so we can send them to you. We store it with your account and delete it if you turn notifications off or delete your account.

Usage analytics and crash reports

We collect information about how the app is used, such as screens viewed, features used, device type, app version and approximate region, and diagnostic reports when the app crashes. We use this to improve Curae and fix problems. These reports do not include your photos, chat messages, or the details in your profiles.

Security logs

Logs of security-relevant events, such as sign-ins and account deletions, to keep the service safe. We keep photos and message contents out of these logs.

Early-access list

If you join our early-access list on curaecollective.app, we collect your email address so we can tell you when Curae opens.

03How we use your information

We use your information to create and run your account, generate styling and gift suggestions matched to a profile, show you real products and shopping links, track your free generations and run your membership, send you account emails and the notifications you have turned on, provide support, understand and improve how the app is used, fix crashes, keep the service secure and prevent abuse, and meet our legal obligations.

We rely on your consent, the performance of our agreement with you, and our legitimate interest in running a safe and functional service. Where the law requires consent, we ask for it. We do not use your personal information to train third-party AI models, and we do not sell it.

04Children's data

Curae is designed for adults. A parent or guardian may create profiles for children under 18 within their own adult account.

• We do not knowingly allow anyone under 18 to create their own Curae account.
• Children do not log in, receive messages or notifications, or interact with the app directly. A child profile is a set of preferences an adult manages.
• Adult-only features, including virtual try-on, are restricted so they cannot be used on a child profile.
• We treat children's profile details and photos as our most sensitive category of information. They are never sent to our analytics or crash reporting providers.
• Children's profile details and photos are stored with the rest of your account data, in Sydney, Australia.
• As the account holder, you are responsible for the information you enter about a child and for having the right to provide it.

If you believe a child has provided us information directly, or you want a child's profile removed, email support@curaecollective.app and we will delete it promptly.

05How AI is used

Styling, gift and declutter suggestions are generated using Claude, an AI service from Anthropic. Product information is fetched from Google Shopping through SerpAPI. When we generate a suggestion we send only the minimum profile summary needed, for example an age band, colour season, body shape, size and country. We do not send your photos, your email, or your full profile to the AI provider.

Curae's AI makes suggestions only. It does not make decisions about you that affect your rights or interests, such as approving or refusing anything.

06Who we share information with

We do not sell your personal information. We share it only with service providers who help us run Curae, and only to the extent they need it.

Overseas disclosure. Your stored Curae data is held in Australia. During early access, our app servers are run by our hosting provider in the United States, which may also process data in India, so your data passes through those servers when you use the app. Our other providers process limited data overseas, mainly in the United States. We take reasonable steps to make sure these providers handle your information consistently with the APPs.

We may also disclose information if the law requires it, or as part of a business transfer, in which case we will tell you.

07Emails and notifications

We send account emails, such as sign-up confirmation and password resets, because they are needed to run your account. If you joined the early-access list, we will email you about Curae's launch, and every email includes a way to unsubscribe.

Push notifications are off by default. If you turn them on, you can turn them off at any time in the app or in your device settings.

08Data retention

We keep your information while your account is active. Deleting a profile permanently removes that profile's wardrobe, saved looks, gifts and lists. Deleting your account permanently removes your account and all associated data from our live systems.

Backups. Our database keeps encrypted automated backups in Australia, so deleted data is removed from them within 30 days. Before 7 November 2026, our database was managed by our hosting provider in the United States, and copies of data deleted before then may remain in that provider's backups for up to 12 months before they are automatically removed. Backups are only used to restore the service after a failure. If we ever restore from a backup, we will re-delete any data you had already asked us to delete.

Early-access list. We keep your email on the list until Curae launches and we have invited you, or until you unsubscribe, whichever comes first.

We may keep a minimal record where the law requires it, and we keep security logs, analytics and crash reports for a limited period.

09How we protect your information

• In transit: all connections use TLS (HTTPS).
• At rest: all stored data, including our database, file storage and backups, is encrypted with AES-256, with automatic key rotation.
• Secrets: service keys and credentials are encrypted and stored separately from our code.
• Access: each account can only reach its own data, passwords are hashed, and administrative access is restricted.
• Monitoring: we log security-relevant events and review them.

Our database provider holds ISO 27001 certification and SOC 2 Type II reports, and our hosting provider holds ISO certification and has completed a SOC 2 Type I audit. No system is perfectly secure, but we work to protect your information and respond quickly if something goes wrong.

10Your rights and choices

At any time you can access what we hold, correct anything wrong (mostly in the app), export a copy of your data from Settings, delete individual profiles, your chat history or your whole account, withdraw consent for optional features such as Calendar Sync and push notifications, and opt out of non-essential emails. Most of these are self-service in the app. If you would rather we handle it, email us and we will action your request, usually within 5 business days. Deleted data may remain in backups for the period described in section 08.

11Cookies and the Curae website

Our website uses only the cookies needed to make the site work and, where enabled, privacy-respecting analytics. We do not use advertising trackers. Where the law requires it, we ask for consent before setting non-essential cookies, and you can decline.

12Data breach notification

If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. Where GDPR applies we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay. We treat any incident involving children's data with the highest priority.

13Changes to this policy

We may update this policy from time to time. If we make a material change we will tell you inside the app before it takes effect, and update the date below. We plan to move our app servers to Australia. We will update this policy and tell you in the app before this happens.

14International users

UK and EEA (GDPR). You have the rights above plus the right to object to or restrict certain processing, and to lodge a complaint with your local data protection authority. Our legal bases are consent, contract, and legitimate interests. Your stored data is held in Australia, but during early access our app servers are run by a hosting provider in the United States that may also process data in India and is not yet GDPR compliant. We therefore ask for your explicit consent to this transfer before you create an account. You can withdraw it by deleting your account.

United States. For children under 13 we comply with COPPA. A parent controls all information about a child profile and can review or delete it at any time.

15Contact and complaints

For any privacy question, data request or complaint: Email support@curaecollective.app. If you are in Australia and not satisfied with our response, you can contact the OAIC at oaic.gov.au. In the UK or EEA, contact your local data protection authority.

Effective date: 23 October 2026  ·  Last updated: 7 November 2026