Privacy Policy

Curio Bite is a content discovery app developed and operated by Algoritmo Lab. We build products that help people engage more deeply with the world around them — starting with Curio Bite, launching first in Singapore.

This policy explains what personal data we collect, why we collect it, and how we handle it. If you have questions, reach us at privacy@curiobite.com.

Curio Bite is built for users aged 13 to 18. We take the privacy of young people seriously. We do not collect more data than we need, we do not use it for advertising, and we do not sell it to anyone.

Where local law requires parental consent for users under a certain age, we collect a parent or guardian's details at sign-up to meet that requirement. We explain exactly what we collect and why in the sections below.

Parental consent applies to creating an account in the app. It does not automatically extend to every way you might reach us — see "When you contact support" below for how this works when there's no account involved.

1When you join the waitlist

When you submit our early-access form, you provide us with:

• Your name and email address
• Your location (country and, where relevant, education level or age range)
• Any preferences or answers you share in the form

2When you use the Curio Bite app

When you create an account in the app, you provide us with:

• Your username — the @handle you choose to go by. This should not be your real name.
• Your password, which secures your account. Passwords are stored using one-way hashing (bcrypt) and are never readable by us or recoverable in plain text.
• Your country.
• Your parent or guardian's first name and email address.
• Your first and last name (optional). You do not need to provide these to use Curio Bite.
• Your grade level (optional), which we use to show you cards suited to your stage of study.
• Your email address (optional). See "Resetting your Password" below for why you may want to add one.
• Your profile photo (optional). See the Amazon S3 entry under "Third-party services" for where photos are stored.

We collect your parent or guardian's details to notify them when you create your account, to obtain their approval where required, and to send them periodic summaries of your activity. Parents can adjust the frequency of these updates, or turn them off entirely, from the Parent Dashboard.

When you use the app we record which cards you view and how long you spend on each one, and the search terms you enter when looking for cards. This is linked to your account, because we use it to count your streaks, award XP, place you on the leaderboard, and choose which cards to show you next. We also use it in aggregate to understand how the product is being used and to improve it. We do not use it for advertising, and we do not sell it.

When you appear on the leaderboard, your username, profile photo, XP and streak are visible to other Curio Bite users. Your real name, email address, parent's details, school and grade level are never shown to other users.

3When you use Curio Bite without an account (guest mode)

You can browse a limited number of cards each day without creating an account. In guest mode:

• The country and grade level you pick are stored on your device only, in your device's secure storage. They are not sent to us and are not linked to any account.
• A count of how many cards you have viewed today is kept on your device, so we can apply the daily limit.
• We do not create an account for you, we do not ask for your name or email, and we do not collect your parent or guardian's details.
• Cards are requested from our servers so we can show them to you. These requests are not tied to a guest identity.

If you later create an account, the preferences saved on your device are cleared. You can also remove everything stored in guest mode by uninstalling the app.

4When you contact support

When you reach out to us for help — through the in-app support button, our support page at Support, or by emailing us directly — we collect:

• Your email address, so we can respond to you. This is required for support requests, even if you did not provide an email when you created your account.
• If you write to us from the in-app support button, the app attaches your username, your parent or guardian's email address as saved on your account, your app version, and your operating system and its version (for example, "ios 18.2"). This helps us find your account and diagnose the problem without asking you to explain it twice. It does not include your device model, your location, or anything else from your device.
• Whatever you tell us in your message.

Contacting support is separate from creating an account. Because it doesn't require an account, it's not gated by the parental consent step described above — a support request can, in principle, come from anyone who reaches the page, including a user who hasn't signed up at all. We keep the amount of data we collect through this channel to the minimum needed to help you, and we don't use it for anything else. If we can tell a message has come from someone who appears to be a minor and it raises a safety concern, we may reach out to a parent or guardian using details already on file, where we have them.

If you forget your Password, we send a one-time code so you can set a new one. If you added your own email address when you signed up, the code goes there. If you did not, the code is sent to your parent or guardian's email address, because that is the only address we hold for your account. Adding your own email address is optional, but it means you can reset your Password without involving your parent.

When you visit our website we may collect basic, anonymised analytics such as:

• Browser type and device category
• Approximate location at country or city level
• Pages visited and time spent on site

This data is aggregated and not linked to your identity.

We use the information you provide to:

• Notify you when Curio Bite launches or opens early access
• Create and manage your account in the app
• Send your parent or guardian account notifications and optional activity summaries
• Send occasional product updates (you can unsubscribe at any time)
• Understand demand so we can prioritise the right markets and features
• Respond to any messages you send us

We do not sell your personal data to third parties, and we do not use it for automated profiling or targeted advertising.

We use the following platforms to operate Curio Bite. Each maintains its own privacy policy and data protection standards.

PostgreSQL

Account data is stored in a PostgreSQL database hosted in Singapore. Passwords are stored using industry-standard one-way hashing (bcrypt) and are never stored or recoverable in plain text.

Amazon Web Services (Amazon S3)

If you choose to upload a profile photo, that image is stored in Amazon Simple Storage Service (Amazon S3), operated by Amazon Web Services, in the Asia Pacific (Singapore) region. Photos are uploaded directly from your device to Amazon S3 using a short-lived, single-use upload link. Before upload, the image is resized on your device to a maximum of 400 pixels on its longest side. Profile photos are deleted when you delete your photo or your account. Amazon Web Services processes this data as our service provider under its own security and privacy terms, and does not use your photo for its own purposes.

Tally

Our early-access form is hosted by Tally.so. Data you submit through the form is processed by Tally under their own privacy policy. Tally does not share your data with third parties for advertising purposes.

Make.com

We use Make.com (formerly Integromat) to automate internal workflows — for example, routing waitlist submissions and triggering account notifications. Your data may transit Make.com's platform in the process.

Brevo

We use Brevo to send emails — including waitlist confirmations, account notifications, and parent activity summaries. Your email address and name are processed by Brevo for this purpose.

Microsoft Outlook (Microsoft 365)

Support requests sent through the in-app support button, our support page, or by emailing us directly are received and stored in a shared Outlook mailbox on Microsoft 365. Your email address, message, and any device or diagnostic information you send us is handled within that mailbox by our team, under Microsoft's own privacy and security terms for Microsoft 365.

Google Analytics (GA4) — website only

We use Google Analytics on our website only. It is not present in the Curio Bite mobile app, and it collects no data about you while you use the app. On the website it collects aggregated data such as pages visited, time spent on site and general location at country level. This data is not linked to your identity. Google Analytics is operated by Google LLC under its own privacy policy.

Google Search Console

We use Google Search Console to monitor how our website appears in Google search results. This tool does not collect any personal data about you as a visitor.

jsDelivr

Cards containing mathematical notation render using MathJax, a formatting library loaded from the jsDelivr content delivery network. jsDelivr receives your device's IP address when this happens. No account or activity data is sent.

We retain waitlist data for as long as is necessary to keep you informed about Curio Bite. We retain app account data for as long as your account is active. Anonymised analytics data may be retained indefinitely. Support correspondence is retained for 24 months from the date of your last message, and is then deleted. Data stored on your device in guest mode stays on your device until you create an account or uninstall the app; we do not hold a copy. Accounts that are never approved by a parent or guardian expire after 7 days and their data is deleted — see "Accounts awaiting parent approval" in our Terms of Service. For how account deletion works, see "Deleting your account" below.

You, or your parent or guardian, can request deletion of your account at any time. In the app, go to account settings and select "Delete my account." If you can't log in, you can request deletion from our website at Delete Account without needing an account or password.

When a deletion request is made, the account is disabled immediately and can no longer be used to log in. We then wait 7 days ("the grace period") before permanently deleting anything, in case the request was made by mistake. During this time, you or your parent or guardian can email privacy@curiobite.com to cancel the deletion — there is no self-service undo. After 7 days, all personal data associated with the account is permanently deleted from our systems and from cloud storage — including profile, reading history, XP, streaks, and profile photo — and a confirmation email is sent once this is complete.

Who can request deletion depends on the account. A parent or guardian can delete their own account, which also deletes every child account linked to it, on the same 7-day schedule. A parent or guardian can also delete a single child's account while leaving their own account and any other children untouched. A child can delete their own account directly in the app; their parent or guardian is notified by email that the account is scheduled for deletion in 7 days.

If you request deletion from our website, we verify the request with a one-time code before it takes effect. A parent enters their email address and receives the code directly. A child enters their username and the code is sent to their parent or guardian's email on file, since not every child has their own email address — the parent then shares the code with the child. To protect against someone trying to delete an account that isn't theirs, our website never confirms or denies whether a matching account exists; it always shows the same message regardless of the outcome.

This 7-day deletion grace period is separate from the 7-day expiry for accounts awaiting parent approval described above — the two are not related.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Our third-party processors (Amazon Web Services, Tally, Make.com, Brevo, Microsoft 365, Google Analytics) maintain their own security standards. No method of electronic transmission is completely secure; we cannot guarantee absolute security.

Because we use cloud-based platforms operated by global providers, your data may be processed outside of your country of residence, including outside Singapore or the European Economic Area. Our third-party processors — including Amazon Web Services, Microsoft 365, Brevo, Make.com and Tally — maintain appropriate safeguards for cross-border transfers. Account data is held in a PostgreSQL database in Singapore, and profile photos are held in Amazon S3 in the Asia Pacific (Singapore) region.

Depending on where you are located, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data — see "Deleting your account" above for how
• Object to or restrict how we use your data
• Withdraw consent at any time (this does not affect prior processing)
• Lodge a complaint with your local data protection authority

If you are under 18 and would like to exercise any of these rights, you or your parent or guardian can contact us at privacy@curiobite.com.

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the site or app after changes are posted constitutes acceptance of the revised policy.

For any privacy-related questions, requests, or concerns, please write to us at privacy@curiobite.com.

Curio Bite is a product of Algoritmo Lab.