Curio
Curio · Binary Data Technology

Privacy Policy

What Curio collects, what it deliberately does not, and what happens to a photo after you scan it.

Last updated August 31, 2026

The short version

Curio is built so that there is very little about you to protect in the first place. That is a design decision, not a marketing line, and the rest of this document explains exactly how it works.

  • There is no account. You never give us a name, an email address, or a password.
  • Your collection - the items you save, your photos, your notes, your folders - lives in a database on your phone and is never uploaded.
  • A photo you scan is sent to our server, passed to the model that reads it, and deleted as soon as the answer comes back. We do not keep the image.
  • What we do keep from a scan is a short mathematical fingerprint of the image and the text of the result, so that the next person who scans the same thing gets an instant answer instead of a fresh model call.
  • Location data is removed from your photo on your phone, before it is sent anywhere.
  • We do not sell your data. Free users who run out of scans may choose to watch one Google rewarded ad for one extra scan; the consent screen and Settings > Privacy let you decline or change advertising choices. Paid users never see ads.

Who we are

Curio is operated by Joseph Hagan, doing business as Binary Data Technology ("we", "us"). For UK and EU data protection law we are the controller of the small amount of personal data described below.

Postal address: 33 Gates Ave, Springfield, MA 01118-2302, United States.

Privacy contact: binarydatatechnology151@gmail.com. General support: binarydatatechnology151@gmail.com.

This policy covers the Curio mobile app and the Curio web scanner. It does not cover the App Store, Google Play, or any other site or service that you reach through a link from Curio.

What we collect

Everything in this list is collected because a specific feature stops working without it. There is nothing here that is collected "just in case".

  • An anonymous install identifier. When the app first opens, Google Firebase issues a random identifier for this installation. It is not linked to your Apple ID, your Google account, your email address, or your phone number, and it does not follow you to another device or survive a reinstall. We use it for exactly one thing: counting how many scans this installation has used, so that the free allowance and the fair-use caps can be enforced on the server where they cannot be edited.
  • The photos you submit for a scan, for as long as it takes to answer. See "What happens to your photo" below.
  • A perceptual hash of each submitted photo. This is a 64-bit fingerprint of the visual structure of the image. You cannot reconstruct a picture from it and it does not identify you; two photographs of the same coin taken by two different people produce nearly the same hash, which is the whole point.
  • The structured result of the scan: the label, the attributes, the confidence band, the value range and its source and date. This is stored against the hash in a cache that every user shares.
  • Corrections you choose to submit. If you tell us a result is wrong, we receive the result we gave, the correction you typed, and the hash. Nothing else travels with it. This is optional and only happens when you tap the button.
  • Purchase and subscription status. Google Play sends a purchase token to the app. Our Firebase backend verifies that token with the Google Play Developer API and records the product, whether it is active, its expiry, and renewal state. We do not receive your payment card, billing address, or Google account name.
  • An app-integrity token. On Android, Firebase App Check asks Google Play Integrity to confirm that a request comes from the genuine Play-distributed Curio app. The token contains app and device integrity signals used only to prevent automated abuse and forged requests; Curio does not use it for advertising or profiling.
  • Product analytics events. Event names such as "scan_started" or "paywall_viewed", plus non-identifying properties such as the vertical, the confidence band, and whether the answer came from the cache. No photo, no result text, no free-text note, and no advertising identifier is attached.
  • Optional rewarded-ad data. Only when a free user chooses the rewarded-ad feature, the Google Mobile Ads SDK may collect and share an IP address, ad interactions such as ad views and taps, diagnostic information, and device or account identifiers including the Android advertising ID or app-set ID. Google uses these for advertising, analytics, and fraud prevention. Curio does not attach a scan photo, result, collection item, note, purchase token, or Firebase identifier to the ad request.
  • Ordinary technical information that any internet request carries: your IP address, the app version, and the device platform. Google receives the IP address as part of routing the request. We use it only for rate limiting and abuse prevention and we do not build a profile from it.

What we deliberately do not collect

This list is as important as the one above, and it is enforced by how the app is built rather than by a promise.

  • No name, email address, phone number, postal address, date of birth, or password. There is no sign-up form because there is no account.
  • No location. Curio strips EXIF metadata, including GPS coordinates, from every image on your device before the image is uploaded.
  • No access to your photo library beyond the individual pictures you pick. Curio never reads, indexes, or uploads the rest of your camera roll.
  • No contacts, calendar, microphone, or health data.
  • No banner, interstitial, or app-open advertising. Curio offers only a voluntary rewarded ad after a free allowance is exhausted, and subscribers remain ad-free.
  • No copy of your collection. Your saved items, photos, notes, folders, and totals stay on your device.
  • No sale of personal information by Curio. Advertising choices, including any consent or opt-out required for personalised advertising, are presented through Google’s consent platform before an ad request.

What happens to your photo

This is the part most people want to know about, so here it is step by step.

The short version: the picture is a means to an end. Once we have the answer, the picture has no further use to us, so it goes.

  • 1. You take or choose a picture. It stays on your device while you review it.
  • 2. Your device shrinks the image so its longest edge is 768 pixels and removes all EXIF metadata, including any GPS coordinates your camera recorded. The smaller, stripped copy is what leaves your phone. The original never does.
  • 3. Your device computes the perceptual hash and sends it to our server first. If someone has already scanned a visually identical item, the cached result comes straight back and your photo is never uploaded at all.
  • 4. If there is no cached match, the image is sent over an encrypted connection to our Cloud Function and passed to the paid Google Gemini API for visual analysis. Curio explicitly disables Gemini interaction storage for each request.
  • 5. The model returns a structured answer. We check it against a strict schema, store the hash and the answer in the shared cache, and return the answer to your phone.
  • 6. The uploaded image is deleted at that point. It is held only for the length of the request, is never written into a long-term store or a backup, and a storage lifecycle rule sweeps any transient object that somehow outlives its request within one hour.
  • 7. Your phone saves the item, with your full-resolution local photo, into the database on your device if you choose to keep it.

Your collection stays on your device

Saved items live in a SQLite database inside the app’s private storage. There is no sync, no cloud backup by us, and no server-side copy to request or delete, because none is ever made.

The practical consequence is worth stating plainly, because it cuts both ways: if you lose the device, delete the app, or reset the phone, the collection is gone and we cannot restore it. Use Settings to export your collection records as JSON or CSV, keep separate copies of important photos, and store them somewhere you control. If your device backs itself up to iCloud or to Google, the app’s data may be included in that backup under Apple’s or Google’s terms, not ours.

Anonymous sign-in, and why it exists

Curio signs your installation in to Firebase anonymously the first time it runs. There is no username, no password, no email, and no profile - just an opaque identifier.

It exists because scan allowances have to be counted somewhere the user cannot reach. Counting on the device would mean a reinstall resets the free tier and a determined user can run our model bill up without limit. Counting against an anonymous identifier is the least invasive way to enforce a quota, and it is why we can offer the app without asking you to register.

Signing out is not a concept here, but you can erase the identifier and everything attached to it - see "Your rights".

Who else handles your data

These are every third party involved, what each one receives, and why. There are no others.

  • Google (Firebase / Google Cloud) - processor. Runs our Cloud Functions, the Firestore database that holds the shared result cache and the quota counters, and the anonymous sign-in service. Receives: the submitted image for the duration of the request, the perceptual hash, the result, quota counters, and the network metadata any request carries.
  • Google Gemini - delegated visual model service. Receives the downscaled, metadata-stripped image and our prompt, but no anonymous install identifier. Curio uses only a paid Gemini API project, for which Google states prompts, files, and responses are not used to improve its products, and sends store=false on every interaction.
  • DeepSeek - disabled in the public configuration. It is retained only as an internal-evaluation opt-in and must not receive public-user images until binding retention, training, deletion, data-processing, and international-transfer terms are approved.
  • Google (Google Play) - independent controller for the purchase itself and processor for our server verification. Google takes the payment, holds your payment details, issues the purchase token, and reports purchase lifecycle state to our Firebase backend. We never see your card, billing address, or Google account name. Google receives no scan photo or result through the billing flow.
  • Google Play Integrity - security processor on Android. Produces a short-lived app-integrity token so Firebase can reject requests from modified, unrecognized, or automated clients. It receives the technical signals required to assess app and device integrity, but no scan photo, result, collection item, note, or payment detail.
  • Google Mobile Ads and its advertising partners - used only for the optional rewarded-ad feature available to free users. They may receive an IP address, ad views and taps, diagnostics, and device or account identifiers for advertising, analytics, and fraud prevention. The European consent message offers Consent, Do not consent, and Manage options; any applicable US-state choice is also available from Settings > Privacy. Curio receives only the earned-reward event needed to add one bounded scan and does not send the scanned object or your local collection to the advertising system.
  • Our analytics endpoint - processor. Receives event names and non-identifying properties so we can see which parts of the app work and which do not. Receives no photo, no result text, no notes, and no advertising identifier.

How long we keep things

Retention periods are enforced by automated deletion jobs, not by anyone remembering to run them.

  • Uploaded photos: deleted as soon as the identification returns. A lifecycle rule removes any transient object within one hour regardless.
  • Shared cache entries (perceptual hash plus structured result): up to 24 months from the last time that entry was used, then deleted. Value estimates go stale long before that, which is why every range carries the date it was produced.
  • Daily quota counters: deleted 35 days after the day they cover. Monthly counters: deleted 13 months after the month they cover.
  • The anonymous install record: deleted after 12 consecutive months with no scans.
  • Corrections you submit: up to 36 months, so the accuracy of a change can be measured over more than one model version.
  • Analytics events: 14 months.
  • Reward records: a random ad-event identifier and the fact that one scan was granted are kept with the anonymous install quota record for up to 13 months. Google and its advertising partners retain ad-delivery data under their own published policies and the choices shown in the consent form.
  • Payment and tax records held by Google Play: for as long as Google’s own legal and accounting obligations require. Our verified purchase-state record is deleted when you use Delete my data, except where applicable law requires a specific record to be retained.

Your rights, and how to use them without an account

If you are in the UK or the EEA you have the right to ask for access to your personal data, to have it corrected, to have it erased, to restrict or object to how we process it, and to receive it in a portable form. Similar rights apply in a number of other places, and we apply the same process to everyone regardless of where they are.

The awkward bit, which we would rather explain than hide: because there is no account, we hold nothing that identifies you as a person. The anonymous install identifier is the only handle that exists. Under Article 11 of the UK and EU GDPR we are not required to acquire extra information about you purely to satisfy a rights request, and we will not, because collecting identity documents to service a privacy request would make your privacy worse rather than better.

So the practical route is:

  • Erasure, the easy way: Settings > Privacy > Delete my data. This calls the server and erases the anonymous install record, its quota counters, and any corrections tied to it. It happens immediately and it does not need our involvement.
  • Your collection: delete the app, or use Settings > Collection > Delete everything. That data was only ever on your device, so removing it is entirely in your hands.
  • Access, portability, correction, restriction, objection: email binarydatatechnology151@gmail.com and include the anonymous install identifier shown in Settings > About. With it we can find the handful of records attached to your installation. Without it we genuinely cannot tell your data from anyone else’s, and we will say so rather than guess.
  • Portability of your collection records does not need us at all: Settings > Export gives you JSON and CSV. Those exports do not embed photo files.
  • We answer within one month. If a request is unusually complex we may extend that by two months and will tell you why.
  • Turning analytics off: Settings > Privacy > Product analytics.
  • Shared cache entries are not tied to your identifier and are not personal data about you, so an erasure request does not remove them. If you believe a particular cached entry does contain personal data - a photograph of a document, say - email us and we will delete that entry.

California privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information is collected and why, to delete it, to correct it, to opt out of its sale or sharing, and not to be discriminated against for exercising any of those rights.

Our answers are short. In the last twelve months we have collected the categories listed under "What we collect": an anonymous identifier, internet activity in the form of app events, and the transient contents of a photo you chose to submit. If you voluntarily request a rewarded ad, Google may process and share identifiers and ad-interaction data for advertising as described above. We do not sell personal information, use sensitive personal information for advertising, offer financial incentives in exchange for data, or knowingly collect or sell the personal information of anyone under 16.

Open Settings > Privacy > Advertising privacy choices to exercise any applicable opt-out of sale, sharing, or targeted advertising offered for your region. To delete Curio’s records, use Settings > Privacy > Delete my data, or email binarydatatechnology151@gmail.com. An authorised agent may submit a request on your behalf with written permission.

Children

Curio is a general-audience app for people who collect things. It is not directed to children under 13, we do not market it to them, and we do not knowingly collect personal information from them. There is no account creation, messaging, user-to-user contact, or social feature. The optional rewarded ad is available only in this general-audience product and the ad request is explicitly marked as not child-directed.

The app is rated for a general audience because its content is suitable for one, which is not the same as being aimed at children. On Google Play it is declared as not primarily child-directed.

If you are a parent or guardian and you believe a child has sent us something, email binarydatatechnology151@gmail.com with the anonymous install identifier from Settings > About and we will erase the installation’s records.

Where your data goes

Our Cloud Functions, Firestore, paid Gemini processing, and optional Google advertising services may process the limited data described above outside your home jurisdiction under Google's applicable terms. DeepSeek is disabled for public users; enabling it later requires a lawful transfer mechanism and approved data-processing terms first.

Where an international transfer occurs, we require an applicable lawful transfer mechanism and data-processing terms before enabling that provider for public users.

In practice the exposure is small, because the only thing crossing a border that relates to you at all is a photograph of an object you own, and it exists on the far side of that border for a matter of seconds.

Security

Everything travels over TLS. The Cloud Functions require a valid Firebase anonymous sign-in token, quota is enforced on the server rather than in the app, and the Firestore security rules deny direct client reads and writes to the cache and the counters - the only way in is through our functions.

On your device, the collection database sits in the app’s private storage, protected by the operating system’s app sandbox and by your device passcode or biometric lock. If you jailbreak or root the device, that protection weakens; that is outside our control.

No system is perfect and we will not pretend otherwise: this policy describes the measures we take, and it is not a guarantee against every possible failure. If a breach affects your rights we will notify the relevant supervisory authority within 72 hours and tell affected users where the law requires it.

Changes to this policy

When we change this policy we update the date at the top and publish the new version in the app and at the hosted address. The in-app copy and the hosted copy are generated from the same source, so they cannot disagree.

If a change materially affects you - a new recipient of your data, a new purpose, a longer retention period - we will show it to you in the app before it takes effect rather than relying on you to check. Continuing to use Curio after that point means the updated policy applies.

Contact and complaints

Privacy questions and rights requests: binarydatatechnology151@gmail.com. Anything else: binarydatatechnology151@gmail.com.

If you are in the UK and you are not satisfied with our response, you can complain to the Information Commissioner’s Office at ico.org.uk. If you are in the EEA, you can complain to the supervisory authority in the country where you live, where you work, or where the problem happened. We would rather you came to us first, but you are not obliged to.