Privacy

Last updated November 5, 2026

Curating is a small app for keeping track of what you’re watching, reading and listening to, and for sharing that with people you choose. This page says exactly what it stores about you and what it does with it. There is no advertising on Curating, and your information is never sold.

Who is responsible for your data

Curating is operated from Brazil by an individual, not a company. That person is the controller of the information described below — the controlador under Brazil’s Lei Geral de Proteção de Dados (LGPD), and the data controller under the GDPR for anyone using Curating from Europe.

Their name isn’t published here, because this page is also where people are sent to report abuse. If you need it — to exercise a right below, or to raise something formally — ask at support@curatingapp.com and it will be given to you.

Questions about your data, requests to see or correct it, and anything else on this page go to support@curatingapp.com. That address reaches a person, not a ticket queue.

What Curating stores

Everything below is held in a Postgres database run by Supabase. Nothing else is collected — there is no advertising identifier, no location data, no contact-list import, and no third-party analytics or tracking in the app.

Your accountYour email address and a hashed password, held by Supabase Auth. The password itself is never stored, and never reaches Curating’s own code in a readable form.

Your profileYour handle, display name, bio, and profile picture if you upload one. Your handle and name are visible to anyone signed in; your other content follows the privacy settings below.

What you logThe films, shows, music, books and podcasts you post about, along with anything you write about them, your rating, when you say it happened, and which episode or season it was.

Who you tagThe people you credit for a recommendation, and the people you say you watched, read or listened with. Tagging someone tells them.

Your connectionsWho you follow, who follows you, and any follow requests still waiting for approval.

Your collectionsYour Tasteboards, what is on them, who collaborates on them, which boards you follow, and your Want to list.

Your activityComments and likes, an activity ledger of things like adding to a board or following someone, and your notifications.

Safety recordsAccounts you have blocked, and any reports you file. A report keeps a copy of the reported text so it can still be acted on if the original is deleted.

Who can see it

Curating is built for small circles, and the access rules are enforced by the database itself rather than only by the app — a request that goes around the app still can’t read something it isn’t allowed to.

A public account’s posts and public boards can be seen by anyone signed in to Curating.
A private account’s posts and boards can be seen only by followers it has approved. You can switch your account to private at any time in Settings → Privacy.
A private board is visible to you alone, whatever your account setting says and whoever follows you.
Your email address is never shown to other people. Neither is your Want to list, unless you turn that on.
Blocking someone hides each of you from the other, and removes any follow between you in both directions.

Why Curating is allowed to store it

Both the LGPD and the GDPR ask for the legal ground behind each use of your information, not just a description of it. Curating relies on three, and none of them is advertising.

To run the appYour account, profile, posts, boards, follows and comments are stored because that is the thing you signed up for — there is no version of Curating that shows your Tasteboard to a friend without storing it. This is performance of a contract with you (LGPD Art. 7, V; GDPR Art. 6(1)(b)).

To keep it safeBlocks, reports and the snapshot of reported content exist so that people can get away from someone and so abuse can be acted on. This is a legitimate interest — ours and other users’ — in a service that isn’t hostile to be in (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).

To meet legal dutiesWhere a law requires something to be kept or handed over, that obligation is the ground (LGPD Art. 7, II; GDPR Art. 6(1)(c)). This has not happened.

Nothing on Curating is profiled or scored automatically, no decision about you is made by a machine, and your information is not used to train anything.

Services Curating relies on

Curating is run by one person and uses a small number of outside services to work at all. It does not share your information with anyone else.

SupabaseHosts the database, sign-in, and uploaded pictures (profile photos, and covers for titles you add). Everything listed above lives here.

VercelHosts the website and, as part of serving it, keeps standard server logs including IP addresses for a short period.

ResendDelivers Curating’s emails (sign-in links, password resets), so it receives your email address and the message being sent.

Apple Push Notification serviceDelivers notifications to your iPhone if you allow them. It receives your device’s notification token and the notification’s text.

Spotify, Letterboxd, GoodreadsOnly if you connect them. Curating reads what you play on Spotify (with your permission, which you can withdraw in Settings or in Spotify) and your public Letterboxd and Goodreads activity, and stores what it imports as your posts. Spotify receives the sign-in you approve; the others receive no information about you.

TMDB, iTunes, Open Library, Google Books, MusicBrainzSupply the catalog information about films, shows, music, books and podcasts. These are looked up by Curating’s own server, not by your browser, so these services do not receive your address or anything identifying you.

Where it is processed

Curating is operated from Brazil, but the services it runs on are not. Supabase, Vercel and Resend are United States companies, and your information is stored and processed on their infrastructure outside Brazil.

That makes it an international transfer under LGPD Art. 33, and under Chapter V of the GDPR for European users. The transfers rest on the contractual data-protection terms agreed with each provider, which oblige them to protect your information to the standard those laws require, and on their own published security commitments. Apple and Spotify receive only what is described above, and no other organization receives your information.

TMDB, the iTunes Search API, Open Library, Google Books and MusicBrainz are queried by Curating’s own server rather than by your browser, so those services never receive your address or anything identifying you — only the title being looked up.

How long it is kept

The short answer is that your content stays until you remove it, and deleting your account removes it immediately. In more detail:

Your contentProfile, posts, comments, likes, boards, follows, Want to list, activity and notifications are kept for as long as your account exists. Deleting the account removes them from the live database at once — there is no waiting period and no way to undo it.

BackupsOur hosting provider takes routine backups for disaster recovery. A copy of deleted content can persist in those for a short period before they roll off, and is not restored or used for anything else.

ReportsA report is kept while it is open and for a period afterwards, so that repeated behavior by the same account is visible rather than resetting each time. Reports about an account are deleted when that account is deleted.

Server logsOur hosting provider keeps standard request logs, including IP addresses, for a short period as part of running the service.

Two things survive deleting your account, and it is worth being clear about both. Comments you left on other people’s posts go with your account, but a title you added to a board you shared with someone else stays on their board — it simply stops pointing at you and carries none of your writing. And a report someone filed about your content is deleted along with your account.

How to delete your account

Your choices

Make your account private, so only approved followers see your posts.
Set any Tasteboard to public, followers-only, invite-only or private.
Keep your activity ledger and your Want to list to yourself.
Limit comments to people you follow.
Block anyone, at any time, from their profile.
Edit your name, bio, handle and picture, or delete any post.
Delete your account and everything in it.

Your rights over your data

Separately from the settings above, the LGPD (Art. 18) gives you rights over your information that Curating has to honor. If you are in Europe, the GDPR gives you equivalent ones. You can exercise any of them by emailing support@curatingapp.com — you do not have to give a reason, and it costs nothing.

Confirmation and access — whether Curating holds anything about you, and a copy of it.
Correction — fixing anything incomplete, inaccurate or out of date. Most of this you can do yourself in Settings.
Deletion — removing your account and its content, which you can also do yourself at any time.
Anonymisation or blocking — of anything unnecessary, excessive, or handled in a way the law doesn’t allow.
Portability — your information in a machine-readable form you can take elsewhere.
Information about sharing — who your data has been shared with. The answer is the providers named above, and nobody else.
Objection — to a use of your information that rests on legitimate interests.
Complaint — to Brazil’s Autoridade Nacional de Proteção de Dados (ANPD), or to your local supervisory authority in Europe, if you think this has been handled badly. You are welcome to raise it here first, but you don’t have to.

Requests are answered within 15 days, which is the deadline the LGPD sets. You may be asked to confirm you are who you say you are — handing someone else’s posts to whoever asks for them would be its own privacy failure.

Children

Curating is not intended for children under 13, and accounts are not knowingly created for them. If you believe a child has an account, email support@curatingapp.com and it will be removed.

Changes to this policy

If this policy changes in a way that affects what is collected or who can see it, the date at the top of this page changes and you’ll be told in the app before it takes effect.

Questions about your privacy? Email support@curatingapp.com. Curating is run by one person, so replies come from a human rather than a helpdesk.