Curated
Discover
Sign in

Privacy Policy

Last updated: November 3, 2026

Curated is operated by Qadri LLC, doing business as Mitho Labs ("we," "us"), which is responsible for the information described here. This Privacy Policy explains what information Curated collects, how we use it, and the choices you have. It applies to the Curated app, curated.network, and related services.

1. Information We Collect

  • Account information: email address and display name.
  • How you sign in: if you use Google or Apple, they share your name, email address and an account identifier with us. If you hide your email with Apple, we receive Apple's relay address instead. For a passkey we keep only its public key and a name you can change; your device keeps the private key.
  • Assistant connections: when you connect Claude, ChatGPT or another assistant, we record which assistant it is, the permissions you allowed and when it last acted for you. We store its access only as a hashed token. When the assistant uses Curated for you, we receive the requests it sends, such as a search, a list title, or the picks and notes to add or change. We do not receive the rest of your conversation.
  • Content you create: lists, picks, notes, images, voice memos you record, and the details of each pick, whether or not you publish them.
  • Device data: device identifier and push token (for notifications), app version, and basic diagnostic logs.
  • Request data: the IP address and browser or app version of requests to Curated, used to keep you signed in, enforce rate limits, prevent abuse and fix errors.
  • Website visits: on curated.network we count page views, the page that sent you, your browser type and country, and how fast pages load. This uses Cloudflare Web Analytics, which sets no cookies and does not identify or follow you across sites.
  • Support communications: messages you send to support@curated.network.

2. How We Use Your Information

We use this information to operate the Service, prevent fraud and abuse, respond to support requests, and improve features. What a connected assistant sends is used only to carry out the request you made through it. We do not sell your personal information, and we do not use it for cross-context behavioral advertising.

3. AI-assisted details

To fill in details for your picks (such as what it is, its author, address or cover), the text and links of a pick may be sent to Anthropic's Claude models, reached through OpenRouter, which we configure to use only providers that do not train on the data. Covers we generate use Cloudflare Workers AI, and voice memos you record are transcribed by OpenAI. These providers process the requests on our behalf. Your notes stay your words: AI never rewrites them unless you ask.

4. Subprocessors

We share data with the following providers strictly to run the Service:

  • Anthropic and OpenRouter: AI-assisted details for picks
  • OpenAI: transcribing voice memos you record
  • Cloudflare: storage for images and covers, cover generation (Workers AI), email forwarding, and website analytics without cookies
  • Google: sign-in with Google, and reading the Google Maps links you add
  • Apple: sign-in with Apple
  • OpenStreetMap: looking up places by name
  • Expo: push notification delivery
  • Railway / managed Postgres: application hosting and database
  • Resend: transactional email
  • Sentry: error reports, used to find and fix problems
  • Have I Been Pwned: checking a new password against known breaches, using only a short piece of its hash, never the password

5. Retention

If you connect an assistant and choose Continue without signing in, we create an account with no email address. Its lists stay private and cannot be published. When you sign in to save them, everything in it moves into the account you sign in to, and the account without an email is deleted. If nobody uses it for 90 days, we delete it and everything in it.

Sign-in sessions, with the IP address and browser they started from, last up to 30 days and are deleted within 7 days after they end. An assistant connection's record is deleted within 13 months of its last use, even if you disconnect it sooner, so a stolen access token can still be recognized. Server and error logs are deleted automatically on our hosting and error-reporting providers' standard schedules.

We retain your account data while your account is active. When you delete your account, we delete personal data within 30 days, except where retention is required for tax, accounting, fraud-prevention, or legal-compliance purposes. Anonymized aggregates may be retained indefinitely.

6. Your Rights (GDPR, CCPA, and Similar Laws)

You may request access to, correction of, deletion of, or a portable copy of your personal data. You can edit your profile and delete your account in Settings, and stop an assistant's access under Assistants (Disconnect). For anything else, including a copy of your data, email support@curated.network. California residents have the right to opt out of the sale or sharing of personal information; we do not sell or share personal information as those terms are defined by the CCPA. EEA/UK residents may lodge a complaint with their local supervisory authority.

7. International Transfers

Curated is based in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. under appropriate safeguards (Standard Contractual Clauses where required).

8. Children

The Service is not directed to children under 13, and we do not knowingly collect data from them.

9. Changes and Contact

We will notify you of material changes through the app or by email. Questions: support@curated.network. By post: Qadri LLC, 304 S Jones Blvd, Suite 106, Las Vegas, NV 89107.