At a glance
Curavo keeps your ordinary notes and collections in this browser. Public guides and editorial submissions use a separate Cloudflare database. The ChatGPT integration reads published guides only. This notice describes what this version does and how you can control or request access to your information.
Who is responsible
Operator / data controller: Kenneth Michels.
Contact address: Wannenholzstrasse 6, 8046 Zürich, Switzerland.
Direct support and privacy contact: curavo.support@gmail.com.
Your browser-local workspace
Notes, collections, custom fields, locally uploaded photos and appearance settings are stored on your device under Curavo’s browser storage. They are not automatically uploaded to the public database or the MCP server. UI preferences and the optional creation-count preference are also stored locally. Browser or device backups may separately copy that storage.
Export a JSON backup in My Space → Settings before clearing site data or moving browsers. Clearing local storage can permanently remove this workspace. Soft-deleted items remain in the local trash until you remove them. Curavo cannot recover browser-only notes from its server.
Public guides, snapshots and editorial drafts
Submitting or publishing sends the selected collection’s title, description, creator alias, entries, fields and included public URLs to Cloudflare D1. Published guides are readable without an account, including through the MCP tools. Treat every included field as public.
Editorial draft and pending submissions are server-stored and available to authorized curators, not public Discover or MCP reads. Approved/rejected submission records can remain in the submissions table; unpublishing a public record does not automatically erase its earlier submission record. No private workspace content is attached automatically.
Read-only snapshot links are different: their fragment carries the shared snapshot. Anyone holding the link can read it; those links are not revocable or live collaboration. Public-guide removal cannot retract copies, exports, screenshots or third-party caches.
ChatGPT MCP reads
The separate Curavo MCP Worker receives tool arguments such as search keywords, category, result limit or a public collection ID. It retrieves allowlisted public results and returns them to ChatGPT. It has no private-workspace login and cannot create, edit, like, save or publish content through its three tools. Curavo does not request the whole conversation through these tools.
Search terms are sent to the Curavo public search API. The implementation does not intentionally persist those queries or tool payloads in a Curavo query-history table. Cloudflare and OpenAI can separately process operational information under their own services and account settings; no zero-logging claim is made. Avoid entering sensitive personal information into public searches.
Counts, cookies and abuse prevention
Optional workspace creation counts send only a fixed event name, not note titles, text, images or local IDs. These optional creation counts are off by default, including for old preferences without a confirmed opt-in. You can turn them on or off in My Space → Settings → Anonymous usage totals. That setting does not disable separately measured public collection reads or reactions.
Website detail reads increment public_list_opened. Requests authenticated with the server-held MCP HMAC key increment mcp_collection_read instead. These are aggregate read counts, not verified humans or unique visitors; repeat requests and other automation can affect totals. The HMAC key is not sent to ChatGPT or browser users.
A signed, random first-party reaction cookie (__Host-curavo-visitor) is only issued when you choose to like or save a public guide, not simply by viewing or searching it. Its configured Max-Age is 31,536,000 seconds (365 days), unless you delete it sooner. Clearing the cookie does not itself remove previously stored reaction rows and can change how later reactions are counted. It is pseudonymous, not an account or proof of identity.
Feedback is limited to four submissions per network-address/visitor-derived daily hash. Raw addresses are not stored in that feedback-limit table. Hash rows older than fourteen days are deleted when later feedback triggers cleanup; this is not a guaranteed scheduled purge. MCP rate limiting uses short-lived per-isolate IP buckets with a one-minute counting window; stale entries can remain until cleanup or isolate shutdown. An optional Cloudflare limiter may be configured.
Feedback, reports and removal requests
If you send feedback, Curavo stores the selected topic, your message, source page, status and timestamp in the curator inbox. Reports include the public list ID, reason and timestamp. Feedback does not automatically attach private notes or a reply address. If you include contact details, they become part of your message.
Use Support → Removal requests with the public collection link and the specific concern. Feedback alone does not provide a private reply channel unless you supply one. Do not send passwords, admin keys, analytics secrets or unnecessary identity documents.
Infrastructure and third parties
Cloudflare Pages/Workers deliver the site and MCP service; D1 stores published guides, editorial submissions, reactions, feedback, reports and aggregate counts. The browser service worker caches application assets, not API responses or your private notes.
Cloudflare can process IP addresses, request metadata and technical/security logs. When configured, Cloudflare Turnstile supports visitor submissions and reports. Remote cover/image URLs can contact their host when loaded; opening a source or Google Maps link contacts that provider. The MCP adapter returns those links without fetching each external destination. OpenAI processes ChatGPT interactions separately under its policies.
Configured hosting locations, processing countries and transfer safeguards: The public database curavo-discover-db uses Cloudflare D1 with its primary instance assigned to Eastern Europe, no jurisdiction restriction and global read replication disabled (dashboard verified 29 October 2026). Cloudflare Pages, Workers, security services, subprocessors, logs, recovery copies and links to other services may involve processing in other countries; data is not guaranteed to stay in Switzerland or the EU.. Cloudflare publishes a customer Data Processing Addendum and standard contractual clauses for applicable transfers. The safeguards that apply to particular transfers depend on the provider agreements and services in use; contact the operator for information about an individual transfer. The published documents do not, on their own, establish that every transfer has been assessed.. Cloudflare publishes a Data Processing Addendum and Standard Contractual Clauses for relevant transfers; the documents are published references rather than a guarantee about every account-specific transfer. See also Cloudflare’s privacy information and OpenAI’s privacy policy.
Retention and deletion
Local data remains until you delete it, clear site storage or your browser evicts it; your exported backups remain under your control. The reaction cookie and feedback-limit cleanup have the configured periods explained above.
Public guides, pending/approved submissions and reports have no automatic expiry. A curator-only retention preview can estimate eligible older drafts, rejected submissions, reviewed feedback, reactions, aggregate counts and rate-limit hashes. A separate explicitly confirmed, admin-protected cleanup is disabled unless the operator enables RETENTION_EXECUTE_ENABLED, and it only removes bounded batches after review. No scheduler is deployed; these rules do not constitute guaranteed automatic expiry. Curator controls can discard unpublished drafts, remove feedback/reports, or unpublish guides and their reactions. Aggregate counts and earlier approved/rejected submission records can remain after those actions. Provider logs and backups follow separately configured provider practices. Cloudflare documents D1 Time Travel restore windows of up to 7 days on Workers Free or 30 days on Workers Paid for production databases; these are not a promise that every deleted record is irrecoverable after that time. If Workers Logs are enabled, Cloudflare lists 3-day (Free) or 7-day (Paid) retention for that product; other log types may differ. The operator has not yet confirmed this account’s plan or enabled observability settings.
Data retention policy and operational limits: Browser-only content remains on the device until the person deletes it, the browser evicts it or site storage is cleared. Public guides remain until unpublished; pending or approved submissions, unresolved reports and earlier submission copies have no automated expiry. Eligible unpublished drafts are identified after 90 days; rejected submissions after 90 days from a recorded rejection date; reviewed feedback after 90 days from a recorded review date; inactive reaction records after 365 days; aggregate usage records after 365 days; and older rate-limit hashes after 14 days. This is a manual eligibility schedule, not an automated deletion promise: cleanup is disabled by default, requires explicit administrator authorization and is limited to 200 rows per category per execution. Legacy reviewed/rejected records without lifecycle dates are excluded. An individual can request review or deletion through the support email. Provider logs, caching and backups follow separate provider settings and retention rules.. Do not read an unspecified period as a promise of automatic deletion.
Your choices and rights
You can export/delete your local workspace, disable optional creation counts, avoid publishing, and clear reaction cookies. For server-held content, request access, correction or removal using the confirmed controller contact above. Depending on the law that applies, you may also have rights to object, restrict processing, receive a portable copy, withdraw consent where used, or complain to a competent data-protection authority.
We may need proportionate information to locate a record and establish your connection to it; do not send more personal data than needed. Deletion cannot erase copies held independently by other users or platforms. No automatic decision about a person or profiling system is implemented by these public collection tools.
Processing grounds and your choices: For processing subject to the GDPR, we generally rely on steps necessary to provide a requested service or perform our agreement when you submit a guide, request publication, react to a guide or contact support; legitimate interests in delivering, securing and moderating the service for essential logging, rate limiting, aggregate public-read counts and misuse prevention; and your opt-in choice for optional creation-count analytics. We balance those interests against visitors' privacy rights. For processing governed by the Swiss FADP, we follow its applicable data-protection requirements. You can turn off optional creation counts at any time. EU/EEA GDPR applicability and any specific representative/consent duties depend on actual service targeting and are not assumed to be absent. Contact us for access, correction, deletion, objection or other applicable rights..