Privacy Policy

Last updated: June 15, 2026

Curo ("Curo", "we", "us") provides an AI email-triage service that reads your connected mailboxes, surfaces what needs your attention, and drafts replies in your voice. This policy explains what we collect, how we use it, and the choices you have. We built Curo to handle your inbox — not to mine it.

1. Information we collect

Account data: your Curo handle/email, name, password hash, and plan.
Connected mailbox data: when you connect a mailbox (Google, Microsoft, or IMAP), we access email metadata and content needed to triage it — sender, subject, date, and body — and store an encrypted credential or OAuth token so we can keep syncing.
Usage data: sync timestamps and the AI token cost of each sync, so we can show you your own usage and operate the service.

2. How we use your data

To triage your mail — score importance, filter noise and phishing, and categorize messages.
To draft replies in your voice and learn from your edits (only your own data trains your own voice; it is never pooled across users).
To send you your triage digest on the channels you choose (email / Telegram).

Google user data — Limited Use

Curo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Gmail data only to provide and improve the user-facing triage features you enable; we do not sell Gmail data; we do not use it for advertising; we do not let humans read it except with your explicit consent, to investigate abuse, for security, or where required by law; and we do not use Gmail data to train generalized AI/ML models. Triage uses your data only to serve you.

3. How your data is stored & protected

Mailbox credentials and OAuth refresh tokens are encrypted at rest (Fernet, AES-128-CBC + HMAC). Plaintext credentials never touch our database, logs, or backups.
Every account is tenant-isolated — one customer can never see another's mail.
Access to production systems is restricted and logged.

4. Sharing

We do not sell your data. We share data only with infrastructure providers that operate the service on our behalf — our hosting provider, and our AI provider that performs triage on the content of an email at the moment it is processed. These providers are bound by their own data-protection terms and do not use your content to train models.

5. Retention & deletion

You can disconnect any mailbox at any time from Settings, which deletes its stored credential and triaged messages. You can delete your account by contacting us; we remove your data within 30 days, except where retention is required by law.

6. Your choices

Connect or disconnect mailboxes whenever you like.
Revoke Google access at any time via your Google Account permissions.
Request a copy or deletion of your data by emailing us.

7. Children

Curo is not directed to anyone under 16, and we do not knowingly collect their data.

8. Changes

We may update this policy; material changes will be announced in-app or by email. Continued use after an update means you accept the revised policy.

9. Contact

Questions or requests: [email protected].