Privacy Notice

Who this covers

This notice explains how Curber handles information when you browse, create an account, post a sale, message another user, report content, or manage a previous Curber purchase. Questions and privacy requests can be sent to privacy@curber.app.

Information we collect

• Account details from Supabase Auth and your chosen sign-in provider, including identifier, email, display name, avatar, and session data.
• Profile, sales, items, schedules, asking prices, photos, saved sales, saved searches, RSVPs, routes, reports, messages, and notification preferences you provide.
• Approximate or precise location when you choose to share it, plus the address and map coordinates of a sale you post.
• Purchase status, product, amount, promotion code and campaign attribution, Stripe identifiers, and receipts. Stripe receives payment-card details; Curber does not store full card numbers.
• Security, moderation, delivery, and product events such as request identifiers, coarse feature outcomes, timestamps, and pseudonymous fingerprints. We do not put raw search text into product analytics.
• If advertising measurement is enabled, Meta receives browser and device information, the pages you visit, and a small set of actions such as viewing or saving a sale, searching, contacting a host, finishing account setup, or publishing a sale. For a few completed actions, Curber also sends matching data through Meta’s Conversions API.

How we use information

We use it to operate accounts and listings; show nearby results and routes; deliver messages and alerts; maintain historical billing records and process optional paid services if they are offered; prevent fraud, abuse, and unsafe uploads; respond to reports; measure whether features work; comply with law; and protect Curber and its users.

Content and AI

New photo uploads, public listing text, messages, and sale inquiries are screened before Curber accepts them. Curber may send that content to OpenAI for automated safety screening. Curber requests that OpenAI not store model outputs for product improvement and does not permit Curber API data to be used to train OpenAI’s models. OpenAI may retain limited API data for abuse monitoring as described in its own policies. A blocked photo is not written to Curber’s photo-storage bucket, and blocked text is not written to Curber’s content tables. Curber keeps only a non-reversible fingerprint and limited moderation metadata needed for security and audit purposes.

When information is shared

Public listings share the host name, listing content, sale city, and the exact address according to the host’s visibility choice. Messages are shared with conversation participants and may be reviewed by authorized staff when reported or needed for safety. Service providers include Supabase (database, authentication, and storage), Vercel (hosting and cookieless traffic analytics), Cloudflare (DNS and network services), Stripe (payments and historical billing records), OpenAI (content safety), Resend (email), OpenFreeMap (map display), Photon (place and address search), PostHog (optional product analytics), and Meta (optional advertising measurement). We may also disclose information for a valid legal request, an emergency, fraud prevention, or a business transfer. Curber does not sell personal information. Meta may use information received through its Pixel for advertising measurement and personalization under its own terms and privacy notice.

Advertising measurement

Curber uses Meta Pixel and the Conversions API to understand whether advertising helps people discover and use the app. Curber does not send Meta your readable name or email, messages, precise location, home or sale address, photos, or raw search terms through this integration. For completed account setup, first contact, and published-sale events, Curber may send a one-way hash of your account identifier and email address so Meta can match and deduplicate the browser and server events. Measurement is off when you disable Advertising measurement in Privacy choices or when your browser sends a recognized Global Privacy Control signal. Changes apply to future activity in that browser.

Product analytics

Vercel Web Analytics counts page views and reports aggregate information such as the page, referring site, country, device, browser, and operating system. It does not use cookies or create personal visitor profiles.

Curber uses PostHog to count defined feature milestones and find broken or confusing flows. Automatic click collection and session replay are disabled. Signed-in activity may use a pseudonymous account identifier so events work across sessions. Curber does not send PostHog names, email addresses, messages, street addresses, precise location, sale IDs, or raw search text. You can disable Product improvement analytics in Privacy choices.

Using Curber without an account

Guest saves, search filters, and route preferences are stored in this browser. We also remember up to 500 viewed sales in this browser to distinguish new and viewed map pins; this history is not synced to your account. Unpublished drafts and their photos are stored on this device. Clearing site data removes them. Guest saves and searches are added to your account only when you choose “Sync to my account”; drafts are uploaded when you publish. Searches and map lookups still send the information needed to return results. Email alerts and messages require an account.

Retention and deletion

Live account and listing data remains until you delete it or it is no longer needed to provide the service. Deleting a sale removes Curber-managed sale photos. Deleting your account removes Curber-managed photos, profile content, messages, saves, saved searches, and other account data; purchase records may be de-identified and retained for tax, chargeback, fraud, accounting, and legal obligations. Short security and moderation records, provider delivery logs, backups, and deletion receipts may remain for a limited period. Failed storage deletions are marked for retry and account deletion stops rather than claiming success.

Your choices and rights

You can edit your profile and listings, manage email preferences, remove content, and delete your account from the You page. You can also ask to access, correct, delete, or receive a copy of information associated with your account by emailing us. We may verify your identity and may retain information where an exception or legal duty applies. Browser and device settings control location access and cookies used for sign-in. Use the Privacy choices control available throughout Curber to turn Meta advertising measurement off or back on. Curber also honors Global Privacy Control as an advertising opt-out signal.

Security, children, and changes

We use access controls, row-level security, encrypted connections, scoped service credentials, rate limits, and audit records, but no system is perfectly secure. Curber is not directed to children under 13 and we do not knowingly collect their personal information. We will update the effective date and request renewed consent when a material change requires it.