Legal
Privacy Policy
Last updated
Curiosity Diaries ("we", "us") runs curiositydiaries.com and api.curiositydiaries.com. This policy explains what we collect, why, who processes it for us, and the choices you have. We keep it short and specific on purpose.
1. What we collect
When you just read. We run our own first-party analytics. For each page view we record the page address, the referring site, UTM campaign tags, an approximate country (from our network provider's header, never a precise location), device type, browser and operating system family, screen size, language, how long the page stayed open and how far you scrolled. We do not store your full IP address with these records and we never sell them.
- If you accept analytics cookies, we keep a random visitor ID in your browser's local storage so we can tell new visitors from returning ones.
- If you choose "Essential only", we use a random ID that lives only for your current browser session.
When you create an account. Your name, email address, a securely hashed password, your credit balance and transaction history, your sign-up IP address, and the date you last signed in. Optional: avatar, short bio and marketing preference.
When you use AI tools. The prompts, chat messages and images you submit, and the results we return to you, so that you can see your history and so we can bill credits correctly. You can delete individual generations and conversations from your account at any time.
When you pay. Payments are handled by Stripe. Card details go directly to Stripe through an embedded, encrypted form; we never see or store your full card number. We keep the subscription status, amounts, invoice links and the last four digits/brand of the card that Stripe shares with us.
When you comment, subscribe or contact us. Your name, email, message, the time, and your IP address (for spam prevention). Comment emails are never shown publicly.
2. Why we use it
- To run the site and your account, and to keep both secure (fraud, spam and abuse prevention).
- To provide AI tools and charge the right number of credits.
- To understand which articles are genuinely useful so we can write better ones (aggregated statistics).
- To send emails you asked for: verification, password resets, receipts, replies, and — only if you subscribed — our newsletter.
Legal bases (where GDPR applies): performing our contract with you, our legitimate interest in running and improving a secure website, your consent (analytics/advertising cookies, newsletter), and legal obligations (tax records).
3. Service providers we share data with
We share only what each provider needs to do its job:
| Provider | Purpose |
|---|---|
| Stripe | Payments, subscriptions, invoices |
| DeepSeek | Generating replies for Curiosity AI chat (your messages are sent to its API) |
| fal.ai | Image generation, background removal and upscaling (your prompt or uploaded image is sent to its API) |
| OpenAI | Drafting and illustrating our own articles (no visitor data is sent) |
| Our hosting & email providers | Running the servers and sending email |
| Cloudflare (if enabled) | Network security, spam protection (Turnstile) and performance |
| Google Analytics / AdSense (only if enabled and only after you consent) | Additional statistics and advertising |
AI providers may process data on servers outside your country. We do not allow them to receive your account email or password.
4. How long we keep it
- Raw page-view records: up to about 13 months, then deleted. Aggregated daily totals (no personal data) are kept.
- Account data: until you delete your account. Deleting your account removes your profile, AI history and bookmarks; payment records are retained as required by tax law.
- Contact messages and comments: as long as needed to respond and to keep discussions intact.
5. Your rights
You can access, correct, export or delete your data, object to or restrict certain processing, and withdraw consent at any time (use Cookie settings in the footer). You can delete your account from Account → Security. For anything else email hello@curiositydiaries.com — we answer within 30 days. You may also complain to your local data-protection authority.
6. Children
Curiosity Diaries is not directed at children under 13 (or under 16 where local law requires), and we do not knowingly collect their data. Paid features and AI tools require users to be at least 18 or to have a parent's permission.
7. Security
Passwords are hashed, API keys are encrypted at rest, all traffic uses HTTPS, and administrative actions are logged. No system is perfectly secure, so we also limit what we collect in the first place.
8. Changes
We'll update the date at the top when this policy changes and highlight significant changes on the site.
Questions? hello@curiositydiaries.com