Privacy notice

What we collect, and on what basis

We only ever ask for what a specific form needs, and nothing is collected passively beyond what's described below.

• Waitlist, step 1: your email address. Legal basis: your consent, given by submitting the form (Art. 6(1)(a) GDPR).
• Waitlist, step 2 (optional): the condition(s) you select and your answer to the frustration question. This is health data, a special category under Art. 9 GDPR, so we ask for your explicit, separate consent via a dedicated checkbox before this step is saved — it is never bundled into the step 1 consent.
• Co-development cohort application: your name, email, condition(s), your answer about what trackers have gotten wrong, your time-commitment preference, and optionally the tools you currently use. Conditions are again explicit-consent health data, captured the same way.
• If you arrive via a link with campaign parameters or a referral code, we hold that in your browser's session storage and send it to our server only if you submit the waitlist form, so it can be attributed to your signup.

Cookies and local storage

We set no advertising or tracking cookies. The following is the complete list of what we do store, all of it functional:

• curo_locale — a cookie remembering your language choice (EN/DE), kept for one year.
• curo:theme — stored on your device to remember your light/dark preference.
• curo:utm and curo:ref — held only for your current browser session, to attribute a waitlist signup to a referral link or campaign if you complete one.

Analytics

We use Vercel Web Analytics and Speed Insights to understand how many people visit, which pages they read, and how fast the site loads for them. It is cookieless and aggregate-only: it does not set tracking cookies, does not follow you across other websites, does not build a profile of you, and does not collect data that identifies you personally. This is why you are not seeing a cookie banner. We do not use Google Analytics or any advertising or profiling tools.

Where your data is stored and who can access it

Form submissions are stored in Supabase, hosted in Frankfurt, Germany (eu-central-1). This website is hosted by Vercel, and the server routes that receive your form data are configured to run in the same EU region. Your form data does not leave the EU. Supabase and Vercel act as processors on our behalf and may not use your data for their own purposes. Access is restricted to the Curo operator; we do not sell data, and we do not share it with insurers, employers, or marketing or advertising platforms of any kind.

How long we keep it

We keep waitlist and cohort application data for 12 months from the date you sign up, or until the app launches and you either activate an account or ask us not to contact you, whichever comes first. If the programme is still running after 12 months, we'll email you to ask whether you'd like to stay on the list before keeping your data any longer. You can ask us to delete it sooner at any time, with no reason needed.

Your rights

Under the GDPR, you have the right to:

• Access the data we hold about you, and get a copy of it.
• Correct anything that's inaccurate or incomplete.
• Have your data erased, or its processing restricted.
• Object to processing based on our legitimate interest.
• Receive your data in a portable format.
• Withdraw consent at any time, with no effect on processing that already happened before you did.

To exercise any of these

Email support@mycuro.app. We respond from that same address, and we will not ask you to create an account or pay a fee to do this.

If you're not satisfied with our answer

You can lodge a complaint with a data protection supervisory authority, including the one in the EU country where you live, where you work, or where you believe an infringement occurred. As we are based in Berlin, our lead authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).