Privacy Policy
Last Updated: August 24, 2026
Introduction
Welcome to CurlCrew ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services.
Information We Collect
Information You Provide to Us
- Account Information: Name, email address, and authentication credentials (via Auth0)
- Profile Information: Profile pictures, bio, and user preferences
- Content: Photos, videos, curl routines, product reviews, comments, and other content you post
- Hair Care Data: Information about your hair type, routines, products used, and preferences
- Safety Reports: When you report content or block another user, we store the report, the reason you selected, and which account you blocked
Information Collected Automatically
- Usage Data: How you interact with the app, features used, and content viewed
- Device Information: Device type, operating system, unique device identifiers
- Log Data: IP address, app crashes, system activity, and timestamps
How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our services
- Create and manage your account
- Enable social features like following, liking, and commenting
- Personalize your experience and provide recommendations
- Analyze hair care routines and provide AI-powered insights
- Screen the text you submit for content that breaks our Terms of Service
- Review reports, moderate content, and suspend accounts that break our rules
- Detect and prevent fraud, abuse, and security issues
- Comply with legal obligations
How We Share Your Information
Third-Party Services
We share information with the following third-party service providers who maintain the same or higher standards of data protection:
- Auth0 (Okta): Authentication and user identity management. Receives your email address and sign-in credentials.
- Amazon Web Services (AWS): Cloud storage (S3) for your photos and videos, and identity services (Cognito) for upload credentials.
- OpenAI: Hair analysis, insights, product recommendations, and the CurlBot assistant. Also screens captions, comments, replies, profile descriptions, and usernames for objectionable content before we store them. Receives the text and images you submit for these features.
- ElevenLabs: Converts CurlBot text replies into spoken audio. Receives the text of the reply that is read aloud.
- Rainforest API: Searches Amazon product listings so you can tag products. Receives your product search terms. It does not receive your identity.
- Amplitude: Product analytics. Receives app usage events tied to a random identifier, only if you are an adult and you turned analytics on. See "Analytics and Tracking" below.
We do not sell your personal information, and we do not share it with advertising networks or data brokers.
Public Content
Content you choose to make public (posts, comments, profile information) will be visible to other users of the app.
Legal Requirements
We may disclose your information if required by law or in response to valid legal requests.
Analytics and Tracking
CurlCrew uses Amplitude to understand how the app is used. Analytics are switched off unless you turn them on, and they stay off for anyone who tells us during sign-up that they are under 18.
Where analytics are on, we deliberately limit what is sent:
- Events are tied to a random identifier generated on your device, not to your name, email address, or account
- Your IP address is not sent
- Your city, country, and region are not sent
- Apple's identifier for vendors (IDFV) is not sent
- Nothing is captured automatically — we send only the events we chose to define
We ask for this choice during sign-up, and we store it with your account. You can change it at any time in the app: open Profile, then Edit Profile, and use the Share Usage Analytics switch under Account. The app stops sending events as soon as you turn the switch off. The switch is shown to adults only, because analytics stay off for anyone who told us they are under 18. You can also email contact@curlcrew.app and we will change it for you.
Data Security
We implement industry-standard security measures to protect your information, including:
- Encryption of data in transit using HTTPS/TLS, with certificate pinning in the app
- Secure token-based authentication (JWT)
- Credentials and tokens stored in the iOS Keychain
- Access controls and monitoring
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
Data Retention and Deletion
We retain your information for as long as your account is active or as needed to provide services. You can delete your account at any time inside the app, under Profile, then Edit Profile, then Account, then Delete Account. You can also ask us to delete it by writing to contact@curlcrew.app.
Deleting your account permanently removes your posts, photos, comments, followers, and saved products, and it cannot be undone. We remove your personal information from our active databases within 30 days, except where retention is required for legal compliance, dispute resolution, or enforcement of our agreements.
Your Rights and Choices
You have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Update or correct your personal information
- Deletion: Delete your account and personal data, in the app or by email
- Opt-Out: Withdraw your consent to product analytics at any time, in the app or by email
- Data Portability: Request your data in a portable format
To exercise these rights, contact us at contact@curlcrew.app, or use Profile, then Edit Profile, inside the app.
App Tracking Transparency (iOS)
CurlCrew does not track you across other companies' apps or websites, and it does not share your information with data brokers. For that reason the app does not ask for permission through Apple's App Tracking Transparency framework. If this ever changes, we will request your permission through that framework before any such tracking begins, and we will update this page first.
Children's Privacy
CurlCrew is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.
International Data Transfers
Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction. We ensure appropriate safeguards are in place for such transfers.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.
Contact Information
California Privacy Rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your information, and the right to opt-out of the sale of your information. We do not sell your personal information.
European Data Protection Rights
If you are in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, erase, restrict processing, object to processing, and data portability. You also have the right to lodge a complaint with a supervisory authority.