Previous version (policy package P-35b5b901fb1e, effective 2026-10-30). It applies until the current version takes effect: read the current version.
Curivra privacy policy
Effective date: 2026-10-30 · Operator ("we"): Brandsap, based in Nagpur, Maharashtra, India · Postal address: available on request from contact@brandsap.com · Privacy contact: contact@brandsap.com · This page: https://curivra-public.briefly-app.workers.dev/privacy/
The short version
Curivra shows short news cards from the topics you choose and nothing else. It is for adults aged 18 and over. You can use it without an account. As a guest you give us no name, e-mail address or phone number. If you create an account, Google's Firebase Authentication handles sign-in; our own database stores only a Firebase user ID, never your e-mail address or password. We do not sell or share personal data for advertising. Curivra shows no ads, uses no advertising ID and contains no third-party analytics or tracking SDKs.
What we collect
| Data | When | Why | Where it is kept | How long |
|---|---|---|---|---|
| A random reader ID and a signed session token | When you first open the app | Keeps your topics and saved stories | Our database (Cloudflare D1); the token stays in your phone's secure storage | Until you delete your data. A guest record unused for 210 days is deleted automatically |
| Your acceptance of the Terms: the Terms version and the time you accepted, with your confirmation that you are 18 or older | When you start using the app, and again if the Terms change | Shows which Terms you agreed to | Our database, with your reader ID | Until you delete your data |
| Topics you follow or exclude, sources you mute, stories you hide or save | When you set them | Builds your feed; filtering happens on our server | Our database | Until you change them or delete your data |
| Account only: e-mail address and password, or your Google identity | When you create an account | Signs you in and lets you reset your password | Google Firebase Authentication. Our database stores only the Firebase user ID | Until you delete your account; Google then removes it from its live and backup systems within 180 days |
| Usage counts: the days you used the app, number of feed loads, empty feeds, saves, and per session the number of cards viewed and the duration | On by default, explained when you first open the app; turn off under You → Privacy → Usage counts | Tells us whether Curivra is useful | Our database. No story IDs, topics or IP addresses | Until you delete your data |
| Beta access (yes or no) | When we invite you to the test programme | Shows test stories to invited testers only | Our database stores only the yes/no flag. If you were invited by e-mail, your address is on an invitation list in our server configuration and compared at sign-in; it is not written to our database | The flag: until you delete your data or access ends. The invitation list entry: until the test programme ends or you ask us to remove it |
| Alerts only: a push token for your phone, and a record of the alerts sent to you | When you turn on Breaking news alerts (off until you turn it on; Android asks for permission) | Sends you breaking stories from the topics you follow, never others | Our database stores the token with your reader ID and, per alert, which story was sent and when. To deliver an alert, Google Firebase Cloud Messaging receives the token and the alert text (the headline and the start of the story) | The token: until you turn alerts off, delete your data, or it stops working (for example after you uninstall), when it is deleted. The alert record: until you delete your data |
| Which stories you read | Only if you turn on Share which stories I read (off by default) | Ranks stories within your chosen topics | Our database | Until you turn it off or delete your data |
| Feedback and problem reports | When you send one | Fixes problems | Our database, with the app version, build type, platform and OS version, and the story for a report | Deleted 12 months after we resolve it, or earlier when you delete your data |
| Complaints you make: the ground (for example "a story is wrong"), your description, the story concerned, and our decision | When you make a complaint in the app (You → Make a complaint, or a story's ⋯ → Report a problem → Make a formal complaint) or write to us | To decide it, and to keep a record of how we handle complaints | Our database, with your reader ID; for a complaint by e-mail or post, the address you wrote from | 12 months after our decision. If you delete your data first, we remove your words and contact details and keep only an anonymous record (reference, ground, dates, decision) until then |
| A visit to a shared story page (someone opened a Curivra link in a browser) | When anyone opens the link | Shows that story | Processed by Cloudflare to serve the page (IP address and browser details). No cookies, no analytics, nothing linked to a reader | Cloudflare's request logs, as below |
| IP address of each request | Every request | Rate limiting and abuse prevention | Processed by our server and by Cloudflare; not written to our database. Cloudflare's request logs for our server may include it | Our server's request logs (Cloudflare Workers Logs) are kept for 3 days on our current plan and up to 7 days on a paid plan |
| Account only: IP addresses of sign-in requests | When you sign in or create an account | Security of sign-in | Google Firebase Authentication | Google states it keeps logged IP addresses for a few weeks |
We do not collect your name (unless Google passes it to Firebase when you sign in with Google), phone number, contacts, location, advertising ID, device identifiers, photos or files. Your topics, saved stories and reading data are never sent to Google or Firebase; only an alert you turned on (its headline and first line) reaches your phone through Google's Firebase Cloud Messaging. Curivra does not use a crash-reporting service today; if one is added, this policy will name it before it is used, and it will run only if you turn on Send crash reports.
Age check (Android). When Curivra is installed from Google Play, the app asks Google Play whether your Google account belongs to an adult, as some U.S. state laws require. Google Play answers on your phone. If it reports an age under 18, or that your age must be confirmed, the app cannot be used until that changes. The answer stays on your phone and is used only for this check: we never receive or store your age or age range, and we do not combine it with anything else.
On your phone the app keeps your settings, topics, saved stories with their text, the Terms version you accepted and an offline copy of your latest feed (up to 20 stories, used for up to 24 hours). When a story is withdrawn or expires, the app deletes its local text. Signing out removes reader data from the phone; Delete my data removes everything. If you installed Curivra from a shared link, the app reads Google Play's install referrer once, on your phone, to open that story after you set up the app; it is not sent to us.
How we use it
To show you stories that match the interests you chose, keep your choices across sessions and devices, secure the service, fix problems and, through usage counts, learn whether the test programme works. We do not infer sensitive traits from your interests, build advertising profiles, or make automated decisions with legal or similarly significant effects about you. We process this data because you asked to use Curivra and agreed to its Terms, and, for the optional items above, because you turned them on.
Who we share it with
We do not sell or rent personal data and do not share it for cross-context behavioural advertising. Service providers process data for us only to run Curivra:
- Cloudflare, Inc. runs our servers and database.
- Google LLC (Firebase Authentication), if you create an account. It receives your e-mail and password or Google identity and your sign-in requests, never your topics or reading data.
- Google LLC (Firebase Cloud Messaging), if you turn on alerts. It receives your phone's push token and the text of each alert to deliver it, never your topics or reading data.
We may disclose information if the law requires it, for example in response to a valid court order, or to protect the safety of people or the service.
Where data is processed and who can access it
- Storage. Our database is hosted by Cloudflare with its primary location in eastern North America. Our server code runs on Cloudflare's global network, so a request may be handled in the Cloudflare data centre nearest to you.
- Sign-in. Google states that Firebase Authentication processes data only in data centres in the United States.
- Access. Curivra's publisher is Brandsap, based in Nagpur, Maharashtra, India. The people we authorise to run the service access personal data from the United States, through Cloudflare's and Google's administration tools and our own newsroom tools, only to operate, secure and support Curivra (for example, to act on a deletion request).
Your data is therefore stored in the United States and on Cloudflare's network, and may be accessed from the countries named above, which may have data protection laws different from those where you live.
Your choices and rights
- Usage counts: You → Privacy → Usage counts. When off, nothing more is recorded.
- Story-level reading data: off unless you turn it on.
- See and change your choices: topics, exclusions and muted sources are shown and editable in the app.
- Download your data: You → Privacy → Download my data gives you a copy, as a file, of everything we store about your reader ID: topics, exclusions and muted sources, saved and hidden stories, settings, usage counts, feedback, complaints and your Terms record. A signed-in account's e-mail address and name are held by Firebase Authentication and shown in the app, not in our database.
- Your U.S. state privacy rights: depending on where you live, you can ask to access, correct or delete your personal data, get a copy in a portable format, and opt out of targeted advertising, sale of personal data or profiling (we do none of these). Use the app, or write to contact@brandsap.com; we reply within 30 days. If we refuse a request, you can appeal by replying "appeal"; we answer an appeal within 45 days, and you may then complain to your state attorney general.
- Delete your data (guest): You → Delete my data. Deletes your reader record and everything linked to it on our server, then clears the phone. If our server cannot be reached, nothing is deleted and the app says so.
- Delete your account (signed in): You → Delete account and data. After you confirm your sign-in, we delete your data from our database and the app deletes your Firebase sign-in account. If the second step fails, the app says so and lets you finish it later.
- Without the app: https://curivra-public.briefly-app.workers.dev/delete/ lets you sign in and delete your account in a web browser. You can also write to contact@brandsap.com; we will ask you to confirm the request from the app or the sign-in account concerned (for a guest, by sending the Reader ID shown under You → About), and we reply within 30 days.
- Questions and complaints: Our Grievance Officer is Satyam Pandey, reachable at contact@brandsap.com. We acknowledge every message and resolve it within 30 days. Complaints about our content follow our complaints procedure (acknowledged within 24 hours, decided within 15 days; see our editorial standards). You may also have the right to complain to the data protection authority where you live.
What deletion cannot reach immediately is described in our account deletion and data retention page.
Retention and backups
Reader data stays until you delete it, with these exceptions. Our database provider keeps a point-in-time recovery history (7 days on our current plan, 30 days on a paid plan). If we enable encrypted off-site backups, they are kept for 14 days. If we ever have to restore from either, we repeat every deletion made since, from a deletion record that holds only the random reader ID, the time and whether you or the inactivity rule deleted it, and is itself deleted after 45 days. Guest records unused for 210 days are deleted automatically, feedback is deleted 12 months after it is resolved, and complaints 12 months after our decision. If a law that applies to us requires us to keep some records longer, we will say so on this page before that applies.
Children
Curivra is for adults. You must be 18 or older to use it, and the app asks you to confirm this before you start. It is not directed to children, and we do not knowingly collect personal data from anyone under
- On Android, the app also asks Google Play for the account's age range (above). If we learn that a
reader is under 18, we delete their data and any account. See our children and age policy.
Security
All traffic uses HTTPS. Session tokens are kept in the phone's secure storage. Newsroom tools require separate staff accounts with role checks, and staff actions are logged. No system is perfectly secure; if a breach affects your personal data we will tell you as the law requires. Report security problems to contact@brandsap.com.
Do Not Track
Curivra does not track you across other apps or websites, so it treats every reader the same whether or not a Do Not Track or Global Privacy Control signal is sent.
Changes
We will post changes on this page with a new effective date. When a change is material, the app asks you to accept the updated Terms before you continue, and you can delete your data instead.