Previous version (policy package P-55a8b32e0a50, effective 2026-10-15). It applies until the current version takes effect: read the current version.
Curivra privacy policy
Effective date: 2026-10-15 · Operator ("we"): Brandsap, based in Nagpur, Maharashtra, India · Postal address: available on request from contact@brandsap.com · Privacy contact: contact@brandsap.com · This page: https://curivra-public.briefly-app.workers.dev/privacy/
The short version
Curivra shows short news cards from the topics you choose and nothing else. It is for adults aged 18 and over. You can use it without an account. As a guest you give us no name, e-mail address or phone number. If you create an account, Google's Firebase Authentication handles sign-in; our own database stores only a Firebase user ID, never your e-mail address or password. We do not sell or share personal data for advertising. Curivra shows no ads, uses no advertising ID and contains no third-party analytics or tracking SDKs.
What we collect
| Data | When | Why | Where it is kept | How long |
|---|---|---|---|---|
| A random reader ID and a signed session token | When you first open the app | Keeps your topics and saved stories | Our database (Cloudflare D1); the token stays in your phone's secure storage | Until you delete your data. A guest record unused for 210 days is deleted automatically |
| Your acceptance of the Terms: the Terms version and the time you accepted, with your confirmation that you are 18 or older | When you start using the app, and again if the Terms change | Shows which Terms you agreed to | Our database, with your reader ID | Until you delete your data |
| Topics you follow or exclude, sources you mute, stories you hide or save | When you set them | Builds your feed; filtering happens on our server | Our database | Until you change them or delete your data |
| Account only: e-mail address and password, or your Google identity | When you create an account | Signs you in and lets you reset your password | Google Firebase Authentication. Our database stores only the Firebase user ID | Until you delete your account; Google then removes it from its live and backup systems within 180 days |
| Usage counts: the days you used the app, number of feed loads, empty feeds, saves, and per session the number of cards viewed and the duration | On by default, explained when you first open the app; turn off under You → Privacy → Usage counts | Tells us whether Curivra is useful | Our database. No story IDs, topics or IP addresses | Until you delete your data |
| Beta access (yes or no) | When we invite you to the test programme | Shows test stories to invited testers only | Our database stores only the yes/no flag. If you were invited by e-mail, your address is on an invitation list in our server configuration and compared at sign-in; it is not written to our database | The flag: until you delete your data or access ends. The invitation list entry: until the test programme ends or you ask us to remove it |
| Which stories you read | Only if you turn on Share which stories I read (off by default) | Ranks stories within your chosen topics | Our database | Until you turn it off or delete your data |
| Feedback and problem reports | When you send one | Fixes problems | Our database, with the app version, build type, platform and OS version, and the story for a report | Deleted 12 months after we resolve it, or earlier when you delete your data |
| IP address of each request | Every request | Rate limiting and abuse prevention | Processed by our server and by Cloudflare; not written to our database. Cloudflare's request logs for our server may include it | Our server's request logs (Cloudflare Workers Logs) are kept for 3 days on our current plan and up to 7 days on a paid plan |
| Account only: IP addresses of sign-in requests | When you sign in or create an account | Security of sign-in | Google Firebase Authentication | Google states it keeps logged IP addresses for a few weeks |
We do not collect your name (unless Google passes it to Firebase when you sign in with Google), phone number, contacts, location, advertising ID, device identifiers, photos or files. Your topics, saved stories and reading data are never sent to Google or Firebase. Curivra does not use a crash-reporting service today; if one is added, this policy will name it before it is used, and it will run only if you turn on Send crash reports.
On your phone the app keeps your settings, topics, saved stories with their text, the Terms version you accepted and an offline copy of your latest feed (up to 20 stories, used for up to 24 hours). When a story is withdrawn or expires, the app deletes its local text. Signing out removes reader data from the phone; Delete my data removes everything.
How we use it
To show you stories that match the interests you chose, keep your choices across sessions and devices, secure the service, fix problems and, through usage counts, learn whether the test programme works. We do not infer sensitive traits from your interests, build advertising profiles, or make automated decisions with legal or similarly significant effects about you. We process this data because you asked to use Curivra and agreed to its Terms, and, for the optional items above, because you turned them on.
Who we share it with
We do not sell or rent personal data and do not share it for cross-context behavioural advertising. Service providers process data for us only to run Curivra:
- Cloudflare, Inc. runs our servers and database.
- Google LLC (Firebase Authentication), if you create an account. It receives your e-mail and password or Google identity and your sign-in requests, never your topics or reading data.
We may disclose information if the law requires it, for example in response to a valid court order, or to protect the safety of people or the service.
Where data is processed and who can access it
- Storage. Our database is hosted by Cloudflare with its primary location in eastern North America. Our server code runs on Cloudflare's global network, so a request may be handled in the Cloudflare data centre nearest to you.
- Sign-in. Google states that Firebase Authentication processes data only in data centres in the United States.
- Access. Curivra's publisher is Brandsap, based in Nagpur, Maharashtra, India. The people we authorise to run the service access personal data from the United States, through Cloudflare's and Google's administration tools and our own newsroom tools, only to operate, secure and support Curivra (for example, to act on a deletion request).
Your data is therefore stored in the United States and on Cloudflare's network, and may be accessed from the countries named above, which may have data protection laws different from those where you live.
Your choices and rights
- Usage counts: You → Privacy → Usage counts. When off, nothing more is recorded.
- Story-level reading data: off unless you turn it on.
- See and change your choices: topics, exclusions and muted sources are shown and editable in the app.
- Delete your data (guest): You → Delete my data. Deletes your reader record and everything linked to it on our server, then clears the phone. If our server cannot be reached, nothing is deleted and the app says so.
- Delete your account (signed in): You → Delete account and data. After you confirm your sign-in, we delete your data from our database and the app deletes your Firebase sign-in account. If the second step fails, the app says so and lets you finish it later.
- Without the app: https://curivra-public.briefly-app.workers.dev/delete/ lets you sign in and delete your account in a web browser. You can also write to contact@brandsap.com; we will ask you to confirm the request from the app or the sign-in account concerned (for a guest, by sending the Reader ID shown under You → About), and we reply within 30 days.
- Questions and complaints: Our Grievance Officer is Satyam Pandey, reachable at contact@brandsap.com. We acknowledge every message and resolve it within 30 days. You may also have the right to complain to the data protection authority where you live.
What deletion cannot reach immediately is described in our account deletion and data retention page.
Retention and backups
Reader data stays until you delete it, with these exceptions. Our database provider keeps a point-in-time recovery history (7 days on our current plan, 30 days on a paid plan). If we enable encrypted off-site backups, they are kept for 14 days. If we ever have to restore from either, we repeat every deletion made since, from a deletion record that holds only the random reader ID, the time and whether you or the inactivity rule deleted it, and is itself deleted after 45 days. Guest records unused for 210 days are deleted automatically, and feedback is deleted 12 months after it is resolved. If a law that applies to us requires us to keep some records longer, we will say so on this page before that applies.
Children
Curivra is for adults. You must be 18 or older to use it, and the app asks you to confirm this before you start. It is not directed to children, and we do not knowingly collect personal data from anyone under
- If we learn that a reader is under 18, we delete their data and any account. See our
Security
All traffic uses HTTPS. Session tokens are kept in the phone's secure storage. Newsroom tools require separate staff accounts with role checks, and staff actions are logged. No system is perfectly secure; if a breach affects your personal data we will tell you as the law requires. Report security problems to contact@brandsap.com.
Do Not Track
Curivra does not track you across other apps or websites, so it treats every reader the same whether or not a Do Not Track or Global Privacy Control signal is sent.
Changes
We will post changes on this page with a new effective date. When a change is material, the app asks you to accept the updated Terms before you continue, and you can delete your data instead.