Privacy Policy
Last updated: September 11, 2026
1. About this policy
This policy explains how Curve ("we," "us," or "our") handles personal information on curvehq.sh and in the Curve Cloud services we operate. It covers visitors, account holders, and people using a workspace hosted by Curve. Contact us at [email protected].
Radius can run locally or on infrastructure operated by someone else. Installing the open-source application does not by itself send your local workspace to Curve. If a vendor or another organization provides your agents or operates your server, its privacy policy governs its handling of your information. This policy applies to information Curve receives through our services.
2. Information we receive
- Account information: your name, email address, verification status, profile picture, and sign-in provider.
- Authentication records: provider account identifiers, authentication tokens, sessions, IP addresses, browser information, and sign-in timestamps.
- Organization and device information: organization names, membership and roles, invitations, registered devices, configuration, and service status.
- Content you or your administrator choose to send to hosted features: conversations, files, artifacts, agent configuration, connected-service metadata, and activity records. What we receive depends on the features and connections you use.
- Technical and support records: request URLs, IP addresses, timestamps, errors, usage needed to operate the service, and information you provide when contacting us.
3. Sign in with Google
If you choose Google sign-in, Google authenticates you on its own page. We request only OpenID, email, and profile permissions. We receive your Google account identifier, email and verification status, and basic profile information such as your name and picture. We use these details to create or identify your Curve account, sign you in, and display your account information. We do not receive your Google password.
Our authentication service stores the linked account information and authentication tokens returned by Google. Stored OAuth access and refresh tokens are encrypted. Google sign-in does not grant Curve or an agent access to Gmail, Google Drive, Calendar, or other Google content. Connecting a separate service requires its own authorization.
We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Curve's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements where applicable.
4. How we use information
We use information to provide the features you request, authenticate accounts, enforce workspace access, operate and troubleshoot hosted services, prevent abuse, respond to support requests, and meet applicable legal obligations. Account information also lets us communicate about your service and its security.
Where data protection law requires a legal basis, we process information to provide the service under our agreement with you, for legitimate interests such as security and reliability, to comply with law, or with your consent where required. You may withdraw consent without affecting earlier lawful processing.
5. When information is shared
Infrastructure, hosting, and email providers process information needed to deliver and maintain the service. Google processes your sign-in under its own privacy policy. Authorized personnel may access information as needed for operations, support, security, and legal compliance.
Your workspace administrator controls membership and settings and may have access to information associated with that workspace. Agents, model providers, and connected tools receive information according to the connections and actions you or your administrator authorize. Their own terms and privacy policies govern their processing. Google sign-in alone does not authorize those separate connections.
We may disclose information when required by law or necessary to protect people, investigate abuse, or protect the service. If ownership of the service changes, information may transfer as part of that change, subject to law and any additional consent required for Google user data. We do not sell personal information or share it for cross-context behavioral advertising.
7. Storage, security, and retention
We use HTTPS, access controls, and restricted credential storage to protect information. No service can guarantee absolute security. Information may be processed outside the country where you live; we apply the transfer safeguards required by applicable law.
We retain account and service information while needed to provide the service and for legitimate security, support, and legal needs. Retention varies by record type and workspace configuration. When information is no longer needed, we delete it or de-identify it. Backups and records required for legal or security purposes may remain longer and are restricted to those purposes.
8. Your choices and requests
Request access, correction, export, or deletion of your personal information by emailing [email protected]. We may need to verify your identity. For a vendor-managed workspace, contact its administrator as well; some requests must be handled by the organization responsible for that workspace. Depending on your location, you may also have rights to object to or restrict processing and to complain to a data protection authority.
Revoke Curve's Google access in your Google Account connections. Revocation prevents further authorized access but does not automatically delete information already stored in Curve or close your Curve account. Contact us to request deletion of that data.
9. Children
Curve is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided personal information, contact us so we can investigate and delete it as appropriate.
10. Changes and contact
We update this page when our practices change and revise the date above. We will provide additional notice or seek consent when required, including before using Google data for a new purpose. For privacy questions or requests, email [email protected].