Privacy

Who we are

Curately is an inventory and selling tool for resellers. It is made and run by its owner, Kyle Wilichowski. Questions about your data go to privacy@curately.co.

What we store

• Your account: your email, your password (kept only as a one-way scramble, so nobody can read it), and your shop’s name and time zone. We note the browser and IP address of each sign-in, and count attempts to slow down guessing.
• Your shop: items, costs, prices, tags, history and photos (originals and resized copies). Sale and shipping records can include a buyer’s name, city or ZIP and a tracking number, when an email or an order says so.
• Your Shopify connection, if you make one: the store address, the app’s Client ID, and its secret or token, encrypted before saving. Order, shipment and refund notices from Shopify are kept as received, so they can include a buyer’s name and shipping address.
• Marketplace emails: each email that reaches Curately, kept whole, and what we read from it.

Three ways email reaches Curately

Use any of them, or all. An email that comes twice is stored once.

1. Connect your inbox (Gmail). When you connect an inbox, you sign in with Google and allow Curately to read your mail. Curately then checks about every 10 minutes, and when you tap Check now, for only messages matching the query shown on your Intake page (Gmail’s Purchases category and known marketplaces); nothing else is listed, fetched or kept. The first check looks back 30 days. Known marketplaces are a shared list of sender domains, like vinted.com, with no email content. The same rules will apply to Microsoft accounts.
2. Forward with a rule. You set up a filter in your mail provider that forwards marketplace mail to your shop’s Curately address. We get what the filter sends and nothing else.
3. Forward by hand. You forward one email to your address. We get that email.

Google user data

Curately's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect Gmail, we ask for read-only access, plus your address to show who is connected. Curately cannot send, change or delete anything in your mailbox. In plain terms:

• We use it only to provide the feature you see: turning purchase and sale emails into items and records in your shop.
• We never use it for advertising.
• We never sell it or transfer it, except as needed to provide that feature, for security, or because the law requires it.
• No person reads it, except with your explicit consent, for security, or to comply with the law.

An email becomes a saved example for improving a marketplace parser only when you choose that on its card, and then with your personal details removed. Mail Curately pulled from a connected inbox is never used that way without that choice.

Nothing from your mailbox is used to train AI models.

Instagram

If you connect Instagram, you sign in with Facebook and let Curately read your account. It never posts, comments, sends messages or changes anything. About every 15 minutes, and when you tap Check now, it reads the account’s id and name and the captions, links and times of your latest posts, only to find the post you prepared in Curately and mark it posted with its link. Posts that match none of yours are not kept.

Curately keeps the account’s id and name, the linked Facebook Page’s id and name, your Facebook id (so Facebook can tell us whose data to delete), the permissions you granted, whether the account can tag products, and an access token for that Page, encrypted. When you connect, it also reads the list of Pages you manage; it asks for business management only so a Page held in a Business portfolio can be found.

Disconnect in Settings, Posts deletes all of that; the post ids stay on the posts they were found as. If you ask Facebook to delete your data, Curately deletes the connection and the post ids too, and Facebook shows you a confirmation code.

When an AI reads your email

A model reads an email only when you forward it by hand or tap Read it in your Inbox, and only that email. To do that we send its sender, subject, date and text (cut to about 12,000 characters, with picture links listed) to Anthropic’s API, which sends back what it found. Anthropic does not train on it. Nothing is added to your shop until you tap.

All other email, including mail pulled from a connected inbox, is read by Curately’s own code, never by a model.

Where your data lives

• Neon holds the database: account, shop, items and records.
• Cloudflare holds photos and original emails in its R2 storage, receives forwarded mail at in.curately.co, and shows photos from data.curately.co. A photo’s address is long and unlisted, but anyone who has it can open it; that is how your Shopify listing shows it.
• Vercel runs the app and keeps ordinary request logs.
• Inngest runs background jobs. It sees ids and short results, not your emails.
• Anthropic, for Read it only. Shopify, Google and Meta (Facebook and Instagram), only if you connect them.

Emails are encrypted before they are stored; the storage address of an email only ever serves ciphertext. No advertisers, no analytics, no data brokers.

How long we keep it

• Other mail, meaning email Curately could not read and you have not asked it to read, is deleted after 30 days, with the original message.
• Every other email stays with your shop until the account is deleted: the ones that became items, sales or shipments, the ones you asked Curately to read, and the ones set aside.
• If you disconnect Gmail, Curately’s access at Google is revoked and our copy of the tokens deleted. Emails already pulled stay in your Inbox history.
• To delete your account, email privacy@curately.co from the address you signed up with. We delete your shop, items, photos and emails. Backups exist and are deleted on the provider’s schedule.

Cookies

One cookie, which keeps you signed in for up to a week. No advertising or analytics cookies, no third-party scripts. Your light or dark choice and the columns you show stay in your browser’s storage on your device and are not sent to us.

Your choices

• If you have connected Gmail, disconnect it on your Intake page, or remove Curately at myaccount.google.com/permissions. Either stops all pulling.
• If you have connected Instagram, disconnect it in Settings, Posts, or remove Curately under Business integrations in your Facebook settings.
• Turn a forwarding rule off in your mail provider.
• Delete an item from its page.
• Ask for your account to be deleted, or for a copy of your data, at privacy@curately.co.

Contact

privacy@curately.co. When this page changes, the date at the top changes.