1. Information We Collect
We collect information directly from you when you register, configure your profile, scan retail barcodes, record sensory ratings, and interact with the CuratedLists platform.
•Account & Authentication Data
We collect your email address and authentication session tokens via Supabase Auth. We utilize secure passwordless Magic Links and verified third-party OAuth providers (Google, GitHub). We never store raw passwords on our servers.
•Profile Data & Preferences
Information you voluntarily provide in your profile, including your chosen display name, unique @username handle, profile avatar image, tasting bio / curation philosophy, and profile visibility preference (is_public: boolean).
•User Content & Sensory Evaluations
Your custom contender rosters, rating modes (simple 0–5 / 0–10 or multi-axis criteria schemas), weightings, normalized radar coordinate benchmarks, subjective tasting notes, item placement in SABCD tier boards, and contender queues.
•Uploaded Media & Camera Hardware Access
Camera Access: When using the barcode scanner, we request temporary camera stream access. Barcode recognition is executed locally and client-side in your device browser using the Barcode Detection API. Video streams are never recorded, transmitted, or stored on our servers.
Packaging Imagery: Photos of product bottles, cans, bags, and packaging that you upload are optimized, WebP-compressed, and stored in our secure object storage.
•Technical & Edge Network Telemetry
Internet Protocol (IP) addresses, browser user-agent strings, country-level geographic coordinates, referring URLs, and edge cache hit/miss telemetry captured at the Cloudflare edge network for rate-limiting, edge revalidation, and DDoS defense.
2. How We Use Your Information
We use the data collected strictly for platform operations, community consensus modeling, and security:
1. Core Service Delivery & Benchmarking
Rendering your personal tier lists, calculating mathematical composite scores, plotting dynamic multi-axis SVG radar polygons, managing your tasting backlog, and generating dynamic social share preview cards (Open Graph images) when you share public rosters.
2. Shared Universal Product Catalog & Community Aggregation
Aggregating non-personal product imagery, verified UPC/EAN barcodes, producer information, and mathematical sensory score averages into our shared product graph. This enriches the edge barcode cache and powers community-wide consensus rankings and future B2B culinary metadata APIs.
3. Communications & Zero Ad-Network Policy
Sending transactional authentication emails (Magic Links) and critical service announcements.
3. Data Storage, Security & Subprocessors
CuratedLists runs on an enterprise-grade global edge runtime designed to minimize data latency and ensure high cryptographic security.
Authorized Infrastructure Subprocessors
Global Edge CDN, serverless edge compute runtime, SSL/TLS termination, DDoS mitigation, and edge header routing.
Relational database storage, Row-Level Security (RLS) enforcement, user authentication, and profile image storage.
Low-latency edge caching, API rate limiting, privacy fallback caching, and ephemeral session state synchronization.
External public catalog fallback queried anonymously when a scanned barcode is not yet indexed in our local database.
Database Row-Level Security (RLS)
Every query executed against our primary database is protected by granular PostgreSQL Row-Level Security policies. Users can only modify rows belonging to their verified auth.uid(), and private rosters are cryptographically restricted from unauthenticated or non-owner access.
4. Privacy Controls: Private Profiles & Rosters
We built CuratedLists with privacy-by-design, allowing you to choose whether your taste profile is a public publication or a private journal:
Private Profile Toggle
Located in Account Settings. When enabled, your user profile, vanity route (/@username), and all associated rosters are strictly hidden from external visitors, community listings, and search engines. Direct visits receive a private profile notice.
Public Profile & Shareable Slugs
When your profile is set to Public, your public rosters become discoverable across the community index, and visitors can interactively inspect your multi-axis radar profiles.
5. Data Access, Portability & Deletion Rights
You maintain complete authority over your personal identity and stored data:
- Access & Rectification: You may review and modify your display name, username, bio, and profile photo at any time directly through Profile Settings.
- Data Deletion: You have the right to request deletion of your account and personal data. Upon processing an account deletion request, your authentication credentials, personal profile, and subjective evaluation notes will be permanently removed.
- Persistence of Anonymized Catalog Data: In accordance with our Terms of Service, universal product barcode mappings and non-personal packaging photos contributed to the shared catalog persist indefinitely to prevent breaking product references for fellow community members.
7. GDPR & CCPA/CPRA Compliance Disclosures
Regardless of your physical location, CuratedLists extends comprehensive data protection rights consistent with global regulations:
European Economic Area (GDPR)
If you reside in the EU/EEA, our legal basis for collecting personal data includes performing our contractual agreement with you (providing the Platform), our legitimate interest in securing and improving our services, and your consent. You have the right to lodge a complaint with your local supervisory authority.
California Residents (CCPA/CPRA)
Under the California Consumer Privacy Act and CPRA, California consumers have the right to request disclosure of personal information collected, request deletion, and opt-out of the sale or sharing of personal data. As stated herein, CuratedLists does not sell or share personal information for cross-context behavioral advertising.
8. Children's Privacy Protection
CuratedLists is not directed to children under the age of thirteen (13), and we do not knowingly collect personal information from children. If we become aware that personal information has been gathered from a child under 13 without verifiable parental consent, we will take immediate measures to delete that data from our servers.
9. Changes to This Privacy Policy
We may periodically update this Privacy Policy to reflect changes in our data practices, regulatory requirements, or edge features. When modifications occur, we will update the "Last Updated" date at the top of this document. Continued use of the platform after an update signifies your acceptance of the revised policy.
10. Privacy Officer & Contact Information
If you have questions, feedback, or would like to exercise any of your statutory data protection rights, please contact our support team at:
Want to learn more about content ownership and licensing?
Review our complete Terms of Service for user-contributed content rights and platform rules.