Effective Date: May 29, 2026

Welcome to Curbfind ("we", "us", or "our"). We are committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your personal data. It applies to all users of the Curbfind platform, whether you are located in North America, the European Economic Area (EEA), or elsewhere. By using our platform, you agree to the practices described in this policy.

1. Information We Collect

We collect only the information that is necessary to operate the Curbfind platform. This includes:

• Account information: Your username, email address, and encrypted password. If you sign in via Google, we receive your name and email from Google — we never receive your Google password.
• Profile information: An optional avatar (profile picture) that you may upload or select.
• Posted content: Photos you upload, item titles, and descriptions you attach to posts. The approximate location (latitude/longitude) of posted items is stored to display them on the map.
• Device location: Accessed when you actively post an item, use map features, or enable the "Automatic" location setting. When the "Automatic" setting is on, your last known location is saved and used to provide you with push notifications and emails about nearby items. We do not continuously track your whereabouts.
• Automatically collected data: Standard server logs including your IP address, browser type, operating system, referring URL, and pages visited. This data is used for security monitoring and platform diagnostics.
• Cookies and local storage: Session cookies to keep you logged in, and preference data (language, distance unit) stored locally in your browser.

2. How We Use Your Information

We use the information we collect solely for the following purposes:

• To create, manage, and authenticate your account.
• To display your posts (photos, item name, and fixed location coordinates) to other users on the platform.
• To show you items posted near your location when you use map and search features.
• To send you transactional emails such as account verification, password reset, and important service updates.
• To maintain platform security, prevent abuse and spam, and enforce our Terms of Use.
• To improve the platform through anonymized, aggregated analytics.

3. What Is Publicly Visible

Curbfind is a community platform. The following information is visible to all users and unauthenticated visitors:

• Your username and avatar (profile picture).
• Posts you create: the photo(s), item title, description, and the fixed location of the item on the map.

Note: Your email address, your real-time location, your account creation date, and any other account details are strictly private and are never displayed publicly. The location stored with your posts is the location of the item — not a reflection of your home address or ongoing whereabouts.

4. Location Data — Special Notice

Precise geolocation is considered sensitive personal information under applicable law (including the COPPA 2026 amendments, CCPA/CPRA, and Canada's PIPEDA). We treat it accordingly:

• We only access your device location when you explicitly grant permission and actively use a location-dependent feature (posting an item, viewing nearby items on the map).
• Your location is never tracked continuously. If you enable the "Automatic" location setting, your last known location is saved securely and used exclusively to provide you with push notifications and emails about nearby items.
• When you post an item, only the fixed coordinates of that item's location are stored. These coordinates represent the item's position — not your personal location profile.
• Your location data is never sold, rented, or shared with advertising networks or data brokers.
• You may revoke location access at any time via your browser or device settings. Revoking access will disable location-dependent features, but your account will remain fully functional.

5. Photos and User-Generated Content

When you upload a photo to Curbfind:

• Your photo is temporarily processed through Cloudflare Workers AI to suggest item names, and then uploaded to our servers and stored to be displayed with your post.
• Photos you upload are publicly visible as part of your posts. Do not include personal, sensitive, or identifiable information in your photos (such as faces, license plates, or personal documents).
• We strip EXIF metadata (including any GPS coordinates embedded in image files) from uploaded photos. The item's location is obtained separately from your device's geolocation API, not from photo metadata.
• You retain ownership of your photos. By uploading, you grant us a limited license to host and display them on the platform, as described in our Terms of Use. You may delete your posts — and the associated photos — at any time from your account settings.

6. Cookies and Tracking Technologies

We use the following types of cookies and storage mechanisms:

• Essential cookies: Required for login sessions and security. These cannot be disabled without breaking core platform functionality.
• Preference cookies: Store your language and distance unit settings. These can be cleared via your browser settings.
• Third-party cookies: Our analytics providers (Google Analytics, Sentry) and advertising partners (Google AdSense) may set cookies subject to their own privacy policies. You can manage your consent for these optional cookies at any time using the Cookie Preferences link in the footer.
• Security tools: We use Cloudflare Turnstile for bot protection. Cloudflare may process your IP address and browser fingerprint to assess whether a request is human. Cloudflare's privacy policy applies to this processing.

7. How We Share Your Information

We do not sell, rent, or trade your personal information. We share your data only in the following limited circumstances:

• Service providers: Trusted third-party vendors who help us operate the platform (e.g., cloud hosting, email delivery via Resend, image storage). These providers are contractually bound to process data only on our behalf and in accordance with our instructions.
• Legal requirements: If required by law, court order, or lawful government request, we may disclose information to comply with our legal obligations. We will notify you of such requests where legally permitted.
• Business transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you in advance and your rights will be preserved.
• Protection of rights: We may disclose information to protect the safety of our users, enforce our Terms of Use, or prevent fraud and abuse.

8. Data Retention

We retain your personal data only for as long as necessary:

• Account data (username, email, hashed password) is retained for as long as your account is active. You may delete your account at any time from your Settings page, which will permanently erase your account data and all associated posts.
• Posts and associated images are retained until deleted by you or removed by our moderation team.
• Server log data (IP addresses, access logs) is retained for up to 90 days for security purposes and then permanently deleted.
• Anonymized and aggregated data (e.g., usage statistics) may be retained indefinitely as it cannot be linked back to any individual.

9. Children's Privacy

Curbfind is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13, in compliance with the Children's Online Privacy Protection Act (COPPA) and applicable Canadian law. If we become aware that a child under 13 has created an account, we will promptly delete their account and all associated data. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@curbfind.ca.

10. Your Privacy Rights

Depending on your jurisdiction (including under the GDPR, CCPA/CPRA, and PIPEDA), you may have the following rights regarding your personal data. We honour these rights for all users regardless of location:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request that we correct inaccurate or incomplete information.
• Right to Deletion: Request that we delete your personal data. You can do this directly from your Settings page or by contacting us.
• Right to Withdraw Consent: Withdraw consent for any processing based on consent (e.g., location access) at any time. Withdrawal does not affect the lawfulness of prior processing.
• Right to Data Portability: Request a structured, machine-readable copy of your data.
• Right to Object / Opt-Out of Sale: We do not sell your data. You may opt out of any future targeted advertising at any time through your browser's cookie settings or by contacting us.

Note: To exercise any of these rights, please use your Settings page or contact us at support@curbfind.ca. We will respond to all requests within 30 days (or sooner where required by law).

11. Security

We implement industry-standard security measures to protect your personal information, including HTTPS encryption for all data in transit, hashed and salted password storage, access controls limiting staff access to personal data, and regular security reviews. No system is perfectly secure. If you believe your account has been compromised, please contact us immediately at support@curbfind.ca and change your password.

12. Third-Party Services

Our platform integrates with the following third-party services, each governed by their own privacy policies:

• Google Sign-In (OAuth 2.0): Used for optional account authentication. Google's Privacy Policy applies.
• Cloudflare Turnstile: Used for bot protection on forms. Cloudflare's Privacy Policy applies.
• Advertising partners: Third-party ad networks may display ads on the platform and set cookies. You can control ad tracking through your browser settings or by using an ad blocker.
• Cloud infrastructure: Our platform is hosted on cloud infrastructure providers. Data is stored within servers subject to appropriate data processing agreements.

13. International Data Transfers

Curbfind is operated from Canada. If you access the platform from the EEA or outside Canada, your information may be transferred to and processed in Canada or the US. We rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) or adequacy decisions, to ensure your data is protected when transferred internationally.

14. Do Not Track

Some browsers include a "Do Not Track" (DNT) feature that sends a signal to websites requesting that your browsing not be tracked. We honor DNT signals to the extent technically feasible. We do not cross-site track users for advertising purposes and we do not sell your personal data to third parties.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this page and, where reasonably practical, by sending you a notification via email or in-app notice. Your continued use of the platform after the updated effective date constitutes your acceptance of the revised policy. If you do not agree to the changes, you must stop using the platform and may delete your account.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us through the Help Center contact form or by email at support@curbfind.ca. We are committed to resolving privacy concerns promptly and will respond to all inquiries within 30 days.