Effective Date: September 3, 2026 · Merchant of Record: Dodo Payments, Inc.
Curtly ("Curtly," "we," "us," or "our") respects your privacy and is committed to protecting it through this Privacy Policy ("Policy"). This Policy describes the categories of information we collect when you access or use curtly.dev, the Curtly API, and related services (collectively, the "Service"), how we use and disclose that information, and the choices and rights available to you. This Policy is incorporated by reference into, and should be read together with, our Terms of Service.
Curtly is engineered as an in-memory, streaming compression pipeline. This is not merely a policy commitment; it is a foundational architectural design choice that materially limits the data Curtly is capable of retaining.
We do NOT store, log, retain, index, or inspect the substantive content of your prompts, source code, system instructions, compressed outputs, or any other payload submitted to the Compression Engine on persistent storage. Once a compression request has been processed and the resulting output has been returned to you over the API response, the payload is discarded from working memory and is not written to disk, database, backup, or any other durable medium.
Because we do not retain the content of your submissions, your prompts, code, and other Customer Content are never used, and cannot be used, to train, fine-tune, evaluate, or otherwise improve any artificial intelligence or machine learning model, whether operated by Curtly or by any third party.
Limited transient exceptions to this architecture are described in Section 3.3 (Technical Metadata) below, and are strictly limited to operational necessity such as abuse prevention and rate-limiting; even these transient records do not include the substantive content of your payloads.
All billing, checkout operations, invoicing, and payment transactions in connection with paid subscriptions and usage credits for the Service are processed securely by our Merchant of Record, Dodo Payments, Inc. ("Dodo Payments"). Dodo Payments' handling of your payment information is governed by Dodo Payments' own privacy policy, available at dodopayments.com/privacy, which we encourage you to review.
No card data touches Curtly's systems. Curtly never stores, receives, transmits, or has access to your full credit card number, card verification value (CVV), or bank account credentials. Payment instrument details are transmitted directly between your device and Dodo Payments' infrastructure.
PCI-DSS compliant processing. Payment details are handled by Dodo Payments' PCI-DSS Level 1 compliant payment infrastructure, the highest level of certification available in the payment card industry.
Purpose of billing data. Dodo Payments collects customer billing information (such as your email address, billing name, and billing country or postal code) strictly for the purposes of invoice generation, fraud prevention, chargeback administration, and tax calculation and remittance across 190+ jurisdictions.
Curtly receives limited transaction metadata from Dodo Payments (such as subscription tier, transaction status, payment ID, and billing-cycle dates) that is necessary to provision and manage your Curtly account, but does not receive your full payment card details at any point in this flow.
Because of our zero-storage architecture, the information Curtly collects and retains is deliberately minimal and limited to what is operationally necessary to provide, secure, and bill for the Service.
Your email address, provided at registration and used for account authentication, service-related communications, and billing coordination with Dodo Payments.
A cryptographically hashed representation of your API credentials. Curtly does not store API keys or passwords in plaintext.
Your selected subscription tier and account preferences.
To calculate quota consumption, enforce rate limits, and power your savings and analytics dashboard, we collect aggregated, non-substantive usage metrics, including:
input token counts and output token counts processed per request;
request latency, measured in milliseconds;
HTTP status codes returned by the API; and
request timestamps.
This telemetry consists exclusively of numerical and categorical metadata about a request. It does not include, and cannot be reconstructed into, the substantive content of the prompt, code, or payload that generated it.
We collect your IP address and user-agent string for the limited purposes of rate-limiting, fraud prevention, and distributed denial-of-service (DDoS) mitigation. This information is held temporarily in edge cache for operational security purposes and is not combined with the substantive content of your requests, which, consistent with Section 1 above, we do not retain in the first instance.
If you contact our support team, participate in a survey, or otherwise communicate with us directly, we collect the information you choose to provide in that communication, which we use solely to respond to your inquiry and improve the Service.
We use the limited categories of information described in Section 3 for the following purposes:
to create, authenticate, and administer your account;
to provide, maintain, secure, and improve the operational aspects of the Service (excluding any use of prompt or payload content, which we do not retain);
to calculate and enforce usage quotas and rate limits associated with your subscription tier;
to detect, investigate, and prevent fraud, abuse, and security incidents;
to communicate with you regarding your account, service updates, and policy changes; and
to comply with applicable legal obligations.
We do not use any information we collect for interest-based advertising, and we do not sell information to data brokers or advertising networks.
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share information only with service providers that are essential to delivering the Service, and only to the extent necessary for them to perform their function, subject to appropriate contractual safeguards:
Dodo Payments, Inc. - acting as Merchant of Record for billing, invoicing, tax administration, and subscription management, as described in Section 2.
Cloud infrastructure and security providers (such as Vercel, Amazon Web Services, and Cloudflare) - for edge compute, hosting, and DDoS protection supporting the Service's technical infrastructure.
We may also disclose information where required to do so by law, subpoena, or other legal process, or where we believe in good faith that disclosure is reasonably necessary to protect the rights, property, or safety of Curtly, our users, or the public, or to detect, prevent, or address fraud, security, or technical issues.
In the event of a merger, acquisition, financing, or sale of all or substantially all of Curtly's assets, information may be transferred as part of that transaction, subject to the acquiring entity's commitment to honor the terms of this Policy with respect to previously collected information.
Curtly and its infrastructure providers may process and store information in countries other than your country of residence, including the United States. Where we transfer personal information originating from the European Economic Area, United Kingdom, or Switzerland to such countries, we rely on appropriate safeguards recognized under applicable data protection law, including the European Commission's Standard Contractual Clauses, to the extent applicable to the limited categories of information described in Section 3.
Consistent with our zero-storage architecture, we do not retain the substantive content of your prompts or payloads beyond the duration of the in-memory processing operation. Account data described in Section 3.1 is retained for as long as your account remains active, and for a reasonable period thereafter to comply with legal, tax, and accounting obligations, or to resolve disputes. Aggregated usage telemetry described in Section 3.2 may be retained in de-identified or aggregated form for analytical and product-improvement purposes.
We implement administrative, technical, and organizational safeguards designed to protect the limited information we collect against unauthorized access, disclosure, alteration, and destruction, including encryption of data in transit, hashed storage of credentials, and restricted internal access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
For purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the data controller in respect of the limited categories of personal data described in Section 3 is the individual operator of Curtly (the "Operator"), who is resident in the European Union and reachable at privacy@curtly.dev. Curtly does not currently publish the Operator's name and postal address in this Policy; if you require this information for the purpose of exercising a right under this Section 9 or corresponding with your local data protection supervisory authority, you may request it by contacting privacy@curtly.dev, and it will be provided to the supervisory authority upon a valid request.
If you are located in the European Economic Area, United Kingdom, or another jurisdiction that grants comparable statutory rights, you have the right to:
request access to, and a copy of, the personal data we hold about you;
request correction of inaccurate or incomplete personal data;
request deletion of your account and associated usage telemetry, subject to legal retention requirements;
request restriction of, or object to, certain processing of your personal data;
receive your personal data in a structured, commonly used, machine-readable format (data portability); and
withdraw consent, or otherwise terminate your account, at any time, without affecting the lawfulness of processing conducted prior to withdrawal.
To exercise any of these rights, please contact our Data Protection desk at privacy@curtly.dev. We will respond to verified requests within the timeframe required by applicable law. If you believe we have not adequately addressed your request, you have the right to lodge a complaint with your local data protection supervisory authority.
Depending on your state of residence, you may have additional rights under U.S. state privacy laws, including the right to know what personal information we have collected about you, the right to request deletion of that information, and the right to non-discrimination for exercising your privacy rights. Because Curtly does not sell personal information and does not use it for targeted advertising, many state-law opt-out rights (such as the right to opt out of sale) are not applicable to our data practices. You may exercise any available rights by contacting privacy@curtly.dev.
The Service is not directed to, and is not intended for use by, individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take reasonable steps to delete such information promptly.
We may update this Policy from time to time to reflect changes in our practices, technology, or applicable legal requirements. Where changes are material, we will provide notice by email, in-product notification, or by posting a notice on curtly.dev at least fourteen (14) days prior to the change taking effect. The "Effective Date" at the top of this Policy indicates when it was last revised.
For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection desk at:
Email: privacy@curtly.dev
General Support: support@curtly.dev
Website: https://curtly.dev