Privacy policy
This policy explains what personal data Curibo collects, why we need it, how long we keep it and what rights you have over it.
Last updated: 26 September 2026
Data controller
The controller responsible for the personal data described on this page is:
What we collect and why
We only collect what a feature actually needs. Each purpose below has its own legal basis under the GDPR.
Parent or professional account
- Data
- Email address, password, account plan and creation date
- Purpose
- Creating your account, signing you in and giving access to the features you subscribed to. Your password is handled by Firebase Authentication and never reaches our servers.
- Legal basis
- Performance of a contract (Art. 6(1)(b))
Child profiles
- Data
- Child's name or nickname, birth year, chosen avatar
- Purpose
- Telling profiles apart and selecting age-appropriate content. You may use a nickname instead of a real name.
- Legal basis
- Performance of a contract (Art. 6(1)(b))
Learning activity
- Data
- Games and activities completed, dates, time spent, scores, the child's own difficulty rating, error counts and level progress
- Purpose
- Showing the progress dashboard in your account so you can follow how your child is doing.
- Legal basis
- Performance of a contract (Art. 6(1)(b))
Subscription and payments
- Data
- Stripe customer and subscription identifiers, plan, status, billing period and cancellation dates, invoice amounts and links, and your card's brand, last four digits and expiry date
- Purpose
- Taking payment, managing your subscription and issuing invoices. Full card numbers are handled by Stripe and never reach our servers.
- Legal basis
- Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c))
Contact enquiries
- Data
- Name, email address, organisation, enquiry type and your message
- Purpose
- Answering the question you sent us. We do not use these details for marketing.
- Legal basis
- Legitimate interests (Art. 6(1)(f)) — responding to an enquiry you sent us
Abuse prevention
- Data
- A one-way hash of your IP address, and a count of recent submissions
- Purpose
- Preventing the contact form from being flooded. The address is hashed with a secret key before it is stored, so the stored value cannot be turned back into your IP address.
- Legal basis
- Legitimate interests (Art. 6(1)(f)) — keeping the service available
Website analytics
- Data
- Only if you allow analytics cookies: approximate location derived from IP address, device and browser type, and which pages you visit and for how long — no advertising identifiers
- Purpose
- Understanding how visitors use the website, shown to us only as aggregated statistics, so we can improve it.
- Legal basis
- Consent (Art. 6(1)(a)) — given in the cookie notice and withdrawable at any time on the cookie policy page
Who else handles your data
We do not sell personal data and we never share it for advertising. We use these service providers, who process data only on our instructions:
Accounts, data storage and website hosting
Aggregated website usage analytics
Playing social story videos when you press a story
Payment processing, card data and invoices
Delivering contact enquiry notifications by email
These providers may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's standard contractual clauses or an equivalent safeguard.
How long we keep it
We keep personal data only as long as the purpose it was collected for requires.
Until you ask us to delete your account
For as long as the child profile exists
10 years, as required by accounting law
12 months after we receive it
1 hour, deleted automatically
Your rights
Under the GDPR you can exercise the following rights at any time. Write to us and we will respond within one month.
- Access — obtain a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted where there is no overriding reason to keep it.
- Restriction — ask us to pause processing while a concern is resolved.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing we base on legitimate interests.
- Withdraw consent — where we rely on your consent (website analytics), withdraw it at any time on the cookie policy page. This doesn't affect processing before you withdrew.
If you believe we have handled your data incorrectly, you may also complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, Vilnius, vdai.lrv.lt.
Children's data
Curibo is designed for a child to use with a parent, guardian or specialist. Children do not create accounts, sign in or enter personal data themselves — the adult who holds the account decides what is entered about a child and can change or delete it at any time. We do not profile children for advertising and we do not show them ads.
How we protect your data
Data is stored in Google Cloud Firestore with access limited to the account holder. Sessions use signed, httpOnly cookies sent only over an encrypted connection. Passwords are managed by Firebase Authentication and are never visible to us.
Deleting your account
To delete your account and everything stored under it, write to us at the address above and we will complete the request within one month.
Changes to this policy
If we change how we handle personal data we will update this page and change the date at the top. If a change is significant, we will notify account holders by email.
For details of cookies and browser storage, see our cookie policy.
Have a question about your data? Contact us