Curbi terms and privacy

Privacy notice

Privacy owner: Johnathan Valencia, Curbi, Inc. Privacy questions and data requests go to the contact below.

Curbi, Inc. operates these public developer tools. Browser-only checks and offline verification process your pasted text locally. The API tester and remote MCP send the requests you choose to Curbi for processing. Saving a private project requires a developer account and stores that project in our existing Supabase project under account access controls.

Hosting and security providers process network requests to deliver and protect the service. Optional product analytics is separate from account and security processing, and starts only after you choose “Allow analytics.” We do not use advertising trackers or sell analytics data. Contact hello@curbi.io for privacy questions and account-data requests.

Managed API checks retain per-key completed-check metadata: the verdict, finding count, completion time, request and result digests, and source version (SHA). Raw replies, policy files, full results and API keys are not included in these check records. This does not change existing API-key authentication or usage-accounting processing. The records are unsigned and do not establish authorization or provider completion. Capture begins at rollout; earlier checks may be absent. No retention duration is promised.

Cookies and optional usage counts

curbi_consent is a first-party cookie that remembers your choice for 180 days. It contains a version and either “essential” or “analytics”; it is not a visitor identifier. Sign-in and private-project storage remain separate from analytics.

If you allow analytics, we store totals by UTC date, public page and event type in Supabase: page view, selected tool-button click, download click and example-copy click. These count interactions, not unique people, successful repairs or proven outcomes. We do not store analytics event histories, IP addresses, user agents, email addresses, referrers, query strings, replies, policies, receipts or credentials in the usage table. Hosting providers may retain their own security logs.

The usage table keeps a rolling 90-day window, with older buckets removed on each accepted event. Counts are private to Curbi operators. There is no cross-site tracking or device fingerprint. Anonymous public counters can include automated traffic and are not audited business metrics.

Choose “Essential only” to keep optional analytics off, or use “Cookie choices” in any footer to change your choice at any time. Global Privacy Control and Do Not Track override analytics consent. Offline verification at /verify/ never sends analytics requests. Aggregate counts already recorded cannot identify a person for later removal.

Terms of service

Curbi, Inc. provides free local policy checks and offline receipt verification. The optional managed Check API costs $1 per 1,000 completed checked replies. Each reply in a batch counts separately. There is no setup charge or fixed monthly fee. Stripe uses a metered subscription to bill usage monthly. Applicable taxes and invoice adjustments may affect the final total.

Use Usage to inspect completed checks and lower your key’s monthly ceiling. Manage payment details and cancellation in the billing portal on the API access page. Charges for completed usage may still be billed after cancellation. Keep API keys private and use only data you are authorized to process.

Account notices

Curbi sends account messages such as email confirmation and password recovery when requested. Stripe handles billing notices for managed API access.

AI disclosure

Curbi applies configured rules to the inputs you provide without model inference in the checking path. A result describes those rules and records. It does not establish truth, grant execution authority or confirm provider completion. Production signing is off.

Refunds and billing questions

For an incorrect or disputed usage charge, email hello@curbi.io with the invoice reference. Do not include your API key or payment card details. Curbi will review the reported charge. Applicable statutory rights still apply.

Acceptable use

Use Curbi only for lawful purposes and with authority to process your inputs. Do not attempt unauthorized access, misuse credentials, evade usage limits or interfere with the service. Do not present a rule check as authorization or independent proof that an action happened.