Kurate is run by Kurate LLC, Ridgewood, New Jersey. We collect as little as we can and we never sell it. The people you save in the gift finder stay on your own device; if you make an account, your details and lists are kept with it, private to you unless you share a list or connect with someone. Questions go to our contact page or inquire@kurateyourself.com. For help signing in or with your account, write to accounts@kurateyourself.com.
What stays on your device
The people you save in the gift finder (their names, dates, budgets and notes), your saved Kurations and your reminders are kept in your browser, or encrypted on your phone in the app, and we can’t see them. When you save a person, only the occasion and the relationship (such as “a birthday” and “a friend”) are sent to us, as an anonymous record, and only with your yes to the cookie note (in the app, with Analytics on): never the name, the date or anything else about them. Clearing your browser’s storage, or choosing “Delete all my data on this device” in the app’s Settings, removes them.
A pet you save under People stays in your browser in the same way: its name, whether it is a dog or a cat, its birthday (the month and the day, and the year if you give it), its life stage, size and weight, who it belongs to, a picture if you choose one, and whether you switched a reminder on. A picture is made small in your browser and is never uploaded. A reminder is shown on the page when you open Kurate: the website does not send emails or texts, and removing the pet takes its reminder with it.
The same goes for a KurateKids registry you try out in the planner without an account (saving one, or sharing it with family, needs an account: below). When the gift finder sends a brief across to KurateKids, or a sentence typed on the home page across to the gift finder, it travels inside your browser, not through us. A registry’s print-and-send link carries only the products’ codes, nothing about you or the family.
With your yes to the cookie note (below), the gift finder also learns, in your browser, a taste for each person you shop for: the styles and kinds of gift you saved or asked for while choosing for them, so their next shortlist starts closer to what suits them. It is kept apart for each person (someone you saved under People, or the person a brief describes, such as your sister), and a new person starts with none. It is never sent to us as a profile; it only nudges the choices sent with your next request for that person. Clearing this site’s data in your browser clears all of it. So does choosing Decline. Without a yes it learns only for the visit, in the page’s memory, and forgets it when you leave.
An account is the exception: what you keep with it is kept by Kurate, below. When a list for a baby, a pregnancy or a child’s occasion is started on Kurate, what you typed is handed to KurateKids inside your browser (in its session storage) and removed as soon as the KurateKids form has read it. When you keep gifts from the gift finder in a list and sign in first, the gifts you ticked (their names, makers and prices) and the list’s occasion wait in the same place for at most half an hour, and are removed once the panel has read them; the list itself is then kept with your account.
What we collect, and why
If you join the waitlist: your email address, your optional answer to “Who’s hardest to shop for?”, and the link or campaign that brought you (the campaign tags in that link, the page that referred you, and the page you landed on). We use it to write to you about Kurate. In the app, the waitlist is optional and one field. The first time an address joins, we send it one email from the Kurate team to say it’s on the list. Its logo travels inside the email, so nothing in it loads from our site and we can’t tell whether it’s opened. Every waitlist email has an Unsubscribe button, and your mail app’s own Unsubscribe works too: either takes the address off the list at once, with no account or password. To stop misuse we count how many go to one visitor (at most 3 a day) and to everyone together (at most 300 a day), using a scrambled form of the IP address that expires within the day; past that, no email goes, and you’re on the list all the same.
If you write to us through the contact page or the data request page: your name, email address, the topic and your message, so we can reply.
When you use the gift finder: the choices behind each shortlist (on the website, whether on Kurate or KurateKids; who it’s for, as a relationship; the occasion and date; the budget, or that you gave none; interests and taste; categories and words to leave out; whose wardrobe, or for a child a girl or a boy when you say; which makers to favour; and, for a child or a teenager, an age range: the exact age you type is used to choose the gifts and is not recorded), the picks and how they scored, and what you save, turn down or open at a retailer; and, about the search itself, that it began (on Kurate or KurateKids, and whether from a sentence, the three taps, the home page or a link to an occasion) and, if it failed, a one-word reason (such as “network”). The words the finder picks out of a sentence (such as “pottery” or “matcha”) are used to answer that request; only how many there were is recorded, and which gifts you have already been shown is kept only for that visit so they aren’t repeated. These records never include the recipient’s name, your email, or the sentence you typed. When the finder doesn’t recognise a word, that single word may be kept (up to twelve per shortlist) so the finder can learn it, with a count of how many words it didn’t recognise. A random code links the records from one visit; on the website it is kept in your browser, for that tab only, and in the app it is new each time the app opens. On the website, none of this is recorded unless you choose Accept in the cookie note (below): without it, your choices are used to answer each request and nothing about your visit is kept. In the app, none of this is sent unless you switch Analytics on, and you can switch it off at any time in Settings.
A religion, a heritage or a food rule you mention about someone (“my Muslim friend”, “my Indian mother-in-law”) is read in your browser so the finder does not make a mistake, and goes no further: it is never sent to us, recorded, or used to choose or leave out a gift. If you ask for a thing (a hijab, a Bible, a menorah) or a day (Eid, Hanukkah, Diwali), that word is sent like any other word you ask for, to answer the request, and only how many words there were is recorded. “Kosher” and “halal” are not sent: they leave food and drink out, as if you had chosen “no food”, and the note saying so stays in your browser.
When you shop for a pet in the gift finder: only whether it is a dog or a cat and, if you gave them, its life stage and its size are sent and recorded, with the occasion (a birthday, or a new pet) and the budget. Its name is sent once, to be written into the letter, and is never stored, like a person’s. Its birthday, its weight and its picture are not sent, and a pet’s date is not recorded.
When you build a registry or search in KurateKids: your choices (the tone, taste, essentials and any words you search for) are sent to answer that request and are not stored or logged. The site guide’s answers are written into the page: what you type into it never leaves your browser.
KurateKids registries: you can try the planner without an account, but saving a registry or sharing it with family and friends needs one, and so does opening a registry someone shares with you. We keep the registry with your account: the names you choose to show (for example “Amira and Sam”), your optional note and due date, the budget level and the list of products, so your guests can see it. Only you, signed in, can change it or stop sharing it. When a guest marks “I bought this”, we keep which product and a one-way code made from the guest’s account, so only that account can undo it: never the guest’s name, email or anything else about them. You see which pieces are bought, never by whom. Only people who have the link and are signed in can see the registry; it is not listed in search engines. A registry shared before an account was needed is kept as it was saved: the names, note, due date, budget level and products, a scrambled form of the code its family’s browser made (so the family can still stop sharing it from that browser) and its guests’ scrambled “bought” codes. It stays just as it was: nobody can change it any more, signed-in guests can still open it and mark what they buy, and it ends 18 months after it was shared, unless its family stops sharing it sooner.
When you open a gift at a retailer: a record of the click, with a random code, which product and brand, where on Kurate it was (the gift finder, a Kuration, the home page’s example, a shared list or registry, or KurateKids’ other pages, recorded as “kids”: KurateKids is for gifts for little ones, and its visitors are adults) and whether it was a paid link. It holds no IP address, name, email or anything you chose or typed, and it isn’t linked to your gift finder records. We use it to count the visits Kurate sends each brand, and the visits through paid links. It holds nothing about you, so it is kept whatever you answer in the cookie note. Nothing is recorded when your browser sends Global Privacy Control, or in the app when Analytics is off.
Page visits: only with your yes to the cookie note, the website counts visits with Vercel Web Analytics, which sets no cookie, and your browser remembers for 30 days which link first brought you to Kurate, sending it only if you join the waitlist. Without a yes, joining the waitlist sends only how you arrived on that visit (its campaign tags, the site that sent you and the page you landed on), and nothing is kept in your browser.
Seasonal openings: only with your yes, when the site is dressed for a season (at Christmas, the home page arrives wrapped and unties itself once), your browser keeps a note of the season whose opening it has shown, so it plays only once; the note stays in your browser and is never sent to us. Kurate’s name on ivory, shown once on a first visit, is kept the same way. Without a yes, neither plays.
Keeping the service safe: our host and database keep short-lived technical logs (such as IP address and browser type). To stop abuse, we count requests per visitor using a scrambled (hashed) form of the IP address that expires within the hour.
If you make an account
What it keeps, and why: your email address, a random account number, and when the account was made, confirmed and last signed in to, to sign you in and send you codes; your password, which nobody can read (our sign-in service, Supabase Auth, keeps only a one-way scrambled form of it, and Kurate never stores, logs or shows it); your first and last name, to know whose account it is; your date of birth, because accounts are for adults and anyone under 18 is refused; and, only if you give them, a phone number and a shipping address, kept for you and used for nothing yet. It also keeps the name people see and an optional line about you, which version of the Terms you agreed to and when, records of signing in and out, and your lists and wishes: pieces from the brand book, links from other shops (with the shop’s name), wishes in your own words, and the details you give each one.
Codes: a six-digit code is emailed only to confirm your address when you make an account, to reset a forgotten password, and to confirm a change of address (one code to your current address and one to the new one). A code works once, for 15 minutes. What you type when you sign up is saved only once the code confirms your address.
The week-ahead reminder: when you switch on “Email me a week before” for someone saved in People, we keep with your account their name as you saved it, their day, and the choices behind their shortlist (who they are to you, as a relationship; the occasion; the budget, or that you gave none; interests and taste; categories and words to leave out; the words the finder picked out for them, such as “pottery”; whose wardrobe; and, for a child or a teenager, an age range), never a sentence you typed or an exact age. On the morning a week before their day (or the next morning, when the day is nearer) we send you one email from the Kurate team with five gifts chosen that morning, and the day after their day all of it is deleted. Switch it off or remove the person and it is deleted at once. Every reminder email has an Unsubscribe button, and your mail app’s own Unsubscribe works too: either switches off every reminder for your address and deletes what they kept, with no password.
Only you can see your details, and your lists unless you share one. Nobody at Kurate looks at them, and they are never used to choose gifts, for advertising, or shared with brands. A link you add from another shop is never opened by Kurate, and no picture is loaded from it. Once a week we count the shops people add links from, by each shop’s web address alone and only for a shop five or more accounts have used, so we can look at those makers for the brand book; the count never holds the link, the gift or who added it. Your IP address and browser are not stored with your account. To stop abuse, we count sign-in attempts, failed passwords, sign-ups, code requests and downloads per visitor and per email address, using scrambled forms of both; the counts expire within the hour, and failed passwords for one address within two days at most.
If you share a list: you can share it by its link, with people you choose (below), or both. Whoever opens it must be signed in to a Kurate account, and sees only the name you chose for people to see, the list’s title, its note and date (with the time left until it), and the gifts you still want, with their details and how many are taken. Never your email address, your other details, your other lists, what you already have, or who else can see it. Anyone who has the link and an account can open the list, and you aren’t told who opened it. A gift-planning list can never be shared. A shared list is not listed in search engines, and no shop is told its link. “Stop sharing” switches the link off at once; sharing again makes a new link.
“I’m getting this”: a friend, signed in, can mark a gift so nobody buys it twice. We keep which gift was marked, when, and a one-way code made from the friend’s account, the same whether they opened the list by its link or as someone you chose, so only that account can undo the mark, and it follows them to their other devices: never the friend’s name, email or anything else about them. One account can mark at most 20 gifts on one list. Nobody is shown who marked what: your own pages never show what friends have chosen, and opening your own link takes you to your own list; friends see which gifts are taken, never by whom. Someone with full access to our database could connect a mark to the friend’s account. Marks made before an account was needed keep the scrambled browser code they were made with. Marks stay with the gift until it, its list or your account is deleted, even if the friend deletes their own account; stopping and sharing again keeps them, so nobody doubles up, unless you choose “Also clear what friends have marked” when you stop sharing (you are not told what was marked).
People: you can invite someone to connect with you on Kurate, by a link you send yourself. When they accept, you follow each other. We keep who follows whom and since when, requests to follow back that are waiting for an answer (90 days at most; a declined one is removed after 30 days), which lists you share with which people, and who you have blocked. The people you’re connected with see only the name you chose for people to see and the lists you choose to share with them: never your email address, your details, your other lists, or who else you know. Following never opens a list. There is no directory of everyone, and nobody can look you up. Blocking someone ends following both ways, means neither of you can accept the other’s invitations, and closes all your lists and registries to them, and theirs to you, even through a link they already have; they aren’t told. A list or registry you shared by link stays open to anyone else who has the link and an account until you stop sharing it or it gets a new link; someone who only has the link can’t be blocked. To stop misuse, we count the invitation links each account makes and its requests to follow back, using scrambled forms that expire within a day.
Invitations: an invitation is a random link that works once and ends after 14 days. Whoever has it sees only the inviter’s chosen name, the day it was sent and the day it ends, and can accept it once, so send it only to the person you mean it for. We keep a scrambled form of the link, who sent it, whether it went by email or as a link, and whether, when and by whom it was answered, and delete it 30 days after it ends. The person who invited you sees the name you chose for people to see once you accept. They never see your email address, and they aren’t told whether you declined or simply let it end. Opening an invitation, or signing in from it, never accepts it for you.
No more invitations: Kurate sends no invitation emails just now, but the link at the foot of one sent before still stops invitations from Kurate to that address, from anyone. It needs no account, opens nothing, and nobody is told. To keep to it we store only a scrambled form of the address, which can’t be turned back into it, until invitations are allowed again from the same link. Deleting an account doesn’t undo it.
Cookies: an account uses four, set only by the account pages, unreadable by the page’s scripts and sent only over encrypted connections. One keeps you signed in: with “Remember me on this device” ticked it lasts 30 days and is renewed while you use your account; unticked, your browser forgets it when it closes, and the site ends it after 12 hours in any case. It is signed with a key only Kurate’s server holds, so it can’t be changed in the browser. Two others, each kept for up to 15 minutes, remember the address a code was sent to while you sign up or reset a password, on Kurate or on KurateKids, with what you typed on the sign-up form until the code confirms it. The last, on Your profile for up to 15 minutes, remembers a new address while its two codes are typed.
What we don’t do
We don’t sell or share personal information or show advertising, and Kurate doesn’t follow you across other companies’ apps and websites (a shop, or the network it uses, may set its own cookie on its own site after you click: below). The app has no advertising or tracking software, doesn’t use device identifiers, and never asks for your contacts or location.
Retailers and links
Kurate recommends; it doesn’t sell. When you open a gift, you go to the retailer’s own site, where their privacy policy applies. Every link to a retailer says it came from Kurate (utm_source=kurate), so the retailer can count visits from Kurate. Some links in the gift finder and our Kurations are paid links: a page that shows one says so once, in a line above its gifts. If you buy, the retailer (or the network it uses) may know you came from Kurate, and may set its own cookie after the click to credit the sale to Kurate. Apart from that tag, the only things Kurate adds to a link are the random click code above and, on an Awin link, Awin’s consent flag (below), never anything about you or who the gift is for. This never changes which gifts Kurate picks.
Cookies and your choice
Every visitor is asked once, in a small note at the foot of the screen: Accept or Decline. Kurate keeps only what it needs to work unless you say yes, and your answer never changes the gifts we suggest. To change your mind, use “Cookie choices” at the very bottom of every page, or here:
| What | Where, and for how long |
|---|---|
| Your answer to the cookie note (“kurate_choice”: only the note’s version, your answer and the day) | A cookie, for six months |
| Your sign-in, when you have an account | The account’s cookies, described above |
| The key the password page gives, while the site is private before it opens | A cookie, for seven days |
| The people, Kurations and registries you save, and the codes that let you change what you share or undo a mark | Your browser, until you remove them |
| A brief or a sentence handed from one page to the next | Your browser’s tab, for a few minutes |
| What | Where, and for how long |
|---|---|
| Counting visits (Vercel Web Analytics) | No cookie: the pages you view are counted |
| The gift finder’s visit code, which links the records from one visit | Your browser’s tab, until you close it |
| The gifts you lean towards (a taste for each person you shop for) | Your browser, until you clear it or choose Decline |
| The link that first brought you to Kurate | Your browser, for 30 days |
| Whether Kurate’s name on ivory and a season’s opening have been shown, so each plays once | Your browser, until you clear it or choose Decline |
Accept turns these on. Decline keeps them off and removes any your browser already holds. Until you answer, nothing optional runs, and the gift finder remembers your taste only for the visit, in the page’s memory. Your answer is kept for six months; then we ask again, and sooner if the note’s words change.
Global Privacy Control: if your browser sends it and you haven’t answered, we start on Decline, and the note says so. You can still choose Accept.
Shop links work the same either way. Kurate adds nothing about you to a link. After you click, a shop, or the partner network it uses (such as Awin, Impact, Skimlinks or Shopify Collabs), may set its own cookie on its own site, under its own privacy policy, to credit a sale to Kurate. For Awin links, when you are in the UK or the European Economic Area and haven’t accepted (you declined, your browser sends Global Privacy Control, or you haven’t answered yet), the link tells Awin that you have not agreed to its cookies; when you have accepted, it tells Awin you have. Your country is worked out from your connection for that click only, and is never stored.
Pictures of gifts load from the brands’ own websites, which receive your browser’s request for each picture, as any website does.
Who handles it for us
Supabase (our database) and Vercel (our hosting and page-visit counts) store and process this information on our instructions. They may not use it for their own purposes. Resend delivers the one email when you join the waitlist, with your email address and nothing else about you.
Accounts: Supabase also signs you in, keeps your scrambled password and sends the code emails. Resend may deliver those emails, so it handles your email address and the message. It also delivers the week-ahead reminders you switch on, with your email address, the person’s name and day, and the five gifts.
Brands that partner with Kurate: a brand that pays Kurate does so through Stripe, which handles its card or bank details; Kurate never sees them and keeps only the payment’s status, amount and dates. We send partners a monthly report by email through Resend, to the address they give us, and stop whenever they ask. None of this involves shoppers.
How long we keep it
- Waitlist sign-ups: until you unsubscribe or ask us to remove you.
- Messages and data requests: up to two years after we reply, so we have a record of what was asked and done.
- Gift finder records and click records: 24 months. Every day, a tidy-up deletes any that are older.
- A KurateKids registry kept with your account, and its “bought” marks: until you delete the registry or your account, and no longer than 18 months after you save it.
- A KurateKids registry shared before an account was needed, and its “bought” marks: until its family stops sharing it, and no longer than 18 months after it was shared.
- Technical logs: as long as our host and database keep them, usually days to weeks.
- An account, its details and its lists: until you delete them, all at once, from Your profile.
- A shared list’s link: until you stop sharing it, or delete the list. Friends’ “I’m getting this” marks: until the gift, its list or the account is deleted.
- A week-ahead reminder: until the day after the person’s day, or until you switch it off, remove the person or unsubscribe.
- Invitations: while waiting, then 30 days after they end.
- Who you follow, who follows you, who can see each of your lists and the people you block: until you change them, or either account is deleted. A request to follow back: until it is answered, and 90 days at most; a declined one, 30 days.
- An address that asked for no more invitations: only its scrambled form, until invitations to it are allowed again.
Your choices and rights
You can ask to see the personal information we hold about you, get a copy of it, correct it, delete it, or stop us using it, including stopping emails. Use the data request page. We’ll reply within 45 days, and we may ask you to confirm the email address first. Every waitlist email includes a way to unsubscribe. The codes we send are about your own account and go only to you. Gift finder records carry no name or email, so we can’t tell which ones are yours. They are removed on the schedule above.
We honour Global Privacy Control. If your browser sends it, the website records nothing about your use of the gift finder, and until you answer the cookie note it starts on Decline.
If you have an account, Your profile lets you change your name and details, your email and your password, download a copy of everything, and delete your account and every list in it at once. On People you can see and change who you follow and who follows you, and unblock anyone you blocked.
Children
Kurate, KurateKids included, is for adults choosing gifts. It isn’t directed to children, and we don’t knowingly collect personal information from anyone under 13. When you shop for a child, the gift finder records only an age range, never the child’s name or birthday; any name you give stays on your device. A registry you keep with your account holds only the names, note and due date you type for your guests; please don’t put a child’s full name or birthday in them.
Accounts are for adults, 18 or older; the sign-up asks for your date of birth to check. A list on KurateKids is about a little one but belongs to an adult; please don’t put a child’s full name or birthday in a list, its note or a wish, especially in a list you share. Opening a list or a registry someone shares needs an account, so it is for adults too. People and invitations are for adults as well: please don’t send an invitation to a child, who can’t make an account and so can’t accept it.
Security
Everything travels over encrypted connections. Access to what we store is limited to Kurate. In the app, what you keep on your phone is encrypted with a key held by your phone’s secure storage.
Changes
If this page changes, we’ll update the date at the top. If a change affects how we use information we already hold, we’ll say so on the site and, if you’re on the waitlist, by email.