Privacy Policy

01Introduction & Scope

Kura is a personal content-curation app that lets you save links and items from around the web — articles, videos, songs, podcasts, recipes, and more — into organized "Lists" displayed in a lean-back dashboard of scrollable rows. You can keep your Lists private, make them public, follow other users, and add notes and comments.

Kura is a service of Outer Peak Software LLC, a California limited liability company ("Outer Peak Software," "we," "us," or "our"). This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the rights and choices you have. It applies to the Kura mobile application (available on the Apple App Store) and the Kura website at https://kura.software, together with any related features and services (collectively, the "service").

By creating an account or otherwise using the service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the service. This Privacy Policy is incorporated into and supplements our Terms of Service.

If you have questions about this Policy or our privacy practices, you can reach us at outerpeaksoftware@gmail.com at any time. This contact address also serves as the point of contact for our data protection responsibilities and any EEA/UK representative inquiries described in Section 9.

02Information We Collect

We collect information in three ways: (a) information you provide directly, (b) information we generate or fetch as you use the service, and (c) information collected automatically about your device and usage. We do not require you to provide a traditional password — Kura uses passwordless sign-in only (see "Account & Profile Information" below).

2.1Account & Profile Information

When you create and use a Kura account, we collect:

• Authentication identifiers. Depending on how you sign in, we collect your phone number (when you use SMS one-time-code sign-in) and/or your email address (when you use "Continue with Google" or "Sign in with Apple"). Authentication is handled through Supabase Auth. Kura supports passwordless sign-in only — we do not create or store account passwords.
  • Phone + SMS one-time code: you provide your phone number and we send a one-time numeric code by SMS to verify it.
  • Continue with Google and Sign in with Apple: we use OAuth/OIDC to authenticate you through Google or Apple. We receive the basic profile information these providers return (such as your name and email address, or, where you choose Apple's "Hide My Email" relay, a private relay address). We do not receive your Google or Apple account password.
• Profile details. Your username, display name, avatar image, and an optional bio. Your username and any profile details you choose to display may be visible to other users, especially if you make Lists or your profile public (see Section 7).

2.2User Content & Link Metadata

The core of Kura is the content you save and organize. This includes:

• Saved links and items. The URLs/links and items you save (articles, videos, songs, podcasts, recipes, and similar content).
• Fetched link metadata. When you paste or save a URL, we fetch publicly available metadata from that third-party URL to generate a preview — typically the title, description, preview image, and source/platform. This fetch retrieves information that the destination website already publishes for link previews; we do not log in to, or access private areas of, the sites you save.
• Lists. The Lists you create to organize your saved items, including their names and any organization or arrangement you apply.
• Notes and comments. Any notes or comments you add to items, Lists, or in response to other users' public content.
• Social graph. Your follow relationships — the users you follow and, where applicable, who follows you.

Content and profiles you mark as public are visible to others, including non-users and search engines, as described in Section 7.

2.3Usage & Device / Diagnostic Data

When you use the service, we and our service providers automatically collect technical and usage information, including:

• App and version information (for example, the Kura app version or website build you are using).
• Device and operating-system data (device type, operating system and version, browser type on the web, language, and general configuration).
• IP address, approximate location derived from it (such as country or region), and network information.
• Interaction and usage data (for example, which screens or features you use, actions you take such as saving an item or following a user, and general usage patterns).
• Crash, error, and diagnostic data (for example, crash logs, error reports, stack traces, and performance metrics that help us diagnose problems and improve reliability).

On iOS, Apple MetricKit provides on-device performance and diagnostic metrics (such as launch times, hang rates, and battery/energy metrics) that help us understand and improve app performance.

2.4Cookies & Similar Technologies (Web)

On the Kura website, we and our service providers use cookies and similar technologies (such as local storage and device or session identifiers) to:

• keep you signed in and maintain your session (strictly necessary);
• remember preferences and settings; and
• understand product usage and performance through analytics (see Section 6).

Strictly necessary cookies and storage are required for the website to function (for example, to maintain your authenticated session). Other cookies and similar technologies are used for analytics and performance measurement. You can control non-essential cookies through your browser settings and, where we present a cookie banner or other consent or preference control, through that control. Blocking strictly necessary cookies may prevent parts of the service from working. The Kura mobile app does not use browser cookies, but it uses comparable on-device storage and identifiers to keep you signed in and to support analytics and diagnostics.

03How We Use Information

We use the information described above for the following purposes:

• Provide and operate the service. Create and authenticate your account; store and display your Lists, items, notes, comments, and follow relationships; generate link previews; and deliver the core curation and discovery features.
• Authenticate you and secure your account. Verify your identity through passwordless sign-in (SMS one-time codes and Google/Apple OAuth/OIDC), prevent unauthorized access, and protect account security.
• Generate link previews. Fetch publicly available metadata from URLs you save so we can show titles, descriptions, and images for your items.
• Enable social and public features. Display public Lists and profiles, support following and being followed, and show notes and comments where you have chosen to share them.
• Maintain, improve, and develop the service. Understand how the service is used (in aggregate and through pseudonymized analytics), diagnose and fix bugs and crashes, monitor performance and reliability, and build new features.
• Communicate with you. Send service-related messages, security and account notices, SMS verification codes, and responses to your requests. We send transactional messages necessary to operate the service rather than marketing messages; if we ever send optional communications, we will provide a way to opt out.
• Ensure safety and integrity. Detect, investigate, and prevent fraud, abuse, spam, security incidents, and violations of our Terms of Service or applicable law.
• Comply with legal obligations and protect rights. Meet legal, regulatory, and tax obligations; enforce our agreements; and protect the rights, property, and safety of Outer Peak Software, our users, and the public.

We do not use your personal information for cross-context behavioral advertising, and we do not sell your personal information (see Section 9).

04Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), we process your personal data only where we have a valid legal basis under the EU/UK General Data Protection Regulation (GDPR). The legal bases we rely on are:

• Performance of a contract (Art. 6(1)(b)). To create and authenticate your account and provide the service you have requested — for example, storing your Lists and items, generating link previews, and operating social and public features under our Terms of Service.
• Legitimate interests (Art. 6(1)(f)). To maintain, secure, and improve the service; understand usage through pseudonymized analytics; diagnose crashes and errors; prevent fraud, abuse, and security incidents; and protect our rights and those of our users. Where we rely on legitimate interests, we balance those interests against your rights and freedoms, and you may object as described in Section 9.
• Consent (Art. 6(1)(a)). Where required by law — for example, for certain non-essential cookies and analytics on the web, or any optional communications. Where we rely on consent, you may withdraw it at any time, without affecting processing already carried out.
• Compliance with a legal obligation (Art. 6(1)(c)). To meet legal, regulatory, and tax requirements and to respond to lawful requests from authorities.
• Protection of vital interests / public interest (Art. 6(1)(d)–(e)), where applicable. In rare cases, to protect someone's vital interests or in connection with a matter of public interest.

If you do not provide certain information (such as a phone number or email for sign-in), we may be unable to provide some or all of the service.

05How We Share Information / Sub-processors

We do not sell your personal information. We share personal information only as described below.

5.1Service Providers (Sub-processors)

We use trusted third-party providers ("sub-processors") to operate the service. They process personal information on our behalf, under contractual obligations to protect it and use it only to provide services to us. Our sub-processors include:

5.2Sign-In Providers

When you choose "Continue with Google" or "Sign in with Apple," you authenticate directly with Google or Apple, and your interactions with them are also governed by their privacy policies. We receive limited profile information from these providers as described in Section 2.1. Similarly, your mobile carrier processes SMS messages used to deliver one-time verification codes.

5.3Other Users (Public Content)

When you make Lists or your profile public, or post notes/comments on public content, that information is shared with — and visible to — other users and the public, as described in Section 7.

5.4Legal & Safety Disclosures

We may disclose information when we believe in good faith that doing so is reasonably necessary to: (a) comply with applicable law, regulation, legal process, or an enforceable governmental or law-enforcement request; (b) enforce our Terms of Service and other agreements; (c) detect, prevent, or address fraud, security, abuse, or technical issues; or (d) protect the rights, property, or safety of Outer Peak Software, our users, or the public.

5.5Business Transfers

If Outer Peak Software is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of all or part of our assets, or similar transaction, personal information may be transferred as part of that transaction. We will take reasonable steps to ensure your information remains protected and, where required, will notify you of any material change to how your information is handled.

5.6Aggregated & De-identified Information

We may create and use aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you (for example, statistics about how features are used). This information is not personal information, and we may use and share it for any lawful purpose.

06Analytics & Tracking

We use analytics and diagnostic tools to understand how the service is used and to keep it reliable and performant:

• PostHog (product analytics). We use PostHog to understand product usage and improve features. Analytics events are associated with a pseudonymized user ID and session ID rather than your name, email, or phone number, and analytics payloads are designed to contain no personally identifying information.
• Sentry (crash & error reporting). We use Sentry to capture crash reports, errors, and diagnostic data so we can identify and fix problems. These reports may include technical details such as device and OS information and stack traces.
• Vercel (web performance). On the web, Vercel provides hosting and Core Web Vitals analytics, which measure aggregate website performance (such as load and responsiveness metrics).
• Apple MetricKit (iOS performance). On iOS, MetricKit provides on-device performance and diagnostic metrics.

Your choices. On the web, you can limit non-essential analytics and similar technologies through your browser settings and any cookie/consent controls we present. Many browsers offer "Do Not Track" or Global Privacy Control (GPC) signals; we honor GPC as an opt-out of "sale" or "sharing" where applicable, although we do not sell or share personal information for cross-context behavioral advertising. We do not use third-party advertising trackers or serve targeted advertising.

07Public Content

Kura includes social and discovery features. Lists and profiles you choose to make public are visible to others — including other Kura users, people who are not logged in, and, where applicable, search engines that may index public pages. Public content can include your username, display name, avatar, bio, the public Lists and items you have saved, and notes or comments you post on public content.

Please use discretion about what you save and share publicly. Once content is public, others may view, copy, share, or cache it, and we cannot control how third parties use information you have chosen to make public. If you later make content private or delete it, copies may persist in caches, search-engine indexes, or with people who already accessed it. You control whether your Lists and profile are public or private through the settings available in the service.

08Data Retention

We retain personal information for as long as it is needed to provide the service and for the purposes described in this Policy. In general:

• While your account is active, we keep your account, profile, and content so the service works for you.
• After you close your account, we delete or de-identify personal information associated with your account within a reasonable period, except where we need to retain certain information to comply with legal, regulatory, tax, or accounting obligations; resolve disputes; enforce our agreements; prevent fraud and abuse; or meet other legitimate operational needs.
• Backups. Information may persist in routine, secure backups for a limited period after deletion from active systems before those backups are overwritten or expire.
• Legal holds. We may retain information longer where required by law or where it is subject to a legal hold or ongoing investigation.
• Pseudonymized and aggregated data. Analytics data tied to pseudonymized identifiers, and aggregated or de-identified data, may be retained for longer because it does not directly identify you.

When we no longer need personal information, we delete it or de-identify it using reasonable measures.

09Your Rights & Choices

You can access and update much of your profile information directly in the service, and you can delete your account. Depending on where you live, you may also have additional rights described below. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law (CCPA/CPRA).

To exercise any of the rights below, contact us at outerpeaksoftware@gmail.com. We will respond within the timeframes required by applicable law. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your privacy rights.

9.1GDPR Rights (EEA / UK)

If you are in the EEA or the UK, you have the following rights regarding your personal data, subject to certain conditions and exceptions:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data in certain circumstances.
• Restriction — request that we limit our processing of your data in certain circumstances.
• Portability — receive certain data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Objection — object to processing based on our legitimate interests, on grounds relating to your particular situation.
• Withdraw consent — where we rely on consent, withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). For the purposes of GDPR, Outer Peak Software LLC is the data controller for personal data processed through the service. You can reach our data protection point of contact, and any EEA/UK representative inquiries, at outerpeaksoftware@gmail.com.

9.2CCPA / CPRA Rights (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA):

• Right to know — request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete — request deletion of personal information we collected from you, subject to legal exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share your personal information, so there is nothing to opt out of; we will continue to honor Global Privacy Control (GPC) signals as applicable.
• Right to limit use of sensitive personal information — we do not use or disclose sensitive personal information for purposes that would trigger this right beyond what is necessary to provide the service.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA/CPRA rights.

Categories of personal information collected (last 12 months). Under the CCPA/CPRA, the categories of personal information we collect are:

• Identifiers — such as your email address, phone number, username, display name, IP address, and account/online identifiers.
• Customer records information (Cal. Civ. Code § 1798.80(e)) — such as your name and contact information.
• Internet or other electronic network activity information — such as interactions with the service, usage data, and (on the web) information from cookies and similar technologies.
• Geolocation data — approximate location derived from your IP address (such as country or region).
• Audio, electronic, visual, or similar information — such as your avatar image and the images included in link previews you save.
• Inferences — limited inferences drawn from usage to maintain and improve the service. We do not use this category for profiling that produces legal or similarly significant effects.
• User-generated content you provide — such as the links/items you save, your Lists, notes, comments, bio, and follow relationships.

Business and commercial purposes. We collect these categories for the purposes described in Section 3, including providing and securing the service, authentication, generating link previews, enabling social/public features, analytics and product improvement, diagnostics, safety and fraud prevention, communications, and legal compliance.

Sources. We collect this information directly from you, automatically from your use of the service and your device, from the sign-in providers you choose (Google/Apple), and from the publicly available metadata at URLs you save.

Disclosures for a business purpose. We disclose personal information to the sub-processors and other recipients described in Section 5 for the business purposes described above. We do not sell personal information and do not share it for cross-context behavioral advertising.

You may submit a request to know, delete, or correct by emailing outerpeaksoftware@gmail.com. You may use an authorized agent to submit a request on your behalf, subject to verification.

9.3Other Choices

• Account information. You can review and update your profile (username, display name, avatar, bio) within the service.
• Account deletion. You can delete your account, which initiates deletion of associated personal information as described in Section 8.
• Communications. You can manage how you receive certain communications; service-related and security messages are necessary to operate the service and may not be optional.
• Cookies/analytics (web). You can manage non-essential cookies and similar technologies through your browser settings and any controls we present (see Section 6).

10International Data Transfers

Outer Peak Software is based in the United States, and our sub-processors may process and store information in the United States and other countries. If you access the service from outside the United States, your information may be transferred to, stored in, and processed in countries whose data protection laws may differ from those of your country.

Where we transfer personal data from the EEA, the UK, or other regions with cross-border transfer restrictions to a country that has not been deemed to provide an adequate level of protection, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement, where applicable) — to protect your information. You may contact us at outerpeaksoftware@gmail.com for more information about the safeguards we use.

11Security

We take reasonable and appropriate measures designed to protect personal information from unauthorized access, use, alteration, disclosure, and loss. These measures include:

• encryption in transit using TLS for connections between your device and the service;
• encryption at rest for stored data, provided through our infrastructure providers;
• access controls, authentication safeguards, and the use of reputable, security-focused service providers; and
• monitoring, logging, and other reasonable administrative, technical, and organizational safeguards.

If we become aware of a personal-data breach that affects your information, we will investigate and notify affected users and applicable authorities as required by law.

No method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. You also play an important role in protecting your account — keep access to your phone number, email, and connected Google/Apple accounts secure, and notify us promptly at outerpeaksoftware@gmail.com if you believe your account has been compromised.

12Children's Privacy

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. You must be at least 13 years old to use Kura. If you are in the EEA or the UK, you must be at least 16 years old, or have verifiable parental or guardian consent where local law requires it for users under that age.

If you are a parent or guardian and believe your child under the applicable minimum age has provided us with personal information, please contact us at outerpeaksoftware@gmail.com. If we learn that we have collected personal information from a child under 13 (or under the applicable minimum age) without the required consent, we will take reasonable steps to delete that information promptly.

13Third-Party Links

Kura is built around content you save from across the web. The links and items you save point to third-party websites and services that we do not operate or control. When you follow a saved link, you leave the service and interact with a third-party site that has its own terms and privacy policies. The metadata we fetch to build a preview comes from those third-party URLs. We are not responsible for the content, practices, or privacy policies of those third parties, and this Privacy Policy does not apply to them. We encourage you to review the privacy policies of any third-party sites you visit.

14Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements, or for other operational reasons. When we make changes, we will update the "Last updated" date at the top of this Policy and, where the changes are material, we will provide additional notice as appropriate (for example, through the service or by other reasonable means). Your continued use of the service after the updated Policy becomes effective constitutes your acceptance of the changes, to the extent permitted by law. We encourage you to review this Policy periodically.

15Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our handling of your personal information, please contact us:

Outer Peak Software LLC
Kura — a service of Outer Peak Software LLC
Email: outerpeaksoftware@gmail.com
Website: https://kura.software

For data protection inquiries, including GDPR data-subject requests, EEA/UK representative inquiries, and CCPA/CPRA consumer requests, please use the same address: outerpeaksoftware@gmail.com.