Contact

For questions or bug reports, please reach out via email.

Privacy Policy

Last updated: October 22, 2026

This policy explains how Cigmma (the trade name of a sole proprietor; "we" or "us") handles user information in Curv Link, including the web app, the PWA and the Chrome extensions "Curv Link" (new tab) and "Curv Link Web Helper" (the "Service"). If a Japanese version exists, the Japanese version prevails.

1. Our approach
Your links, folders, settings, search history, wallpapers, added files and icon/thumbnail caches are stored in your browser (IndexedDB, localStorage, chrome.storage) and are not sent to our servers. Only when you use the features below is the information they need sent outside your device. We do not sell user information or use it for personalized advertising. We do not use analytics tools.

2. Accounts (sign-in)
Sync uses sign-in through Supabase (Supabase Inc.) authentication. - Signing in with email: your email address (the confirmation code email is sent by Supabase). - Signing in with Google: the account ID, email address, name and profile picture URL provided by Google (we only use the user ID and email address). To prevent abuse, Supabase also records the IP address and browser information (user agent) used to sign in. An authentication token is stored in your browser to keep you signed in.

3. Sync (optional, off by default)
- Google Drive sync: a sync file encrypted on your device is stored in the app-only area of your own Google Drive (appDataFolder; only the drive.appdata permission is used). So that sync keeps working without reconnecting, when you sign in with Google or connect Google Drive we store Google's authorization (a refresh token limited to the app-only area of Google Drive (drive.appdata) and the sign-in scopes) encrypted on our server on Cloudflare, and use it only to obtain a new access token about once an hour. Alongside it we store, unencrypted, your Google account ID, the granted scopes and timestamps, and, if you signed in with email and then connected Google Drive, which account user ID goes with which Google account ID. Access tokens are handled in your browser; our server holds them only briefly in memory while passing them on and does not store them. Your sync file never passes through our server. You can revoke and delete the stored authorization with "Disconnect Google Drive" in Settings, or revoke it under "Third-party apps & services" in your Google Account (https://myaccount.google.com/connections), in which case we also delete it at the next renewal. Signing out alone does not revoke it. - Relay server (only if you choose it): encrypted changes pass through our server on Cloudflare and are stored until delivery is confirmed (up to 7 days), and each device's sync state for 30 days after its last update. Device IDs, your user ID (while signed in) and timestamps are not encrypted. Expired data is erased by a daily cleanup. While you are signed in, the sync encryption key is derived from your account's user ID. We do not decrypt or view sync content in normal operation, but this is not end-to-end encryption that we are technically unable to decrypt. Sync set up with an invitation code uses a randomly generated key. When the relay server is used, signed in or not, the value the key is derived from is sent to our server to authenticate the connection (we store only a hash of it and do not decrypt or view sync content in normal operation).

4. Sharing by URL
- Sharing by URL compresses the titles and URLs of the shared cylinder's links and its folder structure into the share URL, after "#". Images, videos, local files, settings and wallpapers are not included. The share URL is created on your device. - Browsers do not send the part after "#" to our servers, so we never receive what you share and do not store or record it. - Anyone with the share URL can view its content, and the content stays in any service the share URL was sent through (for example email or chat). A share URL does not expire, and we cannot disable it afterwards.

5. Icons, preview images and similar requests
- To show link icons, the domain names of your saved links are sent, through our image relay server (Cloudflare) or directly, to Google's icon service, DuckDuckGo, Simple Icons and the linked sites. Icon URLs you set yourself or that came with an import are requested directly. For YouTube links, the video ID is sent to YouTube's image servers. - If you use preview mode (page thumbnails), page URLs (without the part after "?" and "#") are sent through the image relay server to thum.io, and to Microlink when needed. - In preview mode, to show product images for saved Rakuten Ichiba item pages (not PR links), the shop code and item code are sent to our product image server (Cloudflare), which reads that public item page and the image it publishes for link previews (og:image). For Amazon short sharing URLs (such as amzn.asia; not PR links), the share code in the URL is sent to our server, which checks where Amazon redirects it to find the product page. Product images are stored only on your device. - To fill in titles automatically, your browser may access a saved URL directly (without cookies or other credentials). - Playing a YouTube or Spotify embed, or previewing an image, video or audio link, connects to that service or site. - Importing a YouTube playlist sends the playlist URL to YouTube through our server. - If you use search suggestions in the search bar ("Show Search Suggestions" in settings; on by default), the text you are typing is sent through our server to the search engine you chose (Google by default; or Bing, Yahoo!, DuckDuckGo, Baidu or Yandex). Text containing a URL, an e-mail address, a local address or a file path is not sent (a domain name on its own, such as "youtube.com", is sent). Our image relay server and our servers are not configured to store access logs (apart from processing on Cloudflare's platform). The same icon requests are made on the device of anyone who opens a share URL.

6. Search
Words you search for in the search bar are sent to the search engine you selected (or your browser's default search engine). If you choose the Amazon or Rakuten row in the search suggestions, the words are sent to Amazon (amazon.co.jp) or Rakuten Ichiba (see "Cookies and advertising" for how these open through referral links).

7. Chrome extensions
- Curv Link (new tab): the tabs and windows permissions are used when you add open tabs as links and to open or switch to the Curv Link tab. The storage permission is used to save links and settings on your device. The history and bookmarks permissions are used when you import links from your browsing history or bookmarks. The search permission is used to search the words in the search bar with the browser's default search engine, and the unlimitedStorage permission to keep caches such as icons on your device. To show icons, the domain names of links are sent to Google's and DuckDuckGo's icon services. This data is not sent to our servers. - Curv Link Web Helper: passes bookmarks you add, move or rename, the current tab you add from its popup, and bookmarks you explicitly import to Curv Link Web inside the same browser; only if you turn it on, it also adds or removes Chrome bookmarks from Curv Link (none of this goes through our servers). It opens Curv Link Web (curv-link.cigmma.com) in new tabs. See the extension's own privacy policy for details. User data obtained from Chrome is used only to provide and improve Curv Link's features and is handled in accordance with the Chrome Web Store User Data Policy, including the Limited Use requirements.

8. Cookies and advertising
The Service's own code does not set cookies. However, the support page (including this policy) shows third-party ads (A8.net, AccessTrade, Ninja AdMax), and these companies may use cookies and similar technologies to collect IP addresses and browser information. External services such as Google and YouTube, and the provider of the icon font used to display pages (cdnjs), may also collect IP addresses and similar information. - Referral links: Amazon (amazon.co.jp) and Rakuten (rakuten.co.jp) links you open from Curv Link, and the Amazon and Rakuten rows in the search suggestions, open through a referral link of Moshimo Affiliate (MOSHIMO Co., Ltd.) or Rakuten Affiliate (Rakuten Group, Inc.), but only when the link carries no referral ID. The URL of the page being opened is then sent to these companies, and they, Amazon or Rakuten may set cookies to track the referral. Your saved link URLs are never rewritten. Links that already carry someone else's referral ID, and short links, open as they are. If you turn off "Open Amazon/Rakuten links via our referral link" in Settings, they open without a referral link. A cylinder shared by URL always opens these links through referral links, whatever the viewer's own setting. Each company handles this information under its own privacy policy.

9. Purposes of use
We use the information we obtain to provide the Service (sign-in and sync), respond to inquiries, prevent abuse, respond to violations of the Terms, and comply with the law.

10. Sharing with third parties and service providers
Except as required by law, we do not provide personal information to third parties without your consent. To run the Service we use the services below, and information may be processed on servers outside Japan. - Supabase Inc. (USA; data stored in the Tokyo, Japan region): sign-in - Cloudflare, Inc. (USA): website delivery, sync relay, image relay, storing the Google Drive sync authorization - Google LLC (USA): sign-in with Google, Google Drive sync We ensure, through each provider's terms and data processing agreements, that these providers continuously take measures in line with Japan's Act on the Protection of Personal Information (Article 28(1)). On request, we will provide without delay information on those measures, the countries involved and their personal information protection systems (Article 28(3)). An overview of each country's system is also available on the website of Japan's Personal Information Protection Commission.

11. Retention
- Account information: until the account is deleted - Sync relay data: up to 7 days (device sync state: 30 days) - Google Drive sync authorization: until you disconnect Google Drive, or 180 days after it was last used - Emails to us: as long as needed to respond

12. Requests for disclosure, deletion and more
To request disclosure, correction, suspension of use or deletion of personal data we hold, or deletion of your account, please email us at the address below. We will respond without delay after confirming your identity, for example by a message from your registered email address. Disclosure is made by email, free of charge. When we delete your account, we also revoke and delete the Google Drive sync authorization stored on our server. Google Drive sync files can be deleted from "Manage apps" in Google Drive settings. Data in your browser is erased when you clear the site data in your browser.

13. Security
We work to prevent leaks, loss or damage of information through encrypted connections (HTTPS), encryption of sync data, and limited administrative access.

14. Changes to this policy
If we change this policy, we will post the updated content on this page. Important changes will be announced on the Service before they take effect.

15. Contact
For questions or complaints about this policy or how we handle personal information, please contact [email protected]. Business handling personal information: Cigmma (a sole proprietor). Our name and address will be provided without delay upon request.