Privacy Policy

The Curious Thing makes personalized puzzles starring your child. Because the product is built from a photo of a child, privacy isn't an afterthought. It's part of how the service is designed. This policy explains, in plain language, what we collect, how we use it, who we share it with, and how long we keep it.

Who This Applies To

The Curious Thing is intended for use by parents and legal guardians, or adults acting with a guardian's permission. It is not directed to children, and we do not knowingly collect personal information directly from a child. The photo of a child is always uploaded by a verifying adult who confirms they have the right to share it (see our Terms).

What We Collect

• The photo you upload, used only to create your puzzle.
• Your child's first name, optional, used only to personalize the puzzle. It is never sent to the AI image service.
• Your email address, to send you the proof, order confirmation, and production updates.
• Your shipping address, collected by our payment provider at checkout, used to print and deliver your puzzle.
• A record of consent, the date/time and IP address from which the parental-consent box was confirmed, kept as a legal record that consent was given.
• Order details, your theme, size, and order status. Payment is processed by Stripe; we never see or store your full card number.

How We Use Your Photo

• We send the photo to our AI image provider to generate the fantasy portrait. We send only the image and a style description, never your child's name.
• We never use your photos to train AI models, and we don't allow our providers to do so.
• When you approve a proof and pay, the approved image is enhanced for print resolution and sent, together with your shipping address, to the print partner who manufactures and ships your puzzle.
• We never use a customer's photo or finished image in our own marketing without your separate, explicit, written permission.

How Long We Keep It

• The original photo you upload is automatically and permanently deleted within 24 hours. It's needed only to generate your image, which happens within minutes.
• The fantasy image we generate is kept for up to 90 days so you can review and re-order it. If you approve and order, the final print file is retained as a record of what we manufactured.
• Your order and consent records are kept as long as needed for our business, accounting, and legal obligations.

Who We Share It With

We do not sell your personal information, and we don't share your photos with anyone except the service providers needed to create and deliver your puzzle. Those providers (sub-processors) are:

• OpenAI, generates the fantasy image from your photo.
• Replicate, enhances the approved image to print resolution.
• Stripe, processes your payment and collects your shipping address.
• Printify / District Photo, manufactures and ships your physical puzzle (receives the final image and your shipping address).
• Resend, sends our transactional emails (proof ready, order confirmed, in production).
• Cloudflare, hosts the site, stores files securely, and provides privacy-first, cookieless website analytics (page views and performance only, no cross-site tracking).
• Supabase, stores order records in our database.
• Microsoft (Clarity), privacy-focused product analytics (aggregate usage, heatmaps, and session replays) that help us improve the site. Your uploaded photo and your child's name are masked and are never captured by it.

We may also disclose information if required by law, or to protect our rights, users, or the public.

Analytics and Improving the Site

To understand how visitors use our site and to make it better, we use privacy-focused analytics: Cloudflare Web Analytics, which is cookieless and measures only aggregate page views and performance, and Microsoft Clarity, which provides heatmaps and session replays of how people move through the site. These tools measure the experience of the adults using the site. They are not used to track children. Wherever a page shows your uploaded photo or your child's name, that content is masked so it can never appear in a session replay, and the photo itself is never sent to these tools. We serve customers in the United States and do not use this data for advertising.

Children's Privacy (COPPA)

We comply with the U.S. Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13. A child's photo is provided by a parent or guardian who attests to that role when they upload it. We do not market to children and we do not track children's online behavior. If you believe a child has provided us information without a parent's involvement, contact us at hello@thecuriousthing.com and we will delete it.

Your Choices and Rights

You can ask us to access or delete the personal information associated with your order at any time. Email hello@thecuriousthing.com and we'll take care of it. (Note: your original photo is already deleted automatically within 24 hours of upload, as described above.)

Where Your Data Is Processed

The Curious Thing serves customers in the United States, and your information is processed by the providers listed above. We don't offer international shipping at this time.

Changes to This Policy

We may update this policy as the service evolves. When we make a material change, we'll update the "last updated" date above and, where appropriate, notify you.

Contact Us

Questions about your privacy or this policy? Email hello@thecuriousthing.com.