Privacy Policy

Last updated: 4 October 2026

This policy explains what stays on your phone, what reaches our servers and why, who else processes it, how long we keep it and how to use your rights. It covers the Curra app and the website curra.app.

Who we are

Curra is an app by Light Softwares (“we”), which decides how your data is used (the data controller). For anything about your data, write to support@curra.app.

In short

• Your CVs, cover letters and documents are saved on your phone, not on our servers. If you upload a CV on the website, we keep only its details (not the file), encrypted in your account, until you delete it.
• AI features send what they need through our server to Anthropic (Claude), only after you agree, and you can turn them off at any time.
• Companies see you only if you publish an anonymous work profile, and never see your surname, photo, phone, e-mail or expected pay.
• We don't sell your data, and we use no advertising or ad tracking.
• You can delete your account in the app or on the website at any time, and it is deleted at once.

What stays on your phone

Your CVs, photo, cover letters, the files in My documents and your notes on applications are saved on your phone. If you use iCloud Backup, they are part of your own Apple backup.

Alerts and reminders (interviews, expiring documents, new jobs) are scheduled on your phone, and reading text from scanned documents happens on your phone.

What reaches our servers, why, and on what basis

Each item says why we need it and its legal basis: contract (needed to give you the service you asked for), consent (you agreed and can withdraw), or legitimate interest (needed to keep Curra working and safe, balanced against your rights).

• Job searches: what you search for (country, city, field, words) and the matching details you choose to use (field, years of experience, degree, skills, certificates), to find jobs and tell you which suit you. These requests may be linked to your install ID or your account. Basis: contract.
• Install ID: an identifier the app creates at random for its copy on your phone (not Apple's advertising or device identifier). We use it to count AI points and daily limits, link purchases to the app, and stop abuse. Basis: contract and legitimate interest.
• AI points on your account: when you're signed in (on the website, or in the app), your points, the free plan's monthly points, the welcome points and the month's free CV reads belong to your account, the same on the website and in the app. The first time the app on a phone signs in to your account, the points you bought and haven't used move from that install ID to your account (once only), and we record that it happened. Your App Store subscription stays linked to the install as before, and we keep its plan, end date and transaction number on your account so the website shows it. Points you buy on the website are added to your account. Basis: contract and legitimate interest (stopping abuse of free points).
• AI features (reading a CV you import, preparing a copy for a job, cover letters, edits, translation, interview questions and feedback, turning what you say into CV text): what the task needs passes through our server to Anthropic, which runs the Claude model. For text tasks we remove your phone number, e-mail and address when the task doesn't need them. When you import a CV as a file or photo, the whole file or photo is sent, including any contact details in it. Nothing is sent before you agree, and you can withdraw at any time in Profile › Settings and language › Account & privacy › AI features. Basis: consent.
• Your account: if you sign in with Apple or Google (for example to let companies find you), we keep an account ID, the e-mail Apple or Google shares (with Apple it may be a private relay address; with Google, only a verified address), your app language, and when you signed up and were last active. With Apple we also keep a token Apple gives us, used only to cancel the Sign in with Apple link when you delete your account. If you sign in with a code sent to your e-mail, we keep that e-mail on your account. Basis: contract.
• Work profile (“Let companies find you”), if you publish it: your first name, job title, field, years of experience, city and districts, type of work, expected pay, and your professional profile (experience, education, certificates, skills and languages, with contact details removed). Companies see your first name and professional profile, and past employers' names only if you allow it. They never see your surname, photo, phone, e-mail, expected pay or districts; we use those only to match you. The CV file itself is not kept. You can hide or delete the profile at any time. Basis: consent.
• Contact requests and messages: when a company asks to contact you we keep the request (the company, the role, its message and any pay it states); if you accept, we keep the messages between you so both sides see them; if you report a company we keep the report to review it. We never give the company your e-mail or phone number, only what you write yourself. You can answer requests and messages in the app or in Company requests on the website. If you have no phone registered for notifications, we e-mail you through ZeptoMail with only the company's name and a link to the request, never the message itself. Basis: contract.
• Notifications: the push token Apple gives your phone, so we can tell you about a request or a reply. Basis: contract.
• Purchases: in the app, we check your subscription and bought points against Apple's signed records and link them to your install ID. On the website, point packs are sold by Paddle, our reseller and Merchant of Record: Paddle takes the payment and handles tax, receipts and refunds, and tells us the order (its number, the pack, the amount, the currency and whether it was paid or refunded) so we can add the points to your account, or take them back after a refund. We never see your payment details. Basis: contract and legal obligations (accounting).
• Abuse protection: Apple's App Attest confirms requests come from the genuine app, and a one-way hash of your network (IP) address limits how many new free installs one network can make. We don't store the IP address itself. Basis: legitimate interest.
• Invite a friend: your invite code, linked to your install ID, the platform, the date and a one-way hash of your network address, and which codes were redeemed, so rewards reach the right people and can't be gamed. Basis: contract and legitimate interest.
• Share links: when you share a job we keep its title, company and link so the link's page works, and count opens without identities. Basis: legitimate interest.
• Support e-mails: your e-mail address and what you write to us, so we can answer. Basis: contract and legitimate interest.

This website

• Cloudflare delivers curra.app and processes your IP address and browser details to serve and protect it.
• The pages load their fonts from curra.app itself, so your browser doesn't connect to Google for them. Only a CV shown in one of its designs (in My CV, or from a CV link someone shared) loads the design's typeface from Google Fonts; then your browser connects to Google, which receives your IP address.
• Searching on the website: what you search for (words, city and filters) reaches our servers so we can find the jobs, and results are cached by search, not by person. To protect the site from automated copying we count the pages each network opens in 10 minutes, using a one-way hash of the network address; we don't store the address itself. Basis: legitimate interest.
• Your account on the website: you can sign in on the website with Google, Apple or a code sent to your e-mail; it is the same account as in the app (the same details as under “Your account” above). For each browser you sign in on we keep a session: the browser and device type (such as “Chrome · Windows”), the approximate city and country Cloudflare gives us, and when you signed in and last used it. You can see these devices and sign them out in My account. Basis: contract.
• Signing in with a QR code: when you open the sign-in page on a computer we make a code that lasts two minutes, and keep the computer's browser type and approximate city with it, to show them on your phone before you agree. A code works once, and only when, on a phone that is signed in, you pick the number shown on the computer's screen. A QR sign-in lasts at most 7 days, and before deleting the account, downloading your CV or opening company requests on that computer we ask you to sign in there with Google or Apple. In My account you can sign out everywhere, the app included. Basis: contract.
• Signing in with an e-mail code: if you choose “Continue with e-mail” (on the website or in the app), we send a 6-digit code to your e-mail through ZeptoMail. We don't keep the code itself: we keep a keyed hash (HMAC) of the code and one of the e-mail, when it was sent and how many tries were made. A code works for 10 minutes, for at most 5 tries, once, and is deleted within a day. When you sign in we open the account that has the same verified e-mail (from Google, Apple or an earlier e-mail sign-in), or make a new one, and keep your e-mail on the account and when you last signed in by e-mail. To prevent abuse we count codes per e-mail and per network (a one-way hash, not the address) for an hour. We never say whether an e-mail has an account. Basis: contract.
• My jobs and search alerts: the jobs you save (title, company, city and link), your application status, notes and interview time, so the same list appears on the website and in the app, and the searches you save as alerts. We send you new jobs at most once a day: as a notification in the app if you've turned notifications on, otherwise to your e-mail through ZeptoMail, and every e-mail has a link that stops the alert. Basis: contract.
• Your CV on the website (My CV): if you upload your CV (a PDF, a Word file or a photo) after agreeing to the AI features, Anthropic's Claude reads it and we keep in your account only the details read from it (your name and contact details, experience, education, skills, certificates and languages), encrypted with a key of your account's own. The file itself is never kept. We use it to tell you which jobs suit you (without AI) and, when you ask, to prepare a copy for a job or a cover letter; the 20 newest copies are kept, encrypted too. You can edit or delete it in My CV, and withdraw your consent in My account. Basis: consent.
• Work profile and company requests on the website: you can prepare, publish and hide your work profile, and answer companies' requests and messages on the website; it's the same data described above under “Work profile” and “Contact requests and messages”. Basis: consent (work profile) and contract (requests).
• Cookies: the website keeps only necessary cookies in your browser, all from curra.app, with no tracking or advertising: c, the country you chose (one year); hv, that you passed the human check, so we don't ask again (7 days, with a one-way hash of your network, not its address); cs, that you're signed in (30 days, renewed as you use the site, at most 7 days when signed in with a QR code, removed when you sign out); ost or oas, only while you sign in with Google or Apple (10 minutes), so we know the answer belongs to your own request; qrb, when you open the sign-in page on a computer (10 minutes), so the QR code signs in only that browser; qt, the quick filters you add to your searches (one year); mjv, whether you see My jobs as a list or a board (one year); xs, while you link Curra for Chrome to your account (10 minutes); sl, that you chose the English site, so we don't send you to another language (one year); ab, that you closed the banner suggesting the Android app, so we don't show it again (90 days); and site_v2, only if you open a preview of the website through a special link (30 days).
• The “confirm you're human” check: if it appears, it is run by Cloudflare Turnstile, and Cloudflare processes your browser and device details to tell people from automated programs. Basis: legitimate interest.
• We use no analytics or advertising tools on the website.

Who processes your data

• Cloudflare hosts Curra's servers, database and this website.
• Anthropic (Claude) processes what AI features send, to return the result. Under its commercial terms it does not use it to train its models, and keeps it only for a limited time, for example for safety checks.
• Apple: Sign in with Apple, purchases, App Attest, notifications, and speech recognition when you use the microphone.
• Google: Sign in with Google, if you choose it; it gives us your account identifier and e-mail. Google also serves this website's fonts.
• Paddle (paddle.com) sells the point packs on the website as our reseller and Merchant of Record. It receives what it needs for the payment, tax and receipt (such as your e-mail address, country, payment details and the order) and handles it under its own privacy policy; we receive only the order's details. The Buy points page loads Paddle's checkout from Paddle.
• Zoho (ZeptoMail) sends job-alert e-mails if you save a search as an alert, and “you have a request or message from a company” e-mails when no phone is registered for notifications (the company's name and a link only), and sign-in codes if you sign in with your e-mail; it receives only your e-mail address and the e-mail itself.
• Job partners: Careerjet receives your search words, the place, and your IP address and browser or app identity, which it requires for every search; these pass through a relay server we run at DigitalOcean that keeps no logs of searches. Jooble, Reed, USAJOBS and France Travail receive only the search words and place.
• Employers' careers sites: we read their public job pages and send them nothing about you. When you apply, you do so on the employer's own site, under its own privacy policy.
• Companies on Curra for Business see only what is described above, and only if you publish a work profile.
• We don't sell your data, and we use no advertising or ad-tracking tools.

International transfers

Our providers work worldwide, so your data may be processed outside your country, including outside Saudi Arabia (for example in the United States and Europe). We choose providers bound by data-protection terms, and send each one only what its task needs.

How long we keep it

• AI requests: the text, file or photo is not kept. A copy of the result is kept for at most one day, so you aren't charged twice if the connection drops.
• Job searches: results are cached for up to 6 hours by search, not by person.
• Your account, work profile, contact requests, messages and push tokens: until you delete your account. A push token also goes when Apple reports it's no longer valid.
• Your CV on the website and its copies for jobs: until you delete it in My CV or delete your account. Copies prepared for jobs: the 20 newest only.
• My jobs and alerts: until you remove them or delete your account. A job you remove keeps only its key (no title or notes) for up to 90 days, so your other devices learn it was removed.
• Website sessions: until you sign out, after 30 days without use (at most 7 days for a QR sign-in), or when you delete your account. QR codes expire after two minutes and are deleted within an hour. E-mail sign-in codes work for 10 minutes and are deleted within a day.
• Usage, points and purchase records, App Attest keys, network hashes and invite records linked to an install ID or your account's ID (counters with no content, kept after an account is deleted so that deleting and re-making an account can't be used to get free points again): kept for accounting and abuse protection. They are not deleted automatically yet; ask us and we'll delete them, except what the law requires us to keep.
• Share links: while the link is in use; you can ask us to remove one.
• Support e-mails: as long as we need them to deal with your request; ask us and we'll delete them.

Your rights

Under Saudi Arabia's Personal Data Protection Law (PDPL), and similar laws where you live, you can:

• Know how your data is used (this policy).
• Get access to your data and a copy of it in a readable format.
• Have it corrected or completed.
• Have it deleted when it's no longer needed.
• Withdraw your consent at any time (for AI features or your work profile). This doesn't affect what was done before.
• Object to processing based on our legitimate interest.

You can do most of this yourself in the app: hide or delete your work profile, turn AI features off, or delete your account (Profile › Settings and language › Account & privacy, or My account on the website). For anything else, write to support@curra.app from the e-mail you signed in with, and we'll reply within 30 days.

If you're not satisfied, you can complain to the Saudi Data & AI Authority (SDAIA). If you are in the European Union or the UK, you can complain to your local data protection authority.

Security

Data travels encrypted (HTTPS), our servers check that AI requests come from the genuine app, access to our database is limited to us, and you can lock My documents with Face ID on your phone.

Permissions the app asks for

Camera (scanning documents, a CV photo), Photos, Microphone and Speech Recognition (writing by voice, interview practice), Notifications (alerts), Calendar (interviews) and Face ID (locking My documents). All are optional and the app works without them.

Age

Curra is for people aged 18 and over, the age of majority in Saudi Arabia. If you are under 18, please don't use Curra; if we learn that a minor has sent us data, we delete it.

Changes

If this policy changes, we post the new version here with its date and explain important changes in the app's release notes or in the app.

Contact

Light Softwares, the developer of Curra. E-mail: support@curra.app.