Privacy Policy
Last updated September 9, 2026
Curartio is operated by Toronto Warez Inc. in Ontario, Canada, and follows the Personal Information Protection and Electronic Documents Act (PIPEDA). This page explains what we collect, why, and what you can ask us to do with it.
1. What we collect
| What | When |
|---|---|
| Name and email address | When you create an account or request an invite |
| Password (stored hashed, never in readable form) | When you create an account |
| Profile details — location, bio, website, Instagram, art style, avatar | Only if you choose to add them |
| Artwork images and details | When you register a piece |
| A link to your work | When you request an invite |
| Standard server logs kept by our host | Automatically, when any page is visited |
We do not collect payment information, because we do not charge artists. We do not buy personal data from anyone, and we do not sell or rent yours.
2. What is public
Curartio is a public registry — the point is that your work can be found and verified. The following is visible to anyone, including search engines:
- your name, and your profile details if you added them
- your avatar
- your registered artwork images, titles, media, dimensions, years and descriptions
- the price of a piece, if you chose to enter one
- your certificate pages, fingerprints and blockchain transaction references
Your email address and password are never shown publicly. Neither is anything you write to us when requesting an invite.
You can hide any piece from your dashboard at any time, which removes it from your profile, the directory and search results.
3. The blockchain part
What we write to Polygon cannot be deleted — by us or by anyone. That record is a SHA-256 fingerprint of your image and a timestamp. It does not contain your name, email, or the image itself.
Even so, please understand before registering: that entry is permanent and public, and no request can remove it. Deleting your account removes your data from this website, not from the blockchain.
4. Why we collect it
- Your email — to identify your account, send password resets, and contact you about your account or a request you made
- Your name and profile — to build your public artist page, which is the point of the service
- Your images — to generate the fingerprint and display your work
- Your invite request — to decide whether to send you a code, and to reply
- Server logs — security, debugging, and keeping the site running
We do not use your information for advertising, and we do not send marketing email you did not ask for.
5. Who else is involved
- Hostinger — hosts the site, the database and uploaded images, and sends our email
- Tatum — the service we use to write records to the Polygon blockchain; it receives the fingerprint, not your personal details
- Polygon — a public blockchain; entries there are permanent and readable by anyone
- Google Fonts — serves the typefaces used on the site
- cdnjs — serves the library that draws QR codes on certificate pages
Some of these operate outside Canada, which means your information may be stored or processed in other countries and be subject to their laws.
6. Cookies
We use one cookie: a session cookie that keeps you logged in. It is removed when you log out or when the session expires.
We do not run advertising cookies, tracking pixels, or third-party analytics. If that changes, this page will say so before it does.
7. How long we keep things
- Account and artwork data — while your account exists
- Hidden artwork — kept, so you can restore it; hidden from public view meanwhile
- Invite requests — kept as email correspondence, and deleted on request
- Password reset tokens — expire after one hour and are then erased
- Used invite codes — kept as a record of how an account was created
- Server logs — retained by our host according to their own schedule
8. Your rights
Under PIPEDA you can ask us to:
- tell you what personal information we hold about you
- correct anything inaccurate
- delete your account and the data attached to it
- withdraw consent for us to use your information, understanding that this may mean closing your account
Email hello@curartio.com and we will respond within 30 days. Most profile details you can change yourself at any time from your dashboard.
The one limit is the blockchain: we can delete everything on this website, but the fingerprint entries already written to Polygon are outside anyone's control.
If you are not satisfied with how we handle a request, you can complain to the Office of the Privacy Commissioner of Canada.
9. Security
The site is served over HTTPS. Passwords are stored as bcrypt hashes and are never readable by us — which is why we can only reset a password, never tell you what it was. Password reset links are stored hashed as well, expire after an hour, and work once.
No system is perfectly secure. If we ever discover a breach affecting your information, we will tell you and report it as the law requires.
10. Children
Curartio is not intended for people under 16. We do not knowingly collect their information; if we learn that we have, we will delete it.
11. Changes
We will update this page as the service develops, and the date at the top shows when it last changed. Significant changes will be emailed to registered artists.
12. Contact
Toronto Warez Inc.
Ontario, Canada
hello@curartio.com