Privacy.

Plain language. No jokes in this one.

What this site collects

This site uses Google Analytics to count visits. It sets cookies to tell visits apart and records the pages you view, the site that sent you, and your general location, device and browser. We use it only to see how the site is doing, not for advertising, and it isn't linked to your name. Google's privacy policy applies to the data it processes for us. You can turn it off by choosing “Only the necessary ones” in the cookie note on the home page, or block it with a browser extension or Google's opt-out add-on. The site also remembers your motion preference in your browser. If you make choices while exploring, it keeps a working note in this browser tab: what you want, tools worth keeping, problems you selected and an example you saved. You can change or clear the note on the contact page. It is not sent to us until a configured form delivery succeeds or you send a prepared draft from your email app.

The fictional example sites also keep some demo choices in your browser, such as your morning pairing and sample shop data. Using those examples does not place an order or send an enquiry to a real bakery.

Client accounts

When client access is connected, the portal uses Supabase to manage account email addresses, password authentication and client project records. Passwords are handled by the authentication provider; we do not store them in the browser or include them in application logs.

Signing in creates essential, secure session cookies. These let the server verify your account and retrieve the project records assigned to you. They are not advertising or tracking cookies. Signing out clears this browser’s session. Access links are used to confirm your account or reset access and should be kept private.

The contact form

When you send an enquiry we receive your name, company, email address, your answers and the working note shown on the final screen. Preparing, copying or downloading an email draft does not send it to us. We use it to reply to you and for nothing else. We do not add you to a mailing list. We keep it for as long as we are talking, then for our records of the conversation.

Curveballs and referrals

A Curveball is a link, QR code poster or business card that one of our clients or partners shares with you. If you open one and ask for a free Site Check, the person who sent it can see the name and website you gave us, whether your Site Check was sent, and whether you go on to work with us. Clients who refer you see your first name only. They never see your email address, phone number, goals or Site Check results. We use this to credit the right person and, where a referral agreement applies, to pay their share. Opening a Curveball without filling in the form shares nothing about you with its sender.

The Curveball Helper browser extension

The Curveball Helper is an optional extension for Chrome and Edge. It helps you add Curveball as a user on your website builder or Google account. It works only on the tab it opens for you, on that platform's own dashboard, and only while its card is showing. On that tab it reads the page's headings and the labels of its buttons, links and boxes, and sends that list to our server to work out the next step. It never reads what you type, never touches password or code fields, never takes screenshots, and can't see your other tabs or your browsing history. The only things it ever types are our access email address and the name of the role you're giving us, and anything that sends an invite or saves a change waits for you to tap Yes. When an AI model helps choose the next step, the same list of labels goes to our model provider, Qwen Cloud, for that one request. We log each step without anything typed. A Helper session ends after an hour, when you tap Stop, or when you close the tab, and you can remove the extension from your browser at any time.

Google data

Only the Curveball team signs in with Google here. The portal never asks you to. With our permission it reads our calendars and free and busy times to offer meeting times, creates the meetings we schedule with you (with a Google Meet link, and your name and email on the invite), and reads the details of meetings on our calendars. Files you share with us in the portal are kept in our Google Drive. Our website checks also use Google's keyword planning figures, such as how many people search for a service near a town. Google sign-in keys are kept private, encrypted in the portal, and used only for these jobs. We don't sell Google data, use it for advertising, or share it beyond the services that run this portal. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Facebook, Instagram, LinkedIn, Threads, YouTube and Pinterest

If you connect your Facebook Page, Instagram, LinkedIn, Threads, YouTube channel or Pinterest in the portal, you sign in on that platform's own page and choose what to share. We never see your password. We receive your Page's or account's name and ID and a key that lets us publish posts on your behalf and read how those posts did (likes, comments, shares, saves, views and clicks). On Pinterest, that means Pins on one of your boards, each leading to a page on your website. We use it only to publish the posts you or Curveball approved for your business and to report on them. The key is encrypted on our server and never shown in the portal. We don't sell this data, use it for advertising, or share it beyond the services that run this portal.

To delete it, press Disconnect on your Growth page. That deletes the stored key straight away. Removing Curveball Creative Studio under Business Integrations in your Facebook settings, or from the apps connected to your Pinterest, Threads, LinkedIn or Google account, also stops the key working. To have everything we hold from these platforms deleted, email Troy and we'll delete it within 30 days and confirm when it's done.

Third parties

Fonts, illustrations and interface scripts are served from this site. When direct form delivery is configured, messages are sent through Resend. If the site prepares an email draft instead, your email provider handles it when you choose to send. Vercel hosts this site and measures page speed anonymously, without cookies. Google Analytics counts visits. Links to VCE, Twist and reference websites open services with their own privacy practices.

Your rights

Ask us what we hold about you and we will tell you. Ask us to delete it and we will. Email Troy to ask.

Last updated October 2026.