Privacy Policy

Curbily LLC · Last updated September 28, 2026

1. Who we are

Super Candy Labs is a brand of Curbily LLC, a Delaware limited liability company. This policy explains what we collect when you use Super Candy Labs, why, who we share it with, and how to delete it. Questions: aram.barnett@gmail.com.

2. Your tongue photo

The scan runs in your browser and your camera image is analyzed on your device. Then:

• Ages 18+ (the default): we upload the scan photo to private storage and keep it in our taste research dataset, as described in our Terms. We use it to design future candies, improve the scanner and study how tongue images relate to taste answers, which may include analysis by AI service providers (see section 6). We record when you scanned and which terms version applied. We don’t publish your photo or use it in ads without asking you first.
• “Scan without saving my photo” (a link on the scan screen): the photo never leaves your device. We receive only a few numbers derived from it (for example, color and texture summaries).
• Under 18: photos are never saved.

We do not run face recognition or collect face geometry. Try to keep your face out of frame; if part of it appears, it’s treated like the rest of the photo.

3. What we collect

• Your first name, email and birth year, and your ZIP or postal code if you give it.
• Your approximate location (country, region and city) from your internet connection, to plan where Super Candy launches.
• Numbers derived from your scan, the taste profile we generate, and saved scan photos if you chose to save them.
• Your answers to taste questions (textures, sourness, sugar, budget, diets and allergies you avoid, and similar), favorite candies and how you rate your matches.
• Which retailer links you tap. Retailers don’t tell us who bought what.
• Your phone number and texting consent, if you sign up for texts, and links you submit to #TongueCheck.
• Who invited you and who you invited, so the invite system works.
• If you reserve: your reservation number and payment status. Stripe processes payments; we never see your full card number.

4. How we use it

To run the lab and your account, generate your profile and candy matches, process reservations and refunds, send the messages you asked for, prevent abuse of invites, and research taste so we can design better candy. We use aggregated or de-identified results in CandyBench, Lab Notes and our marketing (for example, “62% of sour lovers also love crunch”), never your individual data.

5. Diet and allergy answers

If you tell us about allergies or diets, we use that only to filter your candy matches and to inform what we formulate. We don’t sell it or use it for advertising, and it’s deleted with your account.

6. Who we share it with

We don’t sell your personal information. We share it only with service providers that help us run Super Candy, under their own privacy and security terms:

• Vercel (hosting and storage) and Stripe (payments).
• Email and text providers, to send messages you asked for.
• AI service providers (for example OpenAI), to analyze saved photos or answers for research. Under their API terms they don’t use our data to train their own models.
• Retailers only get what their own sites collect when you click a link.

We may also disclose information if the law requires it, or to a successor if Curbily LLC or the Super Candy brand is sold or merged, under this policy’s promises.

7. Text messages

If you give us your mobile number and agree to texts, we send drop and reservation updates (about 2 a month). Reply STOP to opt out or HELP for help. Message and data rates may apply. Curbily LLC does not sell, rent or share your mobile number, SMS opt-in or messaging consent with any third parties or affiliates for their own marketing or promotional purposes. Mobile opt-in data is used only to provide the texts you asked for.

8. Kids

Super Candy is for ages 13 and up. If you’re under 13, we stop you before any camera access or data collection. If we learn we’ve collected information from a child under 13, we delete it. Photos from anyone under 18 are never saved.

9. Keeping and deleting your data

We keep your account data, including saved photos, until you delete your account. You can delete it any time from the bottom of your lab report (“Delete my account and data”), or by emailing aram.barnett@gmail.com. Deleting removes your profile, answers, ratings, saved photos and invite link right away. If you paid for a reservation, we keep that record (name, email, reservation number and amount) only as long as we need it for refunds, accounting and legal obligations. Aggregated or de-identified results that can’t identify you may remain.

10. Your rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Washington or Nevada), you may have the right to access, correct, delete or get a copy of your personal information, and to opt out of certain uses. Email aram.barnett@gmail.com and we’ll respond within the time the law requires. We won’t treat you differently for using these rights.

11. Security

Your data is stored in private cloud storage with access limited to the people and systems that need it. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.

12. Changes

We’ll post updates here and change the date above. If a change is material, we’ll tell you by email before it applies to data we already have.

13. Contact

Curbily LLC · Super Candy Labs · aram.barnett@gmail.com