Privacy

Curioflux is a single-user, self-hosted knowledge base. Everything below describes the deployment at curioflux.com.

What is stored

• The links, posts and text you capture, fetched copies of pages, extracted summaries, entities and relations, and search indexes. All of it lives on the server and in its backups.
• Your account: the email address you sign in with and the date it was created, plus the passkeys you choose to add. No password is stored.
• Access tokens you create for MCP, stored as a hash. The token itself is shown once.
• Captures also arrive through the Telegram bot, which sends them to the server.
• Nothing else is stored.

What Google shares at sign-in

Sign-in uses Google Identity Services. The sign-in page loads Google's script, which verifies your identity and tells Curioflux only your email address and that it is verified. Curioflux keeps no Google access token.

What leaves the server

• Text fetched from public links is sent to the AI provider for summarising and linking, unless the capture is private. Text you paste is sent only when you choose Allow AI. Private captures never reach any AI provider.
• MCP clients you authorise can read your knowledge base. A token you revoke stops working immediately.
• Backups are encrypted with restic and stored in Cloudflare R2.
• The site itself is served through Cloudflare's network.

Data you can delete

Every source has a Forget action that removes it, its archived copy, its note and its relations. Backup snapshots age out on the retention schedule.

Questions: reach the owner through github.com/sanamhub.