Privacy

What we collect, and what we don't.

Last updated 6 October 2026

Curious is run by Josxph Limited (company number 15145694, England and Wales), trading as Curious. This policy covers two things: this website, and the Curious visitor guide that zoos and aquariums run for their visitors.

This website

No cookies. This site sets none. The only thing it keeps in your browser is your sign-in, if you sign in to the portal, and that is cleared when you close the tab.
Cloudflare Web Analytics. Fonts, scripts and images are served from our own domain, apart from Cloudflare Web Analytics, which counts page views without cookies and without identifying you. There is no advertising pixel and no social-media widget on this site.
The live counter. The homepage asks our own analytics service for one number, the total of visitor page views across the platform. Nothing about you is sent with that request.
The contact form. What you type (your name, e-mail, message, and your site and phone number if you add them) is sent to us as an e-mail through Resend, an e-mail delivery service, and lands in our mailbox. We keep it there so we can reply and follow up; it is not stored in any other database. Ask and we will delete it.
Hosting. The site is served by Cloudflare, which keeps the short-lived technical logs any web host keeps, such as the address a request came from, to run and protect the service.

The Curious visitor guide

When a site runs Curious, its visitors scan a code and open a website in their own browser. Curious processes that data on the site's behalf: the site is the controller and we are the processor. Visitors never create an account and are never asked for a name or an e-mail address.

Page views. Each page opened is recorded with the time, the exhibit or animal it belongs to, the browser's preferred language, the device type and brand, the browser and operating system, the country, and the network address the request came from. These records produce the site's Insights, which are aggregate: how many visitors, how long they stay, which exhibits and languages, and when the site is busiest.
A returning-visitor cookie. The guide sets a first-party cookie called curious_visitor containing a random identifier, kept for one year, so the site can count returning visitors and so a visitor's badges and trail survive between visits. It holds no personal details.
Badges, trails and progress are stored on the visitor's own phone, with a copy held on our servers under the same random identifier so they survive a phone clearing its storage.
Quiz answers, upvotes, survey responses and experience clicks are recorded against the same random identifier, never a name. Experience clicks also record the network address and device, like page views. A survey stores exactly what the visitor chooses to write.
Cloudflare Web Analytics. The guide also loads Cloudflare Web Analytics, which counts page views without cookies and without identifying the visitor.
Guide Pass. If a site sells passes, the payment is taken by Stripe for the site, on the site’s own Stripe account and under Stripe’s terms: the site is the seller, and we never see card details. We keep the pass itself: a random pass number, its short code, the price, the dates it runs and Stripe’s reference for the payment, linked to the same random identifier. A pass never carries a name or an e-mail address. The pass is also kept on the visitor’s phone, so the guide opens without asking again.
Appeals. If a site runs an appeal, donations are taken by Stripe for the site, on the site’s own Stripe account and under Stripe’s terms, and we never see card details. We keep the amount, the date, the page it was given on and Stripe’s reference for the payment, and nothing that identifies the donor. If a donor asks for a receipt, their e-mail address goes to Stripe, not to us.
Short links. When a printed short link is scanned, the scan is recorded in the same way as a page view before the visitor is sent on.

Sites that sign up

When a site creates an account we keep the name, e-mail address, site name and company name given at sign-up, and the password, stored only as a scrambled hash. We use them to run the account and to contact the site about it, and a copy of the sign-up details is e-mailed to us through Resend. Payments are taken by Stripe, which handles the card details under its own terms; we never see or store them. Account details are deleted within 90 days of the subscription ending, apart from the invoice records the law requires us to keep.

Where it lives and how long

Curious runs on Cloudflare's network, and its databases are Cloudflare D1. The individual records (page views, experience clicks and short-link scans, each with its network address) are kept while the site subscribes, and Insights adds them up into daily totals. A site's content, records and analytics are deleted within 90 days of its subscription ending. Contact-form e-mails stay in our mailbox until you ask us to delete them.

Your rights

You can ask us what we hold about you, ask for it to be corrected or deleted, or object to how it is used, by e-mailing [email protected]. We answer within a month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

When this policy changes, the date at the top changes with it. Sites are told by e-mail.

Controller: Josxph Limited, trading as Curious, company number 15145694, England and Wales (for this website); the site, for its visitor guide
Contact: [email protected]