666 CURSE

Legal

Privacy Policy

Last updated: 10 October 2026

This policy describes how 666 CURSE handles information in connection with the website and digital Cast purchases. It reflects the product as implemented today.

1. Who we are

666 CURSE is operated by LucyTo Trade s.r.o., Hálkova 1639/14, 120 00 Praha 2, Czech Republic. Company ID (IČO): 01719408. Privacy contact: curse@666curse.com.

2. Information we process

Purchase and personalization

  • Buyer email address (receipt, recovery, transactional messages)
  • Personalization you provide (such as target name/nickname, addressing text, optional signature)
  • Selected curse and related catalog identifiers needed to fulfill the Cast
  • Payment-related identifiers and amounts stored for fulfillment, refunds, and support (payment card details are handled by Stripe, not stored as full card numbers in our application database)

Generated Cast content

  • Cast content snapshot, public token, Curse Number, and related asset metadata
  • Public Curse Page content and downloadable image assets once a Cast is active

Reports and operations

  • Public-page report submissions (reason category) for moderation review
  • Limited operator/admin records used for support, refunds, and moderation

Technical and security

  • Privacy-hashed rate-limit / abuse-control signals derived from network identifiers (not used as a customer profile)
  • Server logs stripped of secrets and unnecessary personal data

3. Cookies and similar storage

We use first-party cookies for:

  • Analytics identity: curse_vid (visitor), curse_sid (session), curse_acq (first-touch campaign metadata such as allow-listed UTM fields / referrer host)
  • Attribution: src_cast when you visit a public Curse Page, so a later checkout can optionally associate a source Cast

These cookies are set by our application middleware. We do not use third-party advertising cookies. Google Analytics, described below, sets its own measurement cookies (_ga and _ga_*) on 666curse.com.

4. Analytics

We operate first-party product analytics (allow-listed event names and properties). Browser analytics does not accept buyer email, payment secrets, or free-text personal content as event payloads. Server-side events may associate a Cast or curse definition id where needed for product metrics.

On the live site we also use Google Analytics 4 (measurement ID G-7YPEK09R7F) to measure page views, navigation between pages, and engagement such as scrolls and outbound clicks when those features are enabled in the Google Analytics property. The tag loads after the page is shown and does not receive buyer email or payment details from our application. Google’s retention for that property is controlled in Google Analytics, not in our database.

Raw analytics retention is designed around approximately 90 days; automated deletion may be configured by the operator and is not guaranteed as a continuous schedule in every environment.

5. Processors and storage

  • Stripe — payment processing, tax calculation at checkout, and related payment events
  • Neon / PostgreSQL — application database for checkout, payments, Casts, jobs, analytics, and support records
  • Cloudflare R2 (S3-compatible) — Cast image assets and master artwork objects
  • Resend — transactional email (confirmation and recovery). We do not email the named target
  • Vercel — application hosting
  • Google Analytics — site measurement on 666curse.com (page views and engagement). Not used for advertising cookies in this implementation

6. How we use information

  • Fulfill purchases and create Casts
  • Send transactional email to the buyer
  • Provide recovery for lost Cast links
  • Operate public Cast pages and downloads
  • Prevent abuse and secure the service
  • Support refunds, disputes, and moderation
  • Understand product usage via first-party analytics and Google Analytics

7. Sharing

We share data with processors listed above to run the service. We do not sell personal information. Public Cast pages expose only the public Cast presentation (not buyer email or payment identifiers).

8. Retention

Paid Cast obligations and related records are retained to fulfill the product, handle refunds/disputes, and maintain integrity of Curse Numbers. Exact multi-year retention schedules beyond operational need are not fully published here and may be refined by the operator.

9. Your choices

  • Use browser controls to clear cookies (analytics and attribution will reset)
  • Use “Lost your curse?” recovery with the purchase email to regain access links
  • Contact curse@666curse.com regarding access or correction requests

10. Children

The service is intended for adults (18+). We do not knowingly sell Casts to children.

11. International users

The service may be accessed from multiple countries. Processing occurs through the hosting and processor locations used by Vercel, Neon, Stripe, Resend, and Cloudflare as configured by the operator.

12. Changes

We may update this policy. The “Last updated” date will change when we do.

13. Contact

Privacy requests: curse@666curse.com.

This policy describes implemented product behavior. It is not attorney-reviewed legal advice.