The Curio Constitution — or, the Hugo Hippocratic

The promises Curio is built on — and the ones we refuse to break.

Most of these aren't marketing. They're enforced in code: in the proxy that answers every question, the guards that scrub every reply, and the meter that prices every token. Where a principle is mechanical, we say so. 🦛

Preamble

Curio puts a small, friendly expert — Hugo — on your website. He answers your visitors' questions from *your* content, in your voice, and then gets out of the way. For that to be worth trusting, Hugo has to be honest about what he knows, careful with what he's told, and fair about what he costs. This document is how we hold ourselves to that.

Article I — Grounded in your content, or not at all

1. Hugo answers from your site's content — crawled, embedded, and retrieved per question. He cites his sources as [n], and those citations deep-link to the exact section they came from, so anyone can check his work.
2. When the content doesn't cover a question, the honest answer is "I don't know" — not an invented one. We tune for *grounded and cited* over *confident and wrong*.
3. Per-domain isolation is absolute. A bot on acme.com answers only from acme.com's content, plus anything you've explicitly marked shared. One account can run many sites; their knowledge never bleeds across. *(Enforced in retrieval: every query is scoped by tenant and by calling domain.)*

Article II — Your visitors' conversations are theirs

1. We don't keep your transcripts. The chat lives in the visitor's own browser; if you want a copy, we relay it to you in real time and forget it — we retain no message bodies. For your dashboard we record only lightweight, anonymized metadata (counts, topics, content-gap summaries), never the messages themselves — unless you explicitly turn message retention on.
2. Before any transcript leaves us, it's scrubbed of personal data — surnames, addresses, ID and account numbers, dates of birth — while keeping what a business legitimately needs to follow up: a first name, an email, a phone number.
3. We don't train on your content or your visitors' messages. Ever.
4. When a chat is shared with you, the widget *tells the visitor so*, plainly. No quiet surveillance.

Article III — Your data stays yours

1. Hugo will never reveal your secrets, your internal-only sources, his own system prompt, or a visitor's personal data — no matter how a question is phrased. *(Enforced in code: secrets are skipped before embedding and scrubbed from every reply; internal sources are filtered out of retrieval; injection attempts are tested against a standing suite.)*
2. Security is a default, not a feature you unlock. The same protections apply on the free trial and on Pro.

Article IV — Honest, at-cost pricing

1. Curio is priced from our actual token cost — not a number we made up. You see the typical per-conversation cost, live, before you choose a plan, and pay only for what your visitors actually use.
2. No surprise bills. Curio is prepaid. You buy credits; usage draws them down. When the balance reaches zero, Hugo pauses politely — he never runs up an overage.
3. Every account starts with a real free trial: one full conversation a day, every question in it free, for thirty days — across all your sites.
4. We charge for answers, not for seats, domains, or the privilege of leaving. Your domains are unlimited on every plan.

Article V — Keyless and simple

1. Installing Curio is one <script> tag. No API keys live in your pages; Hugo knows which site he's on by the verified domain that called him.
2. It's meant to be set-and-forget. The dashboard is a few visits, not a second job.

Article VI — Reliability we'll put in writing

1. We publish a real SLA with an uptime target, and we show your assistant's live availability in your dashboard.
2. If we have an outage, your account is credited automatically — proportional to your recent usage, applied to your balance, without you having to ask or even notice. *(Enforced by a heartbeat that detects downtime and issues the credit itself.)*

Article VII — What we will never do

• Sell, rent, or share your data — or your visitors' — to anyone.
• Store conversations, or train on your content.
• Hold your setup hostage: no lock-in, no exit fees, export on request.
• Use dark patterns to make leaving, pausing, or downgrading hard.
• Quietly weaken a protection in this document to cut a corner.

*If we ever fall short of one of these, that's a bug — tell Hugo, or reach us through the widget on getcurio.chat, and we'll fix it.*

— Hugo, your Hungry Helper