Full spoilers follow.
The film opens with a cold, unexplained prologue: a girl runs from her house in high heels, circles in terror while her father calls after her, drives to a beach and sits alone through the night. The next shot is her corpse, limbs broken into an impossible shape. The audience never learns her name or what reached her — the sequence exists to establish the rules through their outcome, and to promise that the film will not flinch.
Jay's boyfriend "Hugh" takes her to a movie, and she notices him staring at a woman she cannot see. After they have sex in his car, he chloroforms her and she wakes tied to a wheelchair in an abandoned building, where he explains: something will now follow her, walking slowly but relentlessly, visible only to the cursed, able to take the form of strangers or of loved ones in order to get close. It can be passed on through sex, but if the new carrier dies, it returns down the chain to her. "Hugh" is revealed to be a young man named Jeff Redmond living under a false name at his mother's house — a coward, but one who at least passed on the instructions.
The pursuit escalates through a series of forms: a naked woman in Jay's bedroom doorway, an impossibly tall man, an old woman in a hospital gown on the school lawn, and — most disturbingly — figures wearing the faces of family. Jay flees to a lake house with Kelly, Yara, Paul and Greg. There the entity attacks and the group shoots it; it bleeds but does not die, proving it is corporeal and yet effectively invulnerable.
Jay passes the curse to Greg, who doesn't truly believe in it and takes no precautions. The entity comes for him in the form of his own mother, half-dressed, and kills him in his house while Jay watches through the window — the film's cruelest joke about how intimacy and family are used as camouflage. With Greg dead, the thing turns back toward Jay.
The group's final plan is to lure it into a public swimming pool and electrocute it by throwing in plugged-in appliances. Mitchell himself has described this as "the stupidest plan ever," something out of Scooby-Doo, and it goes as badly as that implies: the entity, wearing the form of Jay's father, hurls the appliances at her instead. Paul shoots it in the head; it falls into the water, blood clouds the pool, and the surviving teenagers leave without confirmation that it is gone.
Afterward, Paul and Jay sleep together — she accepts the transfer of the curse to him, the very thing he has wanted all along, which makes the act simultaneously romantic and transactional. In the final scene Paul drives past sex workers, slowing, implying he may be considering passing it on in turn; the film declines to show whether he does. Then Jay and Paul walk down a suburban sidewalk holding hands, and far behind them a figure walks in the same direction. Cut to black.
The unresolved elements are deliberate. The figure may be the entity or an ordinary pedestrian; Mitchell has kept the answer open. The deeper meaning becomes clear in retrospect: the entity was never a puzzle to be solved, because there is no plan, no weapon and no distance that defeats it. It is mortality, and the curse's true rule is that the chain of carriers is simply the chain of human beings. What Jay wins is not victory but company — the image she once daydreamed about, holding hands with someone on a pretty road, achieved at last with death walking behind her. That is the film's closing argument: there is no escape, only moments, and who you spend them with.