Privacy policy

What we collect

Your conversations

The messages you send, the answers Cortex generates, the files you attach and anything you save into a project. Encrypted before storage under a key that belongs to your account.

Account details

Your email address and the identifiers our identity provider, WorkOS AuthKit, issues. If you pay, Stripe holds the card; we hold a customer reference and the plan you are on.

Usage counts

How many messages, reasoning runs, searches and sandbox executions you have used against your plan's limits. Counts, not content.

Operational logs

Request identifiers, timings, error codes and coarse client information, for keeping the service up and investigating faults. Message content is redacted from logs at the point they are written rather than filtered afterwards.

Safety records

That a crisis referral was shown, its category and when. Never the message that triggered it — see the AI disclosures for why.

What we do not do with it

• We do not train models on your conversations. No part of the Cortex pipeline reads them for that purpose. Conversations are encrypted under a key held for your account alone.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising. Under the CCPA/CPRA those are defined terms, and neither applies to us — which is why there is no “Do Not Sell” link on this site. There is nothing for it to switch off.
• We do not use your content to build advertising profiles.

How your content is encrypted

Every account has its own data encryption key. Conversations, attachments and project files are encrypted under it before they reach the database or object storage. The key itself is wrapped by a key-management service in AWS us-east-1 and is never stored in plaintext beside the data it protects.

This is what makes deletion mean something. It is also the honest limit on it: the wrapped key lives in the same database, so a point-in-time restore inside the backup window brings it back along with everything else. That window is 35 days, and the section below is written around it.

How long we keep things

Conversations and projects

Until you delete them, or until you delete your account.

Deleted account, grace period

30 days. Your account is deactivated immediately and the erasure runs after the grace period, so a deletion made by mistake can be undone within it.

Deleted account, backups

A further 35 days. Production database backups (Amazon Aurora point-in-time restore in AWS us-east-1) are kept for 35 days for disaster recovery, so a restore taken before your erasure completed would still contain the wrapped key. Thirty-five days after the erasure runs, every backup that could restore it has expired.

Operational logs

30 days, then deleted.

Safety and audit records

Retained beyond account deletion, holding one-way fingerprints rather than identifiers. These records prove that obligations were met and are the one class of data that has to survive the deletion of the account it concerns.

Billing records

Kept as long as tax and accounting law requires, typically seven years.

What deletion actually does

Your data key is destroyed first, before any row is touched. That makes every ciphertext under it unreadable at once — wherever it happens to live, including copies in object storage and copies inside a backup. Overwriting rows alone would not achieve this: a restore brings overwritten rows back.

Rows, files, the full-text index and the vector index are then cleared. If that pass fails part-way it resumes rather than restarting, and the data is already unreadable while it does.

What survives is a record that the deletion happened, holding one-way fingerprints derived from your identifiers and no content. It exists so that a database restored from backup can have the erasure replayed against it rather than quietly resurrecting an account somebody asked us to remove.

Your rights

Under the CCPA/CPRA, and comparable laws in Virginia, Colorado, Connecticut, Utah, Texas and elsewhere, you can request access to the personal information we hold, a copy of it, correction of it, and its deletion. You can exercise these from Settings, and we do not charge for them or degrade the service if you do.

If you are in the EEA or the UK, the GDPR gives you the same rights plus portability and the right to object to processing. This site is served to the EU (including at cortex.foundation/fr). Our lawful basis for processing conversation content is performance of the contract you entered into by using Cortex. There is no named data protection officer on record here.

Write to privacy@cortex.foundation for anything Settings does not cover. We respond within 45 days, and will tell you before the 45 days are up if we need the extension the statutes allow.

Who else touches your data

Cortex runs on Amazon Web Services in us-east-1: the API on EKS, the database on Aurora PostgreSQL, object storage and key management in the same region. Sign-in is WorkOS AuthKit. Model providers receive the content of the specific request they are answering so they can generate a reply. Cortex does not train models on your conversations, and this page does not claim anything about those providers’ own training policies beyond what we control.

Cortex Code reaches your GitHub repositories through Cortex’s own GitHub OAuth app (scopes repo and read:user). There is no personal-access-token paste. Optional plugins (Gmail, Slack, Drive and similar) are connected through Composio when you choose to connect them; those tools only run on the surfaces you enable (Chat, Bot, or both).

Cortex Code sessions and Cortex Bot computer sessions run in isolated Firecracker guests on our compute farm. If you pay, Stripe holds the card; we hold a customer reference and the plan you are on.

Children

Cortex is not for anyone under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has an account, write to privacy@cortex.foundation and we will delete it.

Changes to this policy

If we change how we handle your data in a way that matters, we will tell you by email before it takes effect rather than by moving the date at the top of this page.