Privacy policy

What we collect

• Your account. If you sign in with Apple we receive the identifier Apple gives us and, if you allow it, your email address. If you sign up with an email and password we store the address and a hash of the password — never the password. We ask for your date of birth when you create an account, to check you are 13 or over and to know whether the extra protections for under-18s apply; we keep it for that. If Apple shares your name, we keep it to greet you.
• Your work. The handwriting on your canvases, the documents you import, your conversations with Cora, the plans you build, and your review history. This is the product; without it there is nothing to come back to.
• Ordinary technical records. Request logs, including your IP address, kept to run the service and to stop abuse. For each reply Cora gives we also note how long it took, what it cost us, and which app and version asked, so we can see when something is slow or broken. Not the words.
• Reports you send. If you tap Report on one of Cora’s replies, we keep that reply, the question just before it, and anything you write in the report, so we can fix what was wrong. Only the person who runs Corollary reads them. The rest of the conversation is not part of the report. Reports are deleted with your account.
• The launch list, if you ask to be on it. Before Corollary opens you can leave an email address to be told when it does. We store that address, which plan you were looking at when you asked, which part of the page you asked from, which of our pages it was, where the visit came from (a search engine, a linking site, or a campaign tag), which version of the page you were shown, what brought you here if you answer the one optional question after joining, the date, and — once we have written to you — the date we did. Nothing else: no name, no IP address, no tracking identifier. It is used for one message and is not a newsletter. Ask us and we will take you off it, or simply ignore the one email.

Who else handles your data

We use a small number of companies to run Corollary. Each one gets only what it needs for its job. We do not sell your work, and we do not use it to advertise to you.

• Render runs our servers and our database, in the United States. Everything in your account is stored there.
• Cloudflare R2 stores the files you upload: photos of your work, PDFs, and imported pages.
• OpenAI runs the model that answers you. See below for what it receives.
• Anthropic reads the page when you ask Cora about your handwriting on a canvas or notebook page, and answers in OpenAI’s place if OpenAI cannot be reached. See below for what it receives.
• Resend sends our emails, such as verifying your address, resetting a password, and the one launch-list message. It receives your email address and the message.
• Stripe takes payment if you buy a plan on the web. You enter your card on Stripe’s own page, so we never see or store the card number. We keep what you bought, its status, and the customer reference Stripe gives us.
• Apple handles sign-in if you choose Sign in with Apple. If you use Hide My Email, Apple gives us a relay address and we never see your real one. Our emails reach you through that relay.

When you ask Cora anything, the relevant part of your work goes to the model provider that answers: an image of the region of the page in question, the text of the conversation, and the context Cora needs. The provider processes it to produce the reply.

Today that provider is OpenAI, under its API terms. OpenAI does not use work sent through its API to train its models. It may keep what we send, and what it sends back, for up to 30 days to detect abuse, and then deletes it, unless the law requires it to keep it longer.

When you ask Cora about what you have written on a canvas or notebook page, the image of that page goes to Anthropic instead, under its API terms. Anthropic does not use work sent through its API to train its models. It deletes what we send, and what it sends back, within 30 days. It may keep content longer if its safety systems flag it or the law requires it. Anthropic also answers in OpenAI’s place, on the same terms, when OpenAI cannot be reached; then your question goes to Anthropic instead of OpenAI. Nothing else you do in Corollary goes to Anthropic. If we ever add or change providers, this page changes with it, and we will say so before it happens.

Children

Corollary is for students aged 13 and over. We ask for your date of birth when you sign up and do not create an account below that age. We do not knowingly collect anything from a child under 13; if you believe one has an account, write to us and we will delete it.

Students under 18 are treated more carefully than adults, not less. See how we measure the product below, and our safety page.

How we measure the product

To know whether Corollary works we record that certain things happened — an account was created, a question was asked, a review card was graded. These records hold shapes and counts, never what you wrote: not your questions, not your handwriting, not your notes.

When you make an account we also note which app you used and, on the web, where the visit came from (a search engine, a site that linked to us, or a campaign tag in the link). If you answer the optional “How did you hear about us?” at the end of setup, we count that answer too. It is a choice from a list, never something you type.

They stay on our own servers. We do not use Google Analytics or any other third-party analytics service, there is no advertising or tracking network in the app or on this site, and nothing follows you to any other app or website.

If you are under 18, we do not keep a per-person record at all. Your activity is counted through a daily code derived from your account, which cannot be linked back to you and cannot be joined across days into a history. You appear in the totals; you do not appear as a person with a trail.

Adults can switch this off in Settings, which drops the per-person record and leaves only the same anonymous daily count.

On this website we count visits anonymously: that a page was opened, which parts of it were scrolled to, which buttons were pressed, and where the visit came from (a search engine, a site that linked to us, or a campaign tag in the link). No cookie is set for this, and no identifier, IP address or device detail is stored with it, so a count cannot be tied to you or joined with any other visit. If you join the launch list, the browser tab keeps a single note that you did, so our pages stop asking; it holds no address or identifier and is gone when you close the tab.

Keeping and deleting

Your work stays until you remove it or close your account. Deleting your account from Settings removes your account and the work attached to it from our database immediately.

Request logs, including IP addresses, are kept for 30 days and then deleted. Encrypted database backups are kept for 30 days, so work you delete can persist in a backup for up to that long before ageing out. Records of a deleted account are removed from backups on the same schedule.

The launch list is deleted once the launch message has been sent. It exists to send one email and has no reason to outlive it.

Your choices

You can export or delete your work at any time from Settings. The export is one JSON file with your conversations, canvases, plans, notes and review history in it; uploaded files are listed rather than included, and security tokens are left out on purpose. Deleting asks you to confirm once, and then it is gone. If you are over 18 you can also turn off per-person measurement there.

If you would rather ask a person — or you want the uploaded files themselves — write to support@getcorollary.app.