Privacy Policy

What we store

• Your account: name, email address, a hash of your password (never the password), and whether your email is verified. If you sign in with Google or GitHub, the name, email and picture they share.
• Your profile: your username and profile picture. They show in CoreCat AI and in CoreCat Rewards.
• Your sessions: when and from which device and network address you signed in, so you can see and end them on the Account page.
• What you create: your prompts, files and reference images you upload, the images, videos and audio made, and your chat history. They are kept in your library until you delete them.
• Your Core Credits: the starter grant, what each use cost (model, time, amount), top-ups and credits added from CoreCat Rewards.
• Connections: API keys (only a one-way hash of the secret is kept, never the key itself) and the apps you approved through Claude, ChatGPT, Cursor, CoreCat Code or another connector, with the permissions you gave.
• Abuse prevention: your email in a normalised form (so one person gets one starter grant), the network (the first three numbers of your address) and a random device id for sign-ups, and security log lines for sign-in and key events.

CoreCat Code

• CoreCat Code runs on your computer. Its sign-in tokens, settings, session history and project notes are saved on your machine (in ~/.corecat-code and in your project folder), not on our servers.
• When you give it a task, it sends your prompt and the code and files it reads for that task to the model you selected, through CoreCat. Only send code you are allowed to share.
• We record each request's model, size and Core Credits cost for your wallet. We do not keep a copy of your code or of the conversation on our servers.

Who receives it

• AI model providers: your prompt, settings, uploads, and for CoreCat Code the code and files it sends, go to the provider of the model you pick, through CoreCat's AI infrastructure partners. Each provider handles them under its own terms. Do not send anything you are not willing to share with them.
• Crypto top-ups: payments are handled by the CoreCat Rewards payment service, which keeps the invoice, the payment address and the transaction. Transactions on BNB Smart Chain are public.
• CoreCat Rewards: if you use the separate CoreCat Rewards program (corecat.network), it signs you in with your CoreCat account and the two products share your account id, name, email, username and picture. Rewards can add Core Credits to your account. Rewards has its own terms and privacy page.
• Email delivery: your email address and the message are handled by our transactional email provider when we send you a verification or password-reset message.
• Bot protection: our sign-up form uses Cloudflare Turnstile (or hCaptcha), which sees your browser and network address when it runs.
• Analytics: the website uses Microsoft Clarity to see how pages are used (page views, clicks, scrolling). Clarity sets its own cookies.
• Logos: model and provider logos are loaded from Brandfetch, which sees your browser and network address when your browser loads them.
• The CoreCat team: administrators can view accounts, generations and chats for support and abuse prevention.
• Nobody else: we do not sell your data and do not use it for advertising.

Cookies

We use a sign-in cookie to keep you signed in, your browser's storage for settings such as the theme, and the cookies of Microsoft Clarity and the bot check described above.

Your choices

You can delete individual generations and chats, end sessions, revoke API keys and disconnect apps on the Account page. Sign out of CoreCat Code with "corecat logout", or delete its folder on your computer. To delete your account or ask for a copy of your data, write to [OWNER: support email address (set SUPPORT_EMAIL)].

CoreCat AI is for people aged 18 and older.

[COUNSEL: legal basis, retention periods per data type, international transfers, rights requests and response times, and the data-controller details for your jurisdiction.]