Privacy Policy

Effective March 27, 2026

This Privacy Policy describes how Cortex ("the Service"), operated by Cortex ("we", "us", "our") in Toronto, Ontario, Canada, collects, uses, and protects your personal information. We are committed to handling your data responsibly and transparently.

1. Data We Collect

Account Information

When you create an account through Clerk, we collect your email address and display name. Clerk handles the authentication process and securely manages your credentials.

Content You Create

We store the content you create within the Service, including:

• Concepts and their explanations
• Notes and annotations
• Cortexes (collections of concepts)
• Spaced repetition review history and scores

Usage Data

We collect basic usage information to improve the Service, including pages visited, features used, and review statistics. We do not use third-party analytics or advertising trackers.

Payment Information

Payment processing is handled entirely by Stripe. We do not store, process, or have access to your credit card details. We receive only confirmation of payment status from Stripe.

AI Generation Data

When you use AI features, we send prompts to third-party AI providers to generate content on your behalf:

• Anthropic Claude -- receives concept titles and context to generate explanations
• Google Gemini -- receives scene descriptions to generate illustrations

These prompts may include concept titles, brief descriptions, and related context you have provided. We do not send your personal information (name, email) to AI providers.

2. How We Use Your Data

We use the data we collect to:

• Provide and operate the Service -- store your content, power spaced repetition, and deliver AI-generated explanations and images
• Process payments -- manage subscriptions and billing through Stripe
• Send service-related communications -- account confirmations, billing receipts, and important service updates
• Improve the Service -- understand usage patterns to make Cortex better
• Generate AI content -- create concept explanations and illustrations tailored to your learning

We do not sell your data. We do not use your data for advertising. We do not send marketing emails.

3. Third-Party Services

Cortex relies on the following third-party services to operate. Each has its own privacy policy governing how they handle data:

4. Data Storage and Security

• Your account and content data is stored in a Neon PostgreSQL database hosted in the US East region
• AI-generated images are stored in Cloudflare R2
• All data is encrypted in transit via HTTPS
• Access to production data is restricted to authorized personnel (the operator)

While we take reasonable measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

5. Data Retention

• Active accounts -- your data is retained for as long as your account is active
• Account deletion -- upon request, your account and associated data will be deleted within 30 days
• AI-generated content -- content generated by third-party AI providers may be cached or retained by those providers in accordance with their own privacy policies
• Billing records -- Stripe may retain transaction records as required by law, independent of your Cortex account status

6. Your Rights

You have the right to:

• Access your data -- view all your content within the app. A full data export feature is planned
• Delete your data -- delete your account through your account settings, which will remove your data within 30 days
• Opt out of communications -- we currently do not send marketing emails. Service-related emails (billing, account security) cannot be opted out of

As a Canadian service, we operate in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA). If you believe your privacy rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada.

7. Cookies

Cortex uses a minimal number of cookies:

• Authentication cookies -- set by Clerk to maintain your login session. These are essential for the Service to function
• No advertising cookies -- we do not use any advertising or retargeting cookies
• No third-party tracking -- we do not embed third-party tracking scripts (Google Analytics, Facebook Pixel, etc.)

8. Children's Privacy

Cortex is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the email address associated with your account. The "Effective" date at the top of this page indicates when the policy was last revised.

---