Privacy policy

Who we are

coredu is operated by Coredu s.r.o., Panská 229/4, 470 01 Česká Lípa, Czech Republic (IČO 24397784, C 55307 at the Regional Court in Ústí nad Labem). We are the data controller for the personal data described here. For anything in this policy — including any of the requests below — write to privacy@coredu.app.

If you join the waitlist

We store:

• Your email address.
• Where you came from — the referring page, and which page or lesson the signup came from.
• The date you joined.

We use it for exactly one thing: to email you when coredu opens, and occasional updates about the launch until then. We do not sell it, rent it, or share it with anyone for their own marketing.

The lawful basis is your consent, given when you submit the form. You can withdraw it at any time — reply to any email from us, or write to the address above, and we will delete your record. Every email we send will carry an unsubscribe link.

We keep waitlist entries until launch and for up to 12 months after, or until you ask us to delete yours, whichever comes first.

If you create an account

We store your email address and an encrypted form of your password (handled by our authentication provider — we never see the password itself), plus the content you create: your canvases, knots, lessons, notes, uploaded images, audio and video, and your settings.

The lawful basis is performance of our contract with you: we cannot run the product without it. We keep it for as long as your account exists. Delete your account and we delete the content with it.

Analytics

We measure how the product is used — pages viewed, features used, performance and errors — so we can fix what is broken and build what is used. This is collected in a pseudonymised form and we do not use it to build advertising profiles or share it with ad networks.

By default nothing is stored on or read from your device for this, so we do not ask your permission for it — there is nothing to give permission for. The lawful basis for the measurement itself is our legitimate interest in operating and improving the service, and you can object at any time: the switch in the section below turns it off completely, and the contact above reaches us for anything else. Where we do store something — the cookie you can opt into below — the basis is your consent, and you can withdraw it in the same place.

AI features

When you use an AI feature, the content you send — your prompt and the relevant part of your canvas — is transmitted to a third-party model provider to generate a response. It is sent for that purpose only. Providers we use are contractually barred from training their models on it.

The models we use are Google’s Gemini, Anthropic’s Claude and OpenAI’s GPT models for text, and Recraft for generated images and illustrations. Claude and GPT are reached through Vercel’s AI gateway, which routes the request and does not use its contents for anything else. Which model handles a given request depends on the feature and on the model you pick.

Do not put anything into AI features you would not want transmitted.

Who processes data for us

We use the providers below. They act as our processors — on our instructions, only for the purpose named, and under a contract that holds them to it. This is the complete list; if it changes we update this page.

• SupabaseDatabase, authentication and file storage — your account and everything you create in it.Hosted in the European Union. Runs on Amazon Web Services.
• VercelHosting and content delivery for the website and app, plus traffic and performance measurement, and the AI gateway that routes requests to the model providers below.Served from the location nearest you, so this can be anywhere in the world. Runs on Amazon Web Services.
• PostHogProduct analytics — which features are used, and errors.Hosted in the European Union.
• PlunkSending transactional and waitlist email.Hosted in the European Union; mail may transit the United States on its way to you.
• Trigger.devRunning background jobs, such as processing the sources you add.Hosted in the European Union; some jobs may run in the United States.
• GoogleGenerating AI content with the Gemini models.United States.
• AnthropicGenerating AI content with the Claude models, reached through the Vercel AI gateway.United States.
• OpenAIGenerating AI content with the GPT models, reached through the Vercel AI gateway.United States.
• RecraftGenerating images and vector illustrations.United States.

Where a provider names a sub-processor of its own, it is the infrastructure it runs on, shown above. We do not hold a direct relationship with those companies — our contract is with the provider, and the provider is answerable to us for them.

Some of these operate outside the European Economic Area, principally in the United States. Where they do, transfers are covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard, such as the provider’s certification under the EU–US Data Privacy Framework.

Cookies and your analytics choice

We set cookies that are strictly necessary to keep you signed in, to keep the service secure, and to remember the choice you make below. Those need no permission and cannot be turned off without breaking the site. We do not use advertising or cross-site-tracking cookies at all.

Analytics are separate and are yours to decide. In the EEA, the UK and Switzerland we ask before putting anything on your device — that is the banner you may have seen on our home or waitlist page. Decline it and nothing is stored: we still count that the visit happened, storing and reading nothing, under our legitimate interest in knowing whether the product works. If you would rather we did not count you at all, the switch below turns analytics off completely.

That storage-free measurement counts that a visit happened using a temporary fingerprint our analytics provider calculates on its own servers and re-randomises daily. Nothing is written to or read from your device, and it cannot be tied back to you. It also cannot recognise you tomorrow, which is the trade we have made and the one thing the optional cookie below changes: with it we can tell that two visits were the same browser, which is how we know whether a change we made actually helped.

Outside Europe analytics start on with that cookie already set, because local law asks us to offer a way out rather than a way in. That way out is the same switch below, and it works from anywhere.

Separately, our hosting provider measures page traffic and how fast pages load. That measurement is cookieless — it stores nothing on your device and reads nothing from it — so it needs no permission and is unaffected by the choice below.

Your rights

If you are in the UK or the EEA you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw consent at any time. Ask at privacy@coredu.app and we will respond within 30 days.

You also have the right to complain to your local data protection authority.

Children

coredu is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will delete it.

Changes

If we change this policy we will update the date at the top, and for anything significant we will tell the people it affects by email.