Your protocol, symptom, supplement, meal, exercise, and lab entries stay on your device. If you use Cōrta AI, your question and relevant app context are sent securely to our AI providers to generate a reply. An optional email is used for a one-time welcome message. We do not sell personal data or use health entries for advertising.
This policy explains what Cōrta collects, why, and what control you have over it. Cōrta is a cortisol and HPA-axis protocol tracker operated by the Cōrta team. If anything here is unclear, email privacy@getcorta.app.
Who we are
Cōrta ("Cōrta," "we," "us," or "our") is a health-tracking application and website operated by the Cōrta team. This policy applies to our website at getcorta.app and to the Cōrta mobile app. For privacy questions, contact privacy@getcorta.app. For anything else, contact hello@getcorta.app.
What we collect
We collect the minimum data needed to operate the website and app:
- On-device app data. Protocol, symptom, supplement, meal, exercise, lab, settings, and chat history are stored locally on your device.
- Optional email and name. If you provide them during onboarding or on the website, they are used to send requested product communications, including a one-time welcome email.
- AI requests. When you use Cōrta AI, your question, active protocol, and recent logs are sent through Supabase to Anthropic to generate a response.
- Product analytics. We collect app screen and interaction events, purchase status, and technical information through PostHog to understand and improve the product. We do not send health entries, AI messages, names, or email addresses to PostHog.
How we use your data
- On-device app data powers your tracking, trends, reports, and app experience.
- Email and name are used only for communications you request. You can unsubscribe where applicable or contact us.
- AI request data is used to answer the question you submit.
- Product analytics is used to improve reliability and understand which features are useful.
Your health data stays yours
Your health-related entries are stored on your device unless you choose to send relevant context to Cōrta AI. We never sell your health data and never use it for advertising or marketing. You can erase local app data at any time using Reset all data in Profile.
Legal bases for processing
Where data-protection laws such as the GDPR apply, we rely on the following legal bases:
- Consent — for optional email communications and for information you choose to send to Cōrta AI. You can withdraw consent at any time.
- Legitimate interests — for aggregate, privacy-respecting analytics used to operate and improve our website and app.
- Contract — where processing is necessary to provide a service you have asked us to provide.
Data retention
App entries remain on your device until you delete them or reset the app. We keep email records until they are no longer needed for the requested communication or you ask us to delete them. AI providers and product analytics providers retain data under their applicable terms and configured retention periods. We do not keep personal data longer than needed for the purposes described here.
Your rights
You can ask us to:
- Access the personal data we hold about you.
- Correct data that is inaccurate.
- Delete your data ("right to be forgotten").
- Export a copy of your data.
- Object to or restrict certain processing, and withdraw consent.
To exercise any of these rights, email privacy@getcorta.app. Depending on where you live, you may also have the right to lodge a complaint with your local data-protection authority.
How we share data
We do not sell your personal data. We share data only with service providers that help us operate: Supabase for backend functions, Resend for requested email, Anthropic for Cōrta AI responses, RevenueCat and the App Store for subscriptions, and PostHog for product analytics. They process data under their own privacy commitments. We may also disclose data when required by law or to protect users or the public.
Security
We use reasonable technical and organizational measures to protect your data, including encryption in transit and access controls on our systems. No method of transmission or storage is perfectly secure, but we work to safeguard the data you trust us with and to limit what we collect in the first place.
Children
Cōrta is intended for adults aged 18 and over. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact privacy@getcorta.app and we will delete it.
International data transfers
We may process and store data in countries other than the one you live in, including the United States. Where we transfer personal data across borders, we take steps to ensure it receives an adequate level of protection, using appropriate safeguards such as standard contractual clauses where required.
Medical disclaimer
Cōrta is an educational and self-tracking tool. It is not medical advice, and it is not a medical device. Nothing in the app or on this website is intended to diagnose, treat, cure, or prevent any condition. Always consult a qualified clinician about your health, symptoms, and any changes to your routine.
Changes to this policy
We may update this policy as the product evolves or as laws change. When we make material changes, we will update the effective date below and, where appropriate, notify you. Continued use of the website or app after changes take effect means you accept the updated policy.
Contact us
Questions about this policy or your data? Email us at privacy@getcorta.app for privacy and legal matters, or hello@getcorta.app for anything else.
Effective date: July 1, 2026.