Privacy Policy

Last updated 22 July 2026

Cortu is a personal memory compiler: it turns what you learn in AI study conversations into atomic concept cards and helps you revise them with spaced repetition. This policy explains exactly what we do and do not collect, who processes your data, and the rights you have over it. It applies to cortu.app, the Cortu mobile app, and the ChatGPT and Claude connectors.

The short version

• We never store your conversations. Extraction runs inside your own ChatGPT or Claude. Only the distilled concepts you choose to save are sent to us. There is no field in our database for raw chat text — the privacy guarantee is structural, not just a promise.
• We run no AI on your data. Our servers only validate and store the concepts you send. We do not send your data to any language model, and we do not use your data to train models.
• Your data is yours alone. Row-Level Security means every concept, recall card, and revision result is readable only by your account.
• We don't sell your data and we don't use it for advertising.

Who we are

Cortu is operated by Mendios Technologies Bangalore Pvt Ltd (WebMobi), the data controller for the information described here. Our contact details are at the end of this policy.

What we collect

• Account — the email address you sign in with, and a display name if you provide one. Authentication is handled by Supabase.
• Concept cards — the structured concepts you save from a connector or import: title, definition, an optional formula, a worked example, an optional common mistake and exam tip, difficulty, topic, and subject.
• Recall questions — the front/back cards generated for each concept.
• Study progress — spaced-repetition state (interval, ease, next-due), your streak, and a rolling memory score, so revision works and improves over time.
• Import metadata — the source type (e.g. ChatGPT, Claude, paste) and counts, used for your usage meter. We do not store the source material itself.
• Basic technical logs — standard request logs and error diagnostics needed to run the service securely and reliably.

What we never collect

• Your AI conversations or their transcripts.
• Uploaded PDFs or images beyond what is needed to extract concepts (and any such file is deleted after processing).
• Payment card details — billing, when introduced, is handled by a payment processor.
• Special-category data. Cortu is not intended for sensitive personal information.

Connecting ChatGPT and Claude

When you link a connector, you authorize it through OAuth to save concepts into your Cortu account. The connector sends only the structured concepts — the conversation stays in your AI app. ChatGPT and Claude are operated by OpenAI and Anthropic respectively under their own privacy policies; what happens inside those apps is governed by them, not by Cortu. You can review and revoke Cortu's access from the connector settings in ChatGPT or Claude at any time.

How your data is used

We use your data solely to provide Cortu: storing your cards, scheduling revision, showing your progress, generating printable study packs, sending you sign-in codes and essential service notices, and keeping the service secure. Our legal bases (where the GDPR applies) are performance of our contract with you and our legitimate interest in operating and securing the service.

Who else processes your data (sub-processors)

We share data only with the service providers we need to run Cortu:

• Supabase — Database, authentication, and storage (hosts your account and concept data).
• Vercel — Application hosting and content delivery.
• Resend — Transactional email (sign-in codes and account notices).

These providers act on our instructions and may process data in other countries; where required we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can delete individual concepts in-app, or email us to exercise any of these rights. We do not sell or "share" personal information as those terms are defined under U.S. state privacy laws, and we will not discriminate against you for exercising your rights.

Data retention and deletion

Your concepts and progress are retained while your account is active. You can delete individual concepts, or request full account deletion, after which your data is removed from our active systems (backups age out on their normal cycle).

Children

Cortu is not directed to children under 13, and you must be old enough to form a binding contract in your country to use it. If you are under 18, use Cortu only with the involvement of a parent, guardian, or teacher. We do not knowingly collect data from children under 13; if you believe we have, contact us and we will delete it.

Security

Data is stored in Supabase (Postgres) with Row-Level Security enforcing per-user access, served only over TLS. Secrets are held server-side only and are never shipped in the app. See our Security page for the specific controls we ship.

Changes to this policy

We may update this policy as Cortu evolves. For material changes we will update the date above and, where appropriate, notify you in-app or by email. Continued use after an update means you accept the revised policy.

Contact

Questions about this policy, or to exercise your data rights, email sachin@cortu.app.