Security

Extraction runs inside your own ChatGPT or Claude. The connector sends only the distilled, structured concepts to our ingestion endpoint. There is no column anywhere in our database for raw chat text — the guarantee is structural, enforced by the schema, not just a policy promise.

Our servers validate the incoming concepts against a strict schema and store them. We do not forward your data to any language model, and we do not use it to train or fine-tune models.

Every application table (concepts, recall questions, revision progress, imports) is protected by Postgres Row-Level Security in Supabase, keyed to your authenticated user id. Isolation is enforced at the database layer, so an application bug cannot leak one account's cards to another. The service-role key that can bypass RLS is held server-side only and is never shipped to the browser or the mobile app.

The Claude and ChatGPT connectors authenticate with OAuth 2.1. Public connectors are required to use PKCE; confidential clients authenticate with a server-side client secret. Authorization codes are single-use, refresh tokens are stored only as SHA-256 hashes, and access tokens are short-lived. You can review and revoke Cortu's access from the connector settings in ChatGPT or Claude at any time — revoking there cuts off save access immediately.

All traffic to cortu.app and the ingestion and MCP endpoints is served over HTTPS/TLS. Data is stored in Supabase (Postgres) with encryption at rest. Application secrets — the OAuth signing secret, the Supabase service-role key, provider keys — live only in server-side environment configuration and are never bundled into the client. A build-time guard refuses to start a production deploy whose signing secret is missing or too short, so a misconfigured deploy fails loudly instead of silently trusting forged tokens.

You can delete individual concepts in the app, or request full account deletion. Deletion removes your concepts, recall cards, and progress from our active systems; backups age out on their normal cycle. See the Privacy Policy for retention specifics.

Cortu's business is the product, not your data. We do not sell or "share" personal information as those terms are defined under U.S. state privacy laws, we run no advertising on it, and we share data only with the sub-processors needed to run the service, listed in our Privacy Policy.