Privacy Policy

Effective date: April 27, 2026

This policy explains what information the Corethium iOS application ("Corethium", "we", "us") collects when you use it, how we use that information, and the choices you have. By using Corethium you agree to this policy.

1. Information we collect

Information you provide

• Account information. When you sign up we collect your email address and the display name you choose. If you sign in with Apple or Google, we receive the email and name from that provider. If you add a phone number to your profile, we store that too.
• Content you create. Projects, sprints, tasks, bugs, feature requests, marketing campaigns, and conversation threads you create in the app are stored in our database under your account.

Information collected automatically

• Crash and performance diagnostics. If the app crashes or hits a performance issue, Firebase Crashlytics sends an anonymous report so we can fix bugs. The report includes the device model, operating system version, app version, and the location of the crash in our code. It does not include the content of your projects.
• Authentication tokens. Firebase Authentication issues a short-lived ID token when you sign in. We use this token to verify each request from the app to our backend. Tokens are kept on your device and refreshed automatically.

Information we do not collect

• We do not use third-party advertising SDKs.
• We do not track you across other apps or websites.
• We do not request access to your contacts, location, or photos unless you explicitly upload an asset.

2. How we use your information

• To create and maintain your account, sign you in, and let you reset your password.
• To store and display the projects, campaigns, tasks, bugs, and other content you create.
• To send you transactional notifications you have opted into (sprint reminders, campaign updates, deadline reminders).
• To diagnose crashes and performance regressions.
• To keep the service secure and prevent abuse.

We do not sell your information to anyone. We do not share it with third parties for their own marketing.

3. Where your data is stored

Corethium runs on Google Cloud and Firebase, hosted in the European Union (region europe-west1). Specifically:

• Firebase Authentication stores your sign-in identity (email, password hash, or OAuth identifier).
• Cloud Firestore stores your profile and the content you create. Each document carries an ownerUid field equal to your account's unique identifier, and Firestore security rules restrict reads and writes to the owner.
• Cloud Run hosts our backend API. Every request is authenticated against your Firebase ID token before it touches your data.
• Firebase Crashlytics stores crash reports.

4. Account deletion and data export

You can delete your account from inside the app at any time: Profile → Privacy & Security → Delete Account. We re-authenticate you, then permanently remove:

• Your Firebase Authentication record
• Your Firestore profile document
• Every campaign, project, sprint, task, bug, feature request, and conversation you own (including nested chat messages)

The deletion runs server-side so it completes even if the app is closed mid-flow. Crash reports already submitted to Firebase Crashlytics are retained for 90 days, anonymised, then purged.

To request a copy of your data, email support@corethium.app from the address on your account.

5. Children

Corethium is not directed to children under the age of 13 (or under 16 in jurisdictions that require it). We do not knowingly collect data from children. If you are a parent and believe your child has created an account, contact us and we will delete it.

6. Your rights

Depending on where you live (EU, UK, California), you may have the right to access, correct, port, or delete the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, contact support@corethium.app. We respond within 30 days.

7. Security

We use TLS for all traffic between the app and our backend, store secrets in Google Secret Manager, run our backend container as a non-root user, and require a valid Firebase ID token plus an admin role check on every internal management endpoint. No system is perfectly secure, but we treat your data with the care we would want for our own.

8. Changes to this policy

If we change this policy in a material way, we will update the effective date above and notify you in the app on next launch. Continued use of Corethium after a change means you accept the new policy.

9. Contact

Questions, complaints, or data requests: support@corethium.app.