Privacy
Last updated 19 September 2026
Core5 is a tool for doing your own work. It has no analytics, no tracking and no advertising, and your data is never sold, shared for marketing, or used to train anyone's models.
Who is responsible
Core5 ("we") is the controller of the data described here. For anything on this page, including any request about your data, write to privacy@core5app.com — that address reaches the person who runs it, and no one else.
What Core5 stores, and where
Your account
An email address, so you can sign in and so your work can follow you from one of your devices to the next. You can sign in with a password, with an emailed link, or with Apple or Google. If you set a password, what is stored is a one-way hash of it, by Supabase's authentication service — never the password itself, and there is no way to read it back.
The work you create in Core5
Tasks, projects, comments, focus sessions, mail-sorting rules and your settings. Held in a database hosted by Supabase in Ireland (EU), encrypted in transit (TLS) and at rest (AES-256). Row-level security means every row is readable only by the account that owns it — enforced by the database, not by the app.
Organizations (Teams)
Your organization sees only what you place in its workspace. Personal tasks, projects, mail, calendar and focus sessions never leave your account. Inside an organization, the people in it can see your display name, your title and your place in the org chart; its administrators also see a log of changes to that structure — who was invited, moved or removed — never of your work.
Your Google account
If you connect Google, Core5 reads your Calendar and Gmail so it can show them, and writes back the changes you make. Two things are worth being precise about:
- Where the permission lives. Your Google tokens are kept in the operating system's keychain on your own Apple devices, synced through your iCloud Keychain if you have it on. A copy of the refresh token is also held on our server, encrypted with a key kept outside the database and readable by no person and no client — it is what keeps your mail alerts instant when your devices are off. Disconnecting the account deletes it.
- Your mail and calendar are not copied to our servers. They travel between your device and Google directly, and are cached on your device so the app works offline.
Core5's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In plain terms: that data is used only to provide the features you can see in the app, it is not transferred to anyone except as needed to provide those features, it is not used for advertising, and no human reads it. There is a page listing every permission and the feature that needs it.
When you ask Core5 to write something
Core5 can draft, rewrite or translate an email for you. Only when you ask, the text you are working on is sent to Anthropic (Claude) to produce the reply, and the answer comes straight back to you. This is a transfer to a provider in the United States, made under the European Commission's Standard Contractual Clauses. Anthropic does not use data submitted through its API to train its models. If you never use those buttons, nothing is ever sent.
If you connect Slack, Notion or HubSpot
These are optional. Their access tokens are stored encrypted on our servers, because the connection has to keep working while the app is closed. They are used only to carry out the rules you set up, and are deleted when you disconnect the service.
What Core5 never does
- No analytics, no telemetry, no behavioural profiling, no advertising identifiers.
- No selling or renting your data, and no sharing it for anyone else's marketing.
- No using your content to train machine-learning models — ours or anybody's.
- No person at Core5 reads your mail, calendar or tasks, and none of it is stored on our servers. The server holds the Google permission so that one automated job can run while your devices are off — keeping your mail alerts alive — and nothing else uses it.
Cookies
This website sets no cookies and carries no third-party scripts. The app stores a session on your device so you stay signed in, which is what makes it work rather than something we watch you with.
The companies that process data for us
| Who | What for | Where |
|---|---|---|
| Supabase | Database, authentication, server functions | Ireland (EU) |
| Vercel | Hosting this website | EU / global edge |
| Your calendar and mail — only if you connect them | Global | |
| Anthropic | Writing assistance — only when you ask for it | United States |
| Resend | Sending your sign-in emails | Ireland (EU) |
How long it is kept
Your content is kept until you delete it or close your account. Deleting your account removes your rows immediately and permanently — see Delete your account. Backups holding a copy are rotated out within 14 days. Disconnecting Google removes its tokens from your device and from our server at once; revoking Core5 in your Google account ends the permission everywhere.
Your rights
Under the GDPR you can ask for a copy of your data, correct it, have it deleted, take it elsewhere, restrict how it is handled, or object to it. Deleting is built into the app; for anything else, write to privacy@core5app.com and you will have an answer within 30 days. You can also complain to your national data protection authority — in Spain, the AEPD.
Legal basis
We handle your data to perform the contract you enter into by using Core5 (Article 6(1)(b) GDPR). Connecting Google, Slack, Notion or HubSpot, and using the writing assistance, are each done on your consent, which you can withdraw at any time by disconnecting them.
Children
Core5 is not directed at children under 16 and we do not knowingly collect their data.
Changes
If this policy changes in a way that affects you, the date above changes and we tell you by email before it takes effect.