Privacy
Last updated 1 September 2026
Core5 is a tool for doing your own work. It has no analytics, no tracking and no advertising, and your data is never sold, shared for marketing, or used to train anyone's models.
Who is responsible
Core5 is operated by Pedro Gainza ("we"). For anything on this page, including any request about your data, write to privacy@core5app.com.
What Core5 stores, and where
Your account
An email address, so you can sign in and so your work can follow you from one of your devices to the next. Sign-in is by emailed link; Core5 stores no password.
The work you create in Core5
Tasks, projects, comments, focus sessions, mail-sorting rules and your settings. Held in a database hosted by Supabase in Ireland (EU), encrypted in transit (TLS) and at rest (AES-256). Row-level security means every row is readable only by the account that owns it — enforced by the database, not by the app.
Your Google account
If you connect Google, Core5 reads your Calendar, Gmail and Google Tasks so it can show them, and writes back the changes you make. Two things are worth being precise about:
- The keys stay on your device. Your Google access and refresh tokens are kept in the operating system's keychain on your own Apple devices, synced through your iCloud Keychain if you have it on. They are never sent to our servers.
- Your mail and calendar are not copied to our servers. They travel between your device and Google directly, and are cached on your device so the app works offline.
Core5's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In plain terms: that data is used only to provide the features you can see in the app, it is not transferred to anyone except as needed to provide those features, it is not used for advertising, and no human reads it. There is a page listing every permission and the feature that needs it.
When you ask Core5 to write something
Core5 can draft, rewrite or translate an email for you. Only when you ask, the text you are working on is sent to Anthropic (Claude) to produce the reply, and the answer comes straight back to you. This is a transfer to a provider in the United States, made under the European Commission's Standard Contractual Clauses. Anthropic does not use data submitted through its API to train its models. If you never use those buttons, nothing is ever sent.
If you connect Slack, Notion or HubSpot
These are optional. Their access tokens are stored encrypted on our servers, because the connection has to keep working while the app is closed. They are used only to carry out the rules you set up, and are deleted when you disconnect the service.
What Core5 never does
- No analytics, no telemetry, no behavioural profiling, no advertising identifiers.
- No selling or renting your data, and no sharing it for anyone else's marketing.
- No using your content to train machine-learning models — ours or anybody's.
- No reading your mail, calendar or tasks by hand. We do not have access to them.
Cookies
This website sets no cookies and carries no third-party scripts. The app stores a session on your device so you stay signed in, which is what makes it work rather than something we watch you with.
The companies that process data for us
| Who | What for | Where |
|---|---|---|
| Supabase | Database, authentication, server functions | Ireland (EU) |
| Vercel | Hosting this website | EU / global edge |
| Your calendar, mail and tasks — only if you connect them | Global | |
| Anthropic | Writing assistance — only when you ask for it | United States |
| Resend | Sending your sign-in emails | Ireland (EU) |
How long it is kept
Your content is kept until you delete it or close your account. Deleting your account removes your rows immediately and permanently — see Delete your account. Backups holding a copy are rotated out within 14 days. Disconnecting Google removes its tokens from your device at once.
Your rights
Under the GDPR you can ask for a copy of your data, correct it, have it deleted, take it elsewhere, or object to how it is handled. Deleting is built into the app; for anything else, write to privacy@core5app.com and you will have an answer within 30 days. You can also complain to your national data protection authority — in Spain, the AEPD.
Legal basis
We handle your data to perform the contract you enter into by using Core5 (Article 6(1)(b) GDPR). Connecting Google, Slack, Notion or HubSpot, and using the writing assistance, are each done on your consent, which you can withdraw at any time by disconnecting them.
Children
Core5 is not directed at children under 16 and we do not knowingly collect their data.
Changes
If this policy changes in a way that affects you, the date above changes and we tell you by email before it takes effect.