Privacy Policy

• Account info — your email address and authentication details. Sign-in is handled by Supabase; if you use Google sign-in we receive your email and basic profile from Google.
• Content you submit — video titles, descriptions, tags, transcripts, channel URLs and any notes you paste in, plus the results we generate from them.
• Usage data — which features you use, when, and basic technical data like browser type and error logs, so we can keep the app working.
• Payment data — your plan status and subscription ID. Payments run through Paddle as merchant of record. We never see or store your card number; it stays with Paddle and its processors.

• To run the service: score visibility, generate optimized titles, descriptions, FAQs and chapters, and show your history.
• To manage your account, subscription and access level.
• To fix bugs, monitor abuse and improve the product in aggregate.
• To send you service emails (receipts, account and security notices) and, only if you opted in, product updates. You can unsubscribe from marketing at any time.

We do not sell your data and we do not use your private video content for advertising.

• Supabase — database, authentication and hosting for your account and saved scans.
• Paddle — payment processing, invoicing and tax as merchant of record.
• Lovable AI gateway — the AI provider that generates scoring and optimization output. The content you submit for analysis is sent to this provider to produce your results.
• YouTube's public Data API — used to read publicly available channel and video statistics when a feature needs them.

We may also disclose data if the law requires it, or to protect the service and its users from abuse.

• Scan and optimization history is kept while your account is open, so you can go back to it.
• If you delete your account, we remove your account data and content within 30 days.
• Billing and tax records are kept longer where the law requires it, and are held by Paddle as well as us.
• Anonymised, aggregated statistics that can't identify you may be kept indefinitely.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Email hello@corahq.com from your account address and we'll respond within 30 days. You can also delete individual scans and optimizations from inside the app at any time.

We use cookies and local storage that are needed for the app to work — mainly keeping you signed in and remembering your session. Paddle sets its own cookies during checkout to process your payment and prevent fraud. We do not run third-party advertising trackers.

Traffic to and from CoraHQ is encrypted in transit (HTTPS). Account data sits in a managed Supabase database with row-level access rules so users can only read their own records, and administrative access is limited to people who need it. No system is perfectly secure, so we don't claim it is — if we ever discover a breach affecting your data, we'll tell you.

CoraHQ isn't directed at anyone under 18 and we don't knowingly collect data from children. If you believe a minor has created an account, email us and we'll remove it.

If we change how we handle data we'll update this page and move the “last updated” date. For significant changes we'll also email account holders or show a notice in the app before the change takes effect.

Questions or requests: hello@corahq.com.