goCORA App Privacy Policy

Effective date: 12 October 2026 · Applies to the goCORA app (app ID com.gocora.app) on iOS, Android and Windows, and to account sign-in and the contact and Help Center forms on gocora.com

1. Who we are

The goCORA app is published by CORA Cyber Security Inc. ("goCORA", "we", "us"), PO Box 33024, Windsor PRO Lakeview, ON Canada N8Y 0A2. Contact us about privacy at [email protected].

This policy covers the goCORA app and the gocora.com sign-in page and forms described in sections 3.5 to 3.9. Our websites are otherwise covered by our website privacy policy.

2. What stays on your device

goCORA connects directly from your device to your email provider (for example Gmail, Outlook or your own mail server). The following is stored only on your device and is not sent to goCORA:

• Email accounts and credentials: your email addresses, and the passwords, app passwords or sign-in tokens used to connect to your email provider. These are stored in an encrypted database on your device.
• Your email: messages, attachments, folders, tags, sender lists and similar settings that goCORA keeps for offline use and search. These are stored in encrypted databases on your device.
• Contacts: if you allow access, goCORA reads your device contacts to show sender names and photos and to help you address messages. Contact photos may be saved on your device as a cache. Contacts are not uploaded to goCORA.
• Biometric unlock: if you use Face ID, fingerprint or Windows Hello, your operating system handles the check. goCORA never receives your biometric data.
• AI API keys: if you enter an OpenAI or Anthropic API key, it is kept in your device's secure storage (Keychain, Android Keystore or Windows credential storage).
• Backups: backups you create in goCORA are encrypted with a passphrase you choose and saved wherever you decide. goCORA does not receive them.
• Secure email keys: each secure email you send gets its own key, which stays on the device that sent it, protected by that device and by your multi-device PIN. goCORA's servers never receive these keys or your messages.

Your emails always remain with your email provider, which handles them under its own privacy policy.

3. Information we or our service providers process

3.1 Your goCORA account (optional)

If you create a goCORA account, we use Google Firebase Authentication (operated by Google LLC) to manage it. Firebase processes:

• your sign-in email address and password (Firebase stores a secure hash, not your password in plain text);
• two-step verification (authenticator app) enrollment, if you turn it on;
• technical data needed for sign-in, such as IP address, device type and timestamps, which Google may log for security.

We use this only to sign you in, protect your account and let you delete it. See Firebase privacy information.

goCORA's sign-in service. When you create a goCORA account, sign in, or reset your password, in the app or on gocora.com, your email address and password pass through a small sign-in service that we run on Google Cloud (Cloud Run, in the United States) on their way to Firebase. The service does not store or log your password, your email address or your sign-in tokens. To protect accounts against password guessing and fake sign-ups, it:

• keeps short-lived counts of attempts per email address and per network (IP) address. These are stored as scrambled codes (a keyed hash) that cannot be turned back into your email or IP address, and are deleted automatically, normally within a day or two;
• may briefly refuse sign-in after too many attempts (you can wait, or sign in on gocora.com with the security check described in section 3.9);
• refuses new accounts that use temporary (disposable) email services.

3.2 Signing in to email providers

When you add an email account, goCORA connects directly to that provider. For Microsoft accounts (Outlook.com, Microsoft 365), you sign in on Microsoft's own page and goCORA receives a sign-in token that lets it read and send your mail. For other providers, including Gmail, you enter a password or app password. In every case, credentials stay encrypted on your device and are never sent to goCORA.

3.3 Importing Google contacts (optional)

If you choose to import contacts from your Google account, goCORA requests read-only access to your Google contacts. They are stored only on your device. goCORA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.4 Purchases

goCORA Premium and any subscriptions are sold through the Apple App Store, Google Play or the Microsoft Store. The store processes your payment. goCORA does not receive your payment card details. goCORA asks the store only whether your store account owns a purchase, and keeps that answer on your device.

3.5 Deleting your account on our website

If you delete your account on our website, you enter your password again (and your two-step verification code, if you use it), and your browser then deletes your account and its data as described in section 8. No email is sent.

3.6 Contact form on our website

If you use the contact form on gocora.com, we receive the name, email address and message you enter. The form sends them to our support team by email so we can reply to you. We don't add you to a mailing list or use your details for anything else, and we keep your message only as long as we need it to deal with your request.

3.7 Help Center feedback

When you answer "Was this helpful?" on a page of our Help Center, we record the page, your answer, the time and your browser type. If you use "Report an issue", we also store your message and, only if you enter it, your email address so we can reply to you. We use this only to improve our help pages and answer your report. It is stored on our website's hosting servers. To have a report deleted, contact [email protected].

3.8 Feature votes and suggestions

On the Suggest a feature page (opened from Settings in the app or from our Help Center) you can vote for upcoming features and send us an idea. Votes are anonymous: your browser keeps a random ID so each browser has one vote per feature, and we store that ID with the feature you voted for, the time, and, if you came from the app, the app version and platform (for example "Android"). We do not link votes to your goCORA account and we do not store your IP address with them. If you send a suggestion, we store your text, the page language, the same app version and platform, and, only if you enter it, your email address so we can reply to you. We use this only to decide what to build next and to answer you. It is stored on our website's hosting servers. You can remove a vote by tapping Vote again; to have a suggestion deleted, contact [email protected].

3.9 Security check on our sign-in page (Cloudflare Turnstile)

The sign-in page on gocora.com uses Cloudflare Turnstile (operated by Cloudflare, Inc.) to tell people apart from automated programs. To do this, Cloudflare processes technical information from your browser, such as your IP address and browser and device characteristics. Most of the time the check runs in the background; sometimes it asks you to tick a box. Our sign-in service then sends the check's one-time result and your IP address to Cloudflare to confirm it. We use the check only to protect sign-in; it is not used for advertising or tracking by goCORA. The goCORA app does not use Turnstile. See Cloudflare's privacy policy.

3.10 Secure email (CORA encryption)

If you use secure email (sending email encrypted with CORA), goCORA stores the following on Google Cloud, linked to your goCORA account. It never includes your messages, their text or the keys that open them.

• Your security key, when you set up a multi-device PIN, in Google Firestore. It is encrypted on your device with your PIN before it is sent, so goCORA cannot open it. When you change or reset the PIN, the previous key is kept so your older secure emails stay readable: for about 4 hours after a change and 3 months after a reset. It is then deleted automatically.
• Your backup account, if you add one: its goCORA account ID and email address, so it can use your security key.
• goCORA's secure email service (Cloud Run and Firestore, in the United States) keeps: the devices where you use secure email (a random code for each installation, its platform such as "Android", whether it has Premium, and dates); which accounts are your main and backup account; and, for devices without Premium, how many secure emails your account sent this month, to apply the free limit. Monthly counts are deleted automatically about a month after the month ends. The service's logs do not contain email addresses, sign-in tokens or these codes.
• In the email itself: each secure email contains the random code of the device that sent it ("Sender-Id"), so goCORA knows which of your devices holds its key. The code does not contain your name or email address.

4. Optional AI features (OpenAI and Anthropic)

goCORA can summarize, translate, suggest replies and extract information from your email using an AI provider. These features are off until you turn them on, and they use your own API key from the provider you choose.

• Permission first: before goCORA sends anything to a provider for the first time, it shows you what will be sent and asks for your permission. Nothing is sent if you decline. You can withdraw permission at any time in Settings.
• What is sent when you use an AI action: the sender, subject, date and text of the message you selected. For a thread summary, it also sends other messages in that conversation, including your own sent replies. goCORA sends message text, not the raw HTML, and it does not send attachments, recipient lists or your contacts.
• Who receives it: the data goes directly from your device to the provider you chose, along with your API key and your IP address. It does not pass through goCORA's servers.
• How the provider uses it: the provider processes the data under its own terms and privacy policy, and may keep it for a limited time. See the OpenAI privacy policy and the Anthropic privacy policy.
• goCORA does not use your email content to train AI models, and does not receive the AI results.
• AI model list: the list of AI models and their estimated costs is built into the app. If you tap Update model list, the app downloads the latest list from gocora.com. That request contains nothing about you: no account, email address, API key, model choice or device identifier. goCORA does not record who downloads the list; like any website, our hosting provider's web servers keep standard access logs (which include the IP address) for a limited time.

5. What we don't do

• No advertising, and no advertising or tracking SDKs.
• No analytics or crash-reporting services.
• No selling or renting of personal information.
• No reading of your email by goCORA staff. We have no access to it.

6. Who we share information with

Recipient	What	Why
Google (Firebase Authentication)	goCORA account email, password hash, two-step verification data, sign-in technical data	To run your goCORA account
Google (Google Cloud, which hosts goCORA's sign-in service)	Your email address and password while you sign in (passed through, not stored), and scrambled attempt counts (section 3.1)	To protect sign-in against password guessing and fake sign-ups
Google (Firestore and Google Cloud, which host goCORA's secure email service)	Your PIN-protected security key, your backup account's ID and email, your registered devices and monthly secure email count (section 3.10)	To make secure email work across your devices and apply the free limit
Cloudflare (Turnstile)	Browser and device technical data, including IP address, when you use the gocora.com sign-in page (section 3.9)	Security check against automated sign-in attempts
Your email providers	Your credentials and the mail you send and receive	Direct connection, so you can read and send email
OpenAI or Anthropic (only if you allow it)	The email content described in section 4, your API key and IP address	AI features you request
Apple, Google or Microsoft stores	Purchase information, handled by the store	In-app purchases
Our website and email hosting provider	Contact form messages, Help Center feedback and reports, and feature votes and suggestions (sections 3.6 to 3.8)	To run gocora.com, store Help Center feedback and deliver contact form messages to our support team
Authorities	Only what we hold, and only if the law requires it	Legal obligations

These companies may process data outside your country, including in the United States.

7. Security

Data stored by goCORA on your device is encrypted, and the encryption keys are kept in your device's secure storage. Connections to email providers, goCORA's sign-in service, Firebase and AI providers use TLS encryption. You can also require sign-in, two-step verification and biometric unlock to open goCORA. Your security key for secure email is encrypted with your multi-device PIN on your device before it is stored (section 3.10). No system is perfectly secure, but we design goCORA so that your email never reaches our servers.

8. Keeping and deleting your data

• Delete your goCORA account in the app: Settings → account → Delete account. Your goCORA account and two-step verification settings are deleted immediately and permanently, together with your secure email data (section 3.10): your security key and any older keys, your backup account link, and everything goCORA's secure email service keeps for your account. If you delete a backup account, it is also removed from the main account. You can also choose to erase all email accounts and data from the device at the same time.
• Delete your account on the web:
  1. Sign in to your account at https://gocora.com/account/signin.html
  2. Use the Delete my account button on your "My Account" page that opens with a successful sign in, and enter your password to confirm.
  This deletes the same data as deleting in the app (above), immediately and permanently. Forgot your password? Use Forgot password? on the sign-in page to reset it first.
• Data on your device stays until you delete it in goCORA, remove the email account, or uninstall the app.
• Contact messages, Help Center reports and feature suggestions are kept only as long as we need them to answer you and improve our help pages and the app. To have yours deleted sooner, email [email protected].
• Firebase may keep security logs or backups for a limited period under Google's policies after your account is deleted.
• Sign-in attempt counts (scrambled codes, section 3.1) are deleted automatically, normally within a day or two. Our sign-in service's logs record only which kind of request was made, its outcome and how long it took, with no email addresses, passwords or IP addresses.
• Deleting your account does not cancel store subscriptions or refund purchases. Manage those in your App Store, Google Play or Microsoft account.

9. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, Canada's PIPEDA or California's CCPA/CPRA), you may have the right to access, correct, delete or port your personal information, to object to or restrict processing, and to withdraw consent. Because most data is stored only on your device, you control it directly in goCORA. For anything we hold, email [email protected]. You may also complain to your local data protection authority.

10. Children

goCORA is not directed at children under 13 (or under 16 where local law sets a higher age). We don't knowingly collect personal information from children. If you believe a child has created a goCORA account, contact us and we will delete it.

11. Changes to this policy

We will update this page when goCORA changes how it handles data, and change the effective date above. If we make a significant change, such as sending new kinds of data to a provider, goCORA will tell you in the app and, where required, ask for your permission again.

12. Contact

CORA Cyber Security Inc. · PO Box 33024, Windsor PRO Lakeview, ON Canada N8Y 0A2 · [email protected]