Privacy Policy
This page explains what we collect when you use CORVIX, why we collect it, and what you can do about it. We've tried to write it the way we'd actually explain it to someone, not the way a legal template usually reads.
What we collect
When you create an account, we store your email address and a hashed version of your password. We never store your actual password in a form anyone, including us, can read.
Because two-factor authentication is required on every account, we store the secret needed to check your codes and a set of hashed one-time backup codes. If you link Telegram for alerts, we store your Telegram chat ID so we know where to send them.
Anything you enter into CORVIX itself, like a conviction book, a watchlist, or advisor client data, is stored under your account so it follows you between devices.
We do not collect payment card details. When billing goes live, our payment processor, Paddle, handles that directly, and we only ever see that a payment succeeded or failed.
Cookies
CORVIX uses one cookie: a session cookie that keeps you logged in. It is not used for advertising or tracking across other sites, and we don't run third-party ad trackers on the site.
Who we share data with
We use a small number of service providers to run CORVIX, and your data passes through them as part of that:
- Render, which hosts our servers and database.
- Resend, which sends account emails like verification and password reset links.
- Cloudflare, which sits in front of the site for security and performance.
- Paddle, which will handle payments once billing is live.
We don't sell your data, and we don't share it with anyone else for marketing purposes.
Some of these providers operate and store data on servers outside the country where you live, including outside the EU, UK, and Singapore. Where your data is transferred internationally, it remains subject to this policy and to the safeguards those providers are contractually required to maintain.
How long we keep it
We keep your account data for as long as your account is active. If you don't verify a new account, we periodically clean up unverified signups after 30 days.
Your rights
You can ask us to access, correct, or delete your account and the data tied to it at any time by emailing [email protected], and we'll respond within a reasonable period. If you're in the EU or UK, you also have rights under the GDPR, including the right to lodge a complaint with your local data protection authority. If you're in Singapore, you have rights under the PDPA.
Security
Passwords are hashed, not stored in plain text. All traffic to CORVIX is encrypted in transit. Two-factor authentication is required on every account as an additional layer of protection. That said, no method of transmitting or storing data is completely secure, and while we take reasonable steps to protect your information, we cannot guarantee its absolute security.
Changes to this policy
If we change what we collect or how we use it, we'll update this page and the date at the top.