Privacy Statement

Last updated: October 10, 2026

Cor is operated by Sergey Stovba, doing business as Cor, in Seattle, Washington, United States (“we,” “us,” or “our”).

This statement explains how Cor handles information when you use our website, apps, bank connections, AI features, and support services.

Cor does not sell your personal information or use your financial information for advertising.

Information we collect

Account information

When you sign in through Google or an email link, we receive information needed to create and authenticate your account, including your email address, account identifier, and name when provided. We use Google Firebase for authentication.

Connected financial accounts

When you connect a financial institution through Plaid, Cor receives information made available through that connection, including:

Cor does not receive your bank password. Authentication takes place through Plaid or your financial institution.

Cor stores the Plaid access token used to retrieve your information in encrypted form on its server. The token is not provided to Cor’s browser or mobile interface.

Information you add

We collect information you enter or change, such as transaction names, categories, tags, notes, income sources, answers about deposits, and preferences.

Chat messages and attachments

We process the messages you send to Cor’s chat and files you attach, such as screenshots or bills, to respond to your questions.

Chat attachments are processed for the associated request rather than kept by Cor as a permanent file collection. This does not mean that AI providers retain no copies; their processing and retention are described below.

Support requests

When you contact Support, we receive your message, contact information, and any attachments you submit. We keep requests in Cor and reply by email.

Usage information

We use Google Analytics to understand visits and app usage. This includes pages or screens viewed, interactions, device and browser information, and approximate location derived from network information.

Cor does not send bank transactions, financial amounts, names, or chat messages to Google Analytics. The Android app does not use an advertising ID.

Inferences

Cor derives information from your financial activity, such as recurring payments, possible subscriptions, spending patterns, estimated income, and an approximate home postal code.

These are estimates and may be incorrect.

How we use information

We use information to:

AI processing

Cor uses Google’s Gemini service to help categorize transactions, identify patterns, generate suggestions, and answer chat questions.

Depending on the feature, information sent to Gemini may include merchant descriptions, transaction amounts and dates, relevant financial context, your messages, and attachments. Cor limits submissions to information relevant to the task and does not intentionally include bank passwords, Plaid access tokens, or full bank account numbers.

AI suggestions are kept separate from original bank data, and supported changes can be undone. AI output may be inaccurate and should be checked before you rely on it.

Cor currently uses Gemini’s unpaid service. Under the applicable unpaid-service terms, Google may use submitted content and generated responses to improve its products and machine-learning technologies, and human reviewers may review that content. This processing is separate from Cor’s own storage practices.

Do not include passwords, Social Security numbers, complete account numbers, or unnecessary identifying information in chat messages or attachments.

Attachment redaction

Before uploading attachments through Cor’s attachment tools, Cor attempts to obscure supported sensitive information, including identification numbers, ID photos and signatures, and Social Security numbers. For Support attachments, or when Hide amounts is enabled, it also attempts to obscure financial amounts.

Automatic redaction can miss information. It does not guarantee that a file is anonymous or contains no sensitive information. Check files and remove information you do not want to share before submitting them.

Files sent directly by email do not pass through Cor’s in-app redaction tools.

Search and weather

To look up alternatives and potentially relevant programs, Cor uses Gemini and web search with location and purchase-type information, such as your town and the kind of purchase, rather than sending your transaction history as a search query.

For weather, Cor sends an inferred home postal code from its server to Open-Meteo. Your browser or phone does not contact Open-Meteo directly for this feature.

Providers that handle information

Cor uses these providers:

Providers may handle information on our behalf or under their own applicable terms and privacy policies. In particular, Plaid’s independent processing and Google’s unpaid AI processing are not limited to Cor’s own retention practices.

We may also disclose information when required by law or valid legal process, or when reasonably necessary to address fraud, security incidents, or threats to users’ safety or rights.

Security and information on your device

Cor uses HTTPS to encrypt information in transit and encrypts stored Plaid access tokens. No service can guarantee absolute security.

Financial records are maintained on Cor’s servers. The app also stores local preferences, such as hidden sections and previously displayed notifications. Information shown on screen, in widgets, or in notifications may be visible to someone with access to your device.

App lock uses your device’s authentication features. Cor does not receive your fingerprint, facial recognition data, or device passcode.

Widgets and notifications retrieve information from Cor’s server when they update. Use your device settings to control their visibility.

Where information is processed

Cor is operated from the United States. Information is processed through the providers listed above and may be handled in the United States or other countries where those providers operate.

Retention and deletion

Cor retains account and financial information while your account is active, hibernating, or deactivated, unless you delete it earlier.

While your account is hibernating, Cor keeps your banks connected and continues to retrieve your transactions so it can send the alerts you choose.

Deactivate account, under Settings › Danger zone, ends your subscription at the end of the period you have paid for and then disconnects your banks. Your information is kept until you sign in again or delete your account.

Records of payments and refunds (the amount, date, store, and the email address on the account) are kept after an account is deleted, as needed for accounting, tax, and legal obligations.

You can export your information or select Delete all data under Settings › Backup & data.

Delete all data disconnects your linked banks through Plaid and deletes the associated information from Cor’s active application records, including imported accounts and transactions, connections, information you added, insights, history, and settings. This action cannot be undone.

In the Android app, this action also deletes your Cor sign-in account. It does not delete your Google account or accounts at your financial institutions.

For instructions on closing your account, including outside the Android app, see Delete your account.

Disconnecting a bank stops future retrieval through that connection; it does not automatically delete information previously imported into Cor.

Deleting Cor data does not necessarily delete support correspondence, provider security records, or information a provider retains independently under its own policies. Contact us if you also want to request deletion of support correspondence or need help completing an account-deletion request.

Your choices and rights

You can disconnect banks, export information, change supported settings, and request account deletion.

Depending on where you live and which laws apply, you may also have rights to access, correct, delete, or obtain a copy of your personal information, or to object to or restrict certain processing.

Send privacy requests to support@cor.money. We may need to verify your identity before fulfilling a request. You may also have the right to complain to the relevant privacy regulator.

Children

Cor is intended for people aged 18 or older. We do not knowingly collect personal information from children under 18.

If you believe a child has provided information to Cor, contact us so we can investigate and take appropriate action.

Changes to this statement

We may update this statement as Cor changes. We will update the date above and provide notice of material changes in the app or by email. Where required, we will obtain consent before applying a new use of your information.

Contact

Sergey Stovba, doing business as Cor
Seattle, Washington, United States
support@cor.money

Terms of Use · Delete your account