Privacy Policy

This policy explains exactly what Coeur, Inc. ("Coeur", "we") collects, why, and what we will never touch. It applies to the coeur.ai website, the free scan, and the monitoring product.

1. What we collect

• Your account. Your email address, and — if you tell us — your name and company. We sign you in with a magic link, so we never hold a password for you.
• Scan targets. The URLs you ask us to scan or watch, when we scanned them, and each scan's result.
• Findings, not data. A finding records that something is exposed — a table name, an approximate row count, a header name — never the contents behind it. We do not read, copy, or store the rows in your database, the files in your buckets, or your users' personal data. If a check can see that a table is publicly readable, it stops there.
• Billing. Payments run through Stripe. We keep your plan, invoices, and payment status; Stripe holds your card details — we never see the full number.
• Usage basics. Standard logs (IP address, browser type, pages visited) to keep the service secure and working. We use a session token in your browser's local storage to keep you signed in — no advertising cookies, no third-party trackers.

2. How we use it

• To run the scans you request and watch the apps you've told us to watch.
• To alert you — by email, in the dashboard, or in Slack if you connect it — the moment an app is exposed.
• To write the plain-English briefing on each report. The factual findings (never your app's user data) are sent to Anthropic's Claude API to generate that explanation; detection itself is deterministic code, and the AI only explains what the code found.
• To bill you, answer your messages, and send the transactional email the service requires (sign-in links, alerts, receipts).
• We never sell your data, and we never use your findings to train models or build datasets.

3. Who we share it with

Only the subprocessors it takes to run the service: our hosting provider (infrastructure), Stripe (payments), Anthropic (report briefings, as described above), and our email delivery provider (the messages you've asked for). Each receives the minimum needed to do its job. We'll disclose information if the law genuinely requires it, and we'll tell you when we're allowed to. Your findings are confidential — we never publish them or share them with anyone else.

4. How long we keep it

Scan history and findings stay as long as your account does — the exposure timeline is part of the product's value to you. Test-account sessions are short-lived and die on revocation. Delete your account and we delete your data within 30 days, keeping only what invoicing law requires us to retain.

5. How we protect it

Everything moves over encrypted connections and is stored encrypted at rest. Access to production data is restricted to the small number of people who operate the service. We watch our own apps with Coeur — and yes, we'd tell you if we ever had a breach that affected you, promptly and plainly.

6. Your rights

Email us and we'll show you the data we hold on you, correct it, export it, or delete it — whichever you ask. If you're in the EU/EEA, UK, or California, these are your statutory rights (GDPR, CCPA); we honor them for everyone regardless of where you live. We don't discriminate against you for exercising them.

7. Scans and the apps we check

One more time, because it's the heart of the product: when Coeur scans an app, it looks at that app from the outside, reads only what the app already makes public, performs no writes, and stores evidence about the exposure — not the exposed data itself.

8. Changes and contact

If we change this policy in any material way, we'll email you before the change takes effect. Questions, requests, or concerns: hello@coeur.ai, or the contact page.