Privacy Policy

1 Overview

Cortex ("we", "us", "our") is an agentic AI code editor for Windows. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our software and services.

We are committed to protecting your privacy. Cortex is built on a local-first, privacy-by-design architecture — your code, prompts, and API keys stay on your machine.

By using Cortex, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Software.

2 Local-First Architecture

• API keys are stored in the Windows Credential Manager, encrypted at rest by the operating system (DPAPI) and tied to your Windows user account.
• Source code and prompts are sent directly from your machine to the AI provider you selected (e.g., DeepSeek, OpenAI, Qwen) over encrypted TLS connections.
• No proxy server. Cortex does not operate a server that intercepts, stores, or logs your prompts, code, or API responses.
• Application settings (theme, model selection, UI layout) are stored locally in your user profile.

3 Data We Collect

Cortex collects minimal data to provide and improve the service:

3.1 Data You Provide

• Account information — email address and display name if you create a Cortex account.
• Subscription information — billing details processed by our third-party payment processor (we do not store full credit card numbers).
• Support communications — messages you send to our support email or contact forms.

3.2 Data Collected Automatically

• Usage telemetry — anonymous, aggregated data about feature usage, error rates, and performance (opt-in only, disabled by default).
• Crash reports — if you opt in, anonymized crash data including stack traces and system info. Crash reports never include your code, prompts, or API keys.
• License validation — when you activate or renew a subscription, your license key is validated against our servers. This transmits only your license key and device identifier.

3.3 Data We Do NOT Collect

As described in Section 2, Cortex never collects your source code, AI prompts, API keys, file contents, or project data.

4 How We Use Your Data

We use collected data for the following purposes:

• Service delivery — to provide, maintain, and improve Cortex and its features.
• Subscription management — to process payments, manage your account, and validate license keys.
• Credit metering — to track credit usage on included AI models (DeepSeek, MiMo) and enforce plan limits.
• Product improvement — to analyze anonymized usage patterns and crash reports to improve stability and performance.
• Communication — to send you important service updates, security alerts, and support responses.
• Legal compliance — to comply with applicable laws, regulations, and legal processes.

We do not sell your personal data to third parties.

5 Data Sharing & Third Parties

We share data only in the following circumstances:

• AI providers — when you use included models (DeepSeek, MiMo), your prompts are sent to the provider via API. These providers have their own privacy policies.
• Payment processor — subscription billing is handled by our third-party payment processor. We do not store your full payment card details on our servers.
• Analytics (opt-in) — if you enable telemetry, anonymous usage data may be processed by a third-party analytics provider.
• Legal requirements — we may disclose data if required by law, subpoena, court order, or government regulation.
• Business transfers — in the event of a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction.

We require all third-party processors to maintain adequate security measures and use your data only for the purposes we specify.

6 AI Provider Data

6.1 Included Models (DeepSeek, MiMo)

• Prompts are sent from your machine directly to the provider's API endpoint.
• Cortex acts as a client — we do not intercept or store the content of your requests or responses.
• Credit usage is metered server-side for subscription management purposes only.
• Your data is subject to the provider's own privacy policy and terms of service.

6.2 BYOK Models (OpenAI, Qwen, OpenRouter)

• You use your own API key to connect directly to the provider.
• As described in Section 2, all data flows directly between your machine and the AI provider — no Cortex server is involved.

7 Subscription & Billing Data

When you subscribe to a Cortex plan:

• What we store: your email address, subscription tier, subscription start/end dates, credit balance, and usage history.
• What we don't store: full credit card numbers, CVV codes, or bank account details. Payment processing is delegated to our PCI-compliant payment processor.
• License keys are generated by our system and linked to your account. They are used to validate your subscription status on your device.
• No auto-renewal. Cortex does not store recurring billing tokens. Subscriptions are 30-day plans that expire automatically and require manual renewal.

8 Premium Features Data

Cortex provides server-side subscription services — Web Search, semantic-search embeddings, and an OCR fallback for models without native vision. This section explains how data is processed when these services are used. Note: when your selected AI model natively supports vision, pasted images go directly to that provider through your own API key and never pass through Cortex's servers — see §8.2.

8.1 Web Search

When the Web Search feature is active and an active subscription exists:

• Search queries generated by the AI agent are sent to Cortex's search provider infrastructure. These queries are derived from your prompts and code context.
• Search results are retrieved, processed, and returned to your local AI session for context enrichment.
• For BYOK models that lack native web search, Cortex routes requests through its own provider (see Section 6).
• Search queries are processed ephemerally — not retained beyond the active request.

8.2 Images: Native Vision vs. OCR Fallback

Native vision (no subscription needed): if your selected model supports vision (e.g., Claude, GPT, Gemini, Grok, Kimi), pasted images are sent directly from your machine to your chosen AI provider using your own API key. Cortex's servers never receive, see, or process these images — the same privacy posture as your regular BYOK chat messages.

OCR fallback (subscription): only when your selected model lacks native vision (e.g., DeepSeek), or a native vision request fails, images are routed through Cortex's OCR infrastructure:

• Images and screenshots are sent to Cortex's OCR processing infrastructure for text extraction.
• Extracted text is returned to your local AI session. Images are not permanently stored on Cortex servers.
• Images are transmitted over TLS 1.2+, processed in memory, and discarded after the response is generated.

8.3 Semantic-Search Embeddings

When semantic search is used with an active subscription:

• What is sent: condensed excerpts of your project's source files (function/class signatures, docstrings, and key lines — capped at ~8,000 characters per file) and AI conversation summaries, for the purpose of building a local search index.
• Secret-type files are never indexed: only common source-code extensions (.py, .js, .ts, .html, .md, etc.) are read — .env files, configuration files, and key/credential files are excluded from indexing entirely.
• How it flows: excerpts are sent over TLS to Cortex's proxy, which forwards them to the embeddings provider and returns only the numerical embedding vector. The text is processed in memory and is not stored or logged on Cortex servers — only anonymous token counts are recorded for usage metering.
• Where the index lives: the resulting search index (vectors + short previews) is stored locally on your machine, never on Cortex servers.
• Without a subscription: semantic search falls back to a fully local method — no text leaves your machine.

8.4 Without a Subscription

Without an active subscription, no data is routed through Cortex's server-side service infrastructure at all. BYOK users retain full access to AI models for code generation — including native image understanding on vision-capable models, which never touches Cortex's servers either way (see Section 2).

9 Cookies & Tracking

The Cortex desktop application does not use cookies or web tracking technologies.

The Cortex website (cortex.ai) may use:

• Essential cookies — required for basic site functionality (e.g., session management, CSRF protection).
• No advertising cookies. We do not use advertising, retargeting, or social media tracking cookies.
• Analytics (opt-in) — we may use privacy-respecting analytics to understand website traffic. This data is aggregated and does not identify individual users.

You can control cookie preferences through your browser settings.

10 Data Retention

• Account data is retained for as long as your account is active, plus 90 days after deletion to allow for account recovery.
• Subscription records are retained for 3 years for financial reporting and legal compliance.
• Crash reports are retained for 90 days, then automatically deleted.
• Telemetry data is aggregated and retained indefinitely in anonymized form.
• License validation logs are retained for 1 year for security and fraud prevention.
• Premium feature data (web search queries, OCR images) is not retained — see Section 8.

You may request deletion of your data at any time by contacting us (see Section 16).

11 Security

We take reasonable measures to protect your data:

• Encryption in transit — all communications between Cortex and our servers use TLS 1.2+ encryption.
• Encryption at rest — API keys are encrypted using Windows DPAPI. Server-side data is encrypted using AES-256.
• Access controls — access to user data is restricted to authorized personnel on a need-to-know basis.
• Security audits — we conduct periodic security reviews of our infrastructure and codebase.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

12 Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your personal data ("right to be forgotten").
• Portability — request your data in a structured, machine-readable format.
• Objection — object to processing of your data for certain purposes.
• Restriction — request restriction of processing under certain circumstances.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

12.1 GDPR (European Economic Area)

If you are in the EEA, you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with a supervisory authority.

12.2 CCPA (California Residents)

If you are a California resident, you have the right to:

• Know what personal information is collected, used, shared, or sold.
• Delete personal information held by businesses.
• Opt-out of the sale of personal information.
• Non-discrimination for exercising your privacy rights.

We do not sell personal information as defined by the CCPA.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

13 Children's Privacy

Cortex is intended for professional and personal software development use and is not directed to children under 16 (or the applicable age of digital consent in your jurisdiction).

We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

14 International Data Transfers

Your data may be processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions where available.
• Contractual commitments from third-party processors to protect your data.

15 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last updated" date.
• Displaying an in-app notification for significant changes.
• Sending an email to registered account holders for material changes affecting data collection or sharing.

Your continued use of Cortex after changes take effect constitutes acceptance of the updated policy. We encourage you to review this page periodically.

16 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

We aim to respond to all privacy-related requests within 30 days.