Who is responsible
The party responsible for the personal data described here is the team behind Cortex66 (our registered company name and address will be added here). Contact: hello@cortex66.com.
What we collect
We collect what the service needs:
- Account: your email address, your name if you give one, your Google or Apple sign-in identity if you choose to use it, and which version of the Terms and Privacy you agreed to and when.
- Workspaces: the workspaces you create or join, the people in them and your role.
- What you write: chats, files and their titles, and your memories. After a turn we look for facts you state about yourself and may propose them as memories, stored as proposals; a proposal joins your brain only when you confirm it, and private messages are never read this way.
- Connections you add: your own provider keys (stored encrypted), the AIs you connect through the Cortex66 connector, and the browser extension devices you pair.
- What the extension reads or does, only as described in the extension section below, stored as redacted records.
- Usage and receipts: which model ran each step, who paid, the price and the cap you approved. Also, on our own server with no cookie and no third party, when you first reached each step of getting started: account created, first chat, first answer, first AI connected, first computer connected, first paid step, and whether you came back on day 1 and day 7. These records hold no message content, and we read them only as totals.
- Security records: sign-in attempts, sessions and devices, with your IP address stored only as a hash.
- Payments: Paddle handles checkout and sends us what you bought, the amount, the status and an order reference. We never see or store your card number.
- Photos you add to a chat: stored with their camera and location data removed, and read only by an AI allowed to read your files.
- Visit statistics and recordings, only if you allow analytics: see the cookies section.
Why we use it
We use this data to run the service you asked for, keep it secure, bill for credit and plans, answer you, and meet our legal duties. We rely on our contract with you, our legitimate interest in a secure service, and your consent where we ask for it.
- We do not sell your data.
- We do not show ads in Cortex66. Advertising measurement runs only if you allow marketing cookies: see the cookies section.
- We do not use your content to train AI models of our own.
AI providers that receive your prompts
When a step runs, the prompt and the context that step needs are sent to the AI provider of the lane that runs it: OpenAI, Anthropic, Google (Gemini), xAI (Grok), DeepSeek or Groq. With your own key, the provider processes it under your agreement with them; on the Cortex66 lane, under ours. We send only what the step needs, and the receipt shows which provider ran it.
Unless you pick a model yourself, the Cortex66 brain chooses the model and provider for each step, by the task, the price and what that provider may read. You can set how much each AI may read in the app.
DeepSeek stores data in China, and its own privacy policy says it may use that data to train its models. So DeepSeek reads only the current message, with personal details masked where we detect them; never your memories, files, photos or private chats. On our credit it runs light steps only, we show a one-line note where it is offered, and you can turn it off.
Groq hosts open-source models. Where we have switched it on, the brain may use it for light steps only, never for your core work. You can also add your own Groq key.
Your own AIs
When you connect your own Claude, ChatGPT or Gemini, they can reach Cortex66 only through the connector you approved, with the access you approved, and you can disconnect at any time from My connected AIs. The connector does not read your chats on those sites.
The browser extension
The Cortex66 extension reads the page you are on only when you press Ask, Save or Start. It masks key-like secrets, emails and phone numbers, then sends the text and the page address to your Cortex66 account, and the model you chose uses it to answer. While a session you started works, it reads a redacted outline of the page, never field values. It keeps your workspace choice and never-read list on your device, and a short-lived device token in memory until Chrome closes. It talks only to cortex66.com, and to other sites only when you allow each one. We do not sell this data or use it for anything else.
The Cortex66 terminal app
The cortex66 command-line app signs in with a computer token kept in your system's keychain. What you send from it is handled like any other Cortex66 chat.
When you connect an AI from the terminal, it writes a Cortex66 entry into that AI's own configuration file on your computer, and saves a backup of the file first. Through the local bridge (cortex66 mcp), that AI reaches your account with this token, and only for the apps you connected.
Run cortex66 privacy at any time to see what it touches on your computer, your standing approvals, and how to undo them.
Service providers
We use a small number of providers to run Cortex66:
- Paddle (payments, as the Merchant of Record; Paddle's own privacy notice covers what you give at checkout).
- Amazon Web Services (hosting in the United States, email delivery and key encryption).
- Google and Apple (sign-in, only if you choose it).
- The AI providers named above (to run the steps you ask for).
- Google Tag Manager and Google Analytics, and Microsoft Clarity (visit measurement, as described in the cookies section).
Retention and deletion
We keep your data while your account is active. A workspace owner can delete a workspace: it is removed after a 7-day grace period, during which the owner can restore it. To get a copy of your data or delete your account, write to us.
After deletion we keep only what we must: totals in the credit ledger, a redacted audit trail, and records the law requires. Paddle keeps payment records under its own duties.
Cookies and storage on your device
Some cookies are necessary and always on: your sign-in session, sign-in progress, protection against forged requests, and gw_consent, which remembers your cookie choice.
Your browser also stores your preferences, such as language, theme and accessibility settings. When you open checkout, Paddle's checkout runs and Paddle's own notice applies.
We ask before any optional cookie. Analytics and marketing start denied, and you can change your choice at any time from Cookie settings at the bottom of every page. One choice counts across cortex66.com and auth.cortex66.com; the gw_consent cookie holds only that choice, and the later answer wins. Nothing from Google or Microsoft loads before you accept: if you decline or have not answered, those scripts are not requested at all. A new account is asked once at sign-up, and declining changes nothing about your account. The optional tags are:
- Analytics, if you allow it: Google Analytics counts visits and which pages help, and Microsoft Clarity records visits with all text masked. If you are signed in, Clarity gets a salted one-way key, never your email or account id. Google and Microsoft set their own cookies and handle this data under their own terms.
- Marketing, if you allow it: Google's tags may measure whether our ads bring visitors.
When a connection fails
If connecting an AI fails, the page may send our server a short report: a fixed reason, an error code and which AI. It carries no cookies and no identity and nothing you typed. It becomes one log line and adds one to a daily count for that reason. Your IP address is used only in memory, to limit how many reports arrive, and is not kept with the report.
Security
We protect your data with:
- sign-in codes and tokens stored only as hashes;
- your provider keys encrypted with a managed key service, never shown back in full;
- HTTPS on every page and request;
- workspace isolation: one workspace never sees another's data, checked by tests on every change.
Your rights
Depending on where you live (for example under the GDPR), you have the right to access your data, get a copy (export), correct it, delete it, restrict or object to its use, and withdraw consent. Many of these are in your settings; for the rest, write to us. You can also complain to your data protection authority.
Where data is processed
Our servers are in the United States. DeepSeek, when used, stores data in China. When data moves across borders, we rely on the safeguards the law requires.
Children
Cortex66 is not meant for children under 16, and we do not knowingly collect their data.
Changes to this policy
When we change this policy, we publish the new version on this page and change the date at the top.