Privacy policy
Corepage ("we", "us") is operated by Rxions Oy, Finland. We are the controller of the personal data described here. You can reach us at hi@rxions.com.
What we collect
- Account data. Your email address, display name, profile picture and language, received from the sign-in method you choose (Google or email and password, both through Google Firebase Authentication).
- Content you create. Notes, collections, tags, locations, dates and your Do boards (layers, groups and projects). It is stored so you can use it again and is private to your account.
- Assistant requests. What you ask Kit, plus the open note or page you point it at, so it can answer. We do not keep a chat history on our servers; the conversation stays in your browser until you close it.
- Credits and usage. A ledger of credits you received, bought and spent, with the kind of request, the model that answered it and its cost.
- Technical data. Your IP address, browser type and the pages requested, in short-lived server logs, and the country and referrer at sign-up. Logs and request records are deleted automatically after a few weeks.
- Settings. Theme, background, column widths and similar preferences, in your account or in your browser.
Why we use it
- To provide Corepage: sign you in, store your notes and boards, answer your requests and keep your credit balance.
- To keep the service safe and working: prevent abuse, fix errors and understand costs.
- To improve the product, using analytics, only if you accept analytics cookies.
The legal bases are performing our agreement with you, our legitimate interest in running a secure service, and your consent for analytics cookies.
Who receives data
- AI providers. When you use Kit or an AI tool, your request is sent to a language model provider. Today that is mainly Google (Gemini). We send only what is needed for the answer.
- Web search. When Kit searches the web for you, the search query is sent to a search provider (TinyFish, and Tavily as a fallback).
- Weather. The city you pick is sent to OpenWeatherMap.
- Sign-in. Google Firebase Authentication handles passwords and Google sign-in.
- Payments. Card payments are processed by Revolut. We never see your card number.
- Analytics. Google Analytics, only after you accept it.
- Hosting and email providers that run the service for us.
We do not sell your data and we do not use your notes to train models. Some providers are outside the EU/EEA; where that applies, transfers rely on standard contractual clauses or an adequacy decision.
Cookies and browser storage
- Necessary: a session cookie that keeps you signed in, a language cookie, and browser storage for preferences such as theme, background and your cookie choice. These do not need consent.
- Analytics: Google Analytics cookies, set only after you choose "Accept analytics". You can change your choice any time with "Cookie settings" in the menu or footer.
How long we keep it
Account data and your content stay until you delete them or your account. Credit records are kept as long as needed for accounting. Technical logs and AI request records are deleted automatically within weeks. When you delete your account, your content and personal data are removed, except what we must keep by law.
Your rights
You can ask for access to your data, correction, deletion, a portable copy, to restrict or object to processing, and to withdraw consent at any time. You can delete your account in Account, then Delete. For anything else, write to us. You also have the right to complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local authority.
Children
Corepage is not meant for people under 16, and we do not knowingly collect their data.
Changes
If this policy changes in a way that matters, we will update the date above and, where needed, tell you in the app.