Your privacy.
Your control.
Your projects are personal. Your credentials are sensitive. At TheCore, we believe you should know exactly what information we handle and how we protect it.
Client-side vault encryption
For your encrypted environment files
No data sales
We do not sell your personal data
You stay in control
Manage and delete your account data
Introduction
Welcome to TheCore. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.
What We Collect
We collect the following information when you use TheCore:
Profile Information: Your email address and name provided by Google during sign-in.
Project Data: Project names, descriptions, tech stacks, repository URLs, and live URLs.
Platform Data: Platform names and login emails associated with your projects.
Notes and To-dos: General notes and tasks you create within the app.
Encrypted Vault Data: Encrypted blobs of your environment variables and .env files.
Preferences: Theme preferences stored in your browser.
Profession & Workplace: Your optional profession/role (e.g. Developer, Student) and workplace or organisation name, collected during account setup. Used solely to personalise your experience and displayed in your account settings. Never shared with third parties.
What We Don't Collect
Under the intended vault design, TheCore does not receive the following sensitive information:
- Hosting platform passwords or cloud provider credentials.
- Plaintext environment variable values.
- Your Vault Master Password.
The Vault & Encryption
Your environment variables are encrypted in your browser using a key derived from your Master Password before the encrypted data is sent to our servers. TheCore uses the Web Crypto API with AES-GCM encryption.
Important to know
If encryption keys are derived locally and never sent to our servers, we cannot read your encrypted environment variables or recover your Master Password if you lose it.
Other information, including project names, login emails, notes, and to-dos, is not client-side encrypted and may be accessible to authorized database operators.
Third-Party Processors
We use third-party providers to operate TheCore.
Supabase
Database and authentication
Vercel
Application hosting
Sign-in authentication
How We Use Your Data
We use your data to provide, maintain, secure, and improve TheCore. We do not sell your personal data, run advertisements, or profile users for advertising.
Your Rights
Depending on your location and applicable law, including India's Digital Personal Data Protection framework and the GDPR where applicable, you may have rights concerning your personal data.
Access and export. Access your data and request an available data export.
Correction. Update inaccurate project and profile information.
Deletion. Request deletion of associated personal data, subject to applicable legal retention requirements.
Security
We use security measures intended to protect your information, including encryption in transit, database Row Level Security (RLS), and client-side encryption for vault data. Effectiveness depends on correct configuration and ongoing maintenance.
No system can guarantee absolute security. Use a strong, unique Master Password and keep your account credentials secure.
Children's Privacy
TheCore is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact us so we can review the situation.
Contact Us
Questions, privacy concerns, or requests regarding your personal information? Get in touch with us.
Privacy enquiries
palerugopi00@gmail.com