Privacy & data security
Your product data stays yours. Full stop.
Coreua exists to turn your product numbers into clear answers. Those numbers are often the most sensitive information a team has, so we built the product around one rule: your data is isolated to your account, protected end to end, and used for nothing except serving you. This page explains, in plain language, exactly how we do that.
The principles we build on
01
Your data belongs to you
The numbers you enter into Coreua exist for one reason: to give you answers. They are never sold, rented, traded, or used to build profiles. There are no advertising partners and no data brokers anywhere in our stack.
02
Isolated by design
Every analysis is bound to the account that created it. Every read and write in the product is scoped to your account ID on the server, so there is no page, endpoint, or shared workspace through which another customer could reach your data.
03
Minimal by default
We collect only what the product needs to work: your email, a one-way hash of your password, the product name and type you tell us about, and the metrics you choose to enter. Nothing else is gathered in the background.
What we collect, and what we don't
We store
- Your email address, used to sign you in and to reach you about your account.
- A one-way hash of your password. Never the password itself.
- The product name and product type you enter during onboarding.
- The metrics you type into an analysis, and the date it was created.
- If you ask us about a paid plan: the contact details you choose to share.
We never collect
- Data from your analytics tools, databases, or any connected system. Coreua only knows what you type in.
- Behavioural tracking, session recordings, or advertising identifiers.
- Your contacts, files, or anything on your device.
- Payment card details. Paid plans are set up directly with our team.
How your data is isolated
Every account in Coreua is a sealed compartment. When you save an analysis, it is written with your account ID attached. When you open your history, the server asks the database only for rows that carry your account ID. There is no query in the product that reads across accounts, no shared workspace, and no way to address another customer's analysis by guessing an identifier: the server checks ownership on every request before it returns anything.
This isolation is enforced on the server, not in your browser. Even a modified client cannot ask for data that does not belong to the signed-in account, because the account is resolved from the secure session cookie on our side and applied to every query.
Your analyses are visible only to you inside the product. The people who run Coreua have an operations dashboard that shows account-level information such as sign-up dates and activity counts so we can keep the service healthy. Any access to underlying systems is limited to the small team that operates Coreua, is used strictly to run, secure, and support the service, and is never used for any other purpose.
The safeguards in place
Encrypted in transit
Every request between your browser and Coreua travels over HTTPS with modern TLS. Certificates are issued and renewed automatically, and plain HTTP is never served.
Passwords are never stored
We keep a bcrypt hash of your password, not the password itself. Nobody at Coreua can read it, and it cannot be reversed from what we store.
Hardened sessions
Sign-in creates a random session token stored in a secure, HTTP-only cookie that scripts cannot read. Sessions expire automatically, and every state-changing request is protected against cross-site request forgery.
A database no one can reach from the internet
Your data lives in a database that listens only to the application running on the same machine. The server firewall exposes nothing but the encrypted web port, so there is no direct path from the outside world to the data store.
Hosted in the European Union
Coreua runs on infrastructure located in Frankfurt, Germany. Your data is stored and processed inside the EU.
No third-party trackers
There are no analytics pixels, session recorders, ad networks, or social plug-ins on Coreua. The only outside services involved are the network edge that serves the site, the font provider, and the hosting provider, none of which receive the metrics you enter.
You stay in control
Delete your history at any time. The History page lets you clear every analysis in your account in one action. Deleted analyses are removed from the database, not archived.
Delete your account. Ask us through the contact page and we will remove your account and everything attached to it.
Ask us anything. If you have a question about how your data is handled, or need a copy of what we hold about you, reach out and a person will reply.
Who else is involved
We keep the list deliberately short. Coreua runs on a hosting provider in Frankfurt, Germany, sits behind a network edge that terminates TLS and shields the server, and loads its typefaces from a font provider. None of these services are given the metrics you enter, and none of them process your data for their own purposes. We do not share, sell, or transfer your data to anyone else, and we will only ever disclose it if the law compels us to.
We will update this page whenever our practices change, and the date below will move with it. Last updated September 16, 2026.