Privacy Notice
Last updated: October 21, 2026
1. Who we are
Corenna is operated by Nathan Claiborne ("we", "us"). For the personal data described in this notice, we act as the data controller. Contact: privacy@corenna.app.
2. What we collect and why
| Category | Purpose | Legal basis |
|---|---|---|
| Email, name, password hash | Account creation and authentication | Contract |
| GitHub username, installation IDs, repo metadata | Connecting and triggering builds on your repos | Contract |
| Encrypted signing materials (keystores, .p12, profiles, passwords) | Producing signed build artifacts on your behalf | Contract |
| Build logs and metadata | Operating the service and troubleshooting | Contract / legitimate interest |
| IP address, device, browser data | Security, fraud prevention, abuse detection | Legitimate interest |
| Support messages | Responding to your inquiries | Contract / legitimate interest |
| Subscription status (from Paddle) | Gating paid features | Contract |
Payment, billing, and tax data are collected directly by Paddle as the Merchant of Record. See Paddle's Privacy Notice.
3. Who we share data with
- Paddle.com — Merchant of Record for sales, subscription management, payments, tax compliance, and invoicing.
- GitHub — repository access, Actions execution, and secret storage scoped to your installation.
- Hosting and infrastructure providers — to operate the database, edge functions, and storage.
- Professional advisers — legal and accounting, where strictly necessary.
- Authorities — where required by valid legal process.
4. International transfers
Personal data may be processed in the United States and the European Economic Area. Where data leaves the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or applicable adequacy decisions.
5. Retention
We retain personal data only as long as needed for the purposes above or as required by law. Account data is kept while your account is active. Signing materials are deleted within 7 days of account or project deletion. Build logs are retained for up to 12 months.
6. Your rights
Depending on where you live, you may have the right to access, rectify, erase, restrict, or port your personal data, to object to processing, to withdraw consent, and to complain to your supervisory authority. We respond to verified requests within one month. Contact privacy@corenna.app.
7. Security
We implement appropriate technical and organisational measures, including encryption in transit and at rest for signing materials, access controls, row-level database security, and audit logging. See the Security page for details.
8. Cookies
We use only essential cookies required for authentication and session management. We do not currently use analytics or advertising cookies. If this changes we will update this notice and request consent where required.
9. Changes
We may update this notice from time to time. Material changes will be communicated by email or in-app notice.