Privacy policy

The short version

Corpus records what you tell it and shows it back to you. It is not funded by advertising, it does not sell or share your health data, and it does not build a profile of you for anyone else's benefit. The sections below say exactly what is stored, what leaves the service, and what you can do about it.

Who runs it

Corpus is operated privately by its maintainer for a small, invited group. It is not a company, not a regulated medical device, and not a clinical service. Contact: Feedback@corpusmark.com.

What is stored

• Your identity — the email address of the Google account you sign in with. Corpus never sees or stores your Google password.
• What you log — body composition, measurements, blood pressure, food and water, supplements and medications, exercise, tasks, custom trackers, notes, and, if it applies to you and you turn it on, menstrual cycle entries.
• Continuous glucose readings, only if you connect a monitor yourself on the Profile page.
• Operational records — which scheduled emails have been sent to you, so you are not sent the same one twice.

Corpus does not use tracking cookies, advertising identifiers, or third-party analytics. The only cookie it sets is the session cookie that keeps you signed in.

Who your data goes to

Only these, and only for the purpose named. None of them are given your data to use for their own purposes.

• Google Cloud — hosting and the database. All of your data rests here.
• Google Sign-In — to confirm it is you. Corpus receives your email address and nothing else.
• Anthropic — only when you choose to use an AI feature. The in-app chat sends what you type; the label, medication and report scanners send the photograph you take; the optional AI report narrative sends a numbers-only summary built from a fixed allowlist, with a guard that refuses to send it if anything non-numeric appears. Photos are processed and discarded, never stored. Every AI feature is optional and manual entry always works instead.
• USDA FoodData Central — the name of a food you are looking up, to fetch its macros. Nothing about you is sent.
• Postmark — to deliver email you have asked for (welcome messages, task reminders, report digests, and anything you submit through the feedback form).
• Your glucose provider (Dexcom or a Nightscout server you run) — only if you connect one, and only to read your readings.

How it is protected, and the honest limits

Access is restricted to an explicit allow-list of email addresses; nobody else can create an account, and removing an address revokes access on the next request. Each account's data is isolated from every other account. Free-text notes and medication label details are encrypted in the database with a key belonging to your account.

The limit worth stating plainly: the service has to decrypt your data to show it to you, so the operator's systems hold a master key. This is server-side encryption, not end-to-end. Someone with access to the running infrastructure could read your data. Please decide what to log with that in mind.

How long it is kept, and getting it back

Your data is kept until you ask for it to be removed. There is not yet a self-service export or delete button in the app — that is being built. In the meantime, write to Feedback@corpusmark.com and ask for a copy of your data or for your account to be deleted, and it will be done. Deletion is permanent and includes backups.

Email you can turn off

Task reminders and report digests are off until you turn them on, and can be turned off again on the Profile page. The welcome series carries an unsubscribe link in every message that works without signing in.

Children

Corpus is not intended for children and accounts are issued only to invited adults.

Changes

If this policy changes in substance, the version above changes with it and anyone with an account is told before the change takes effect.