Privacy Policy
This policy explains what personal data Cortex uses, why, who receives it, how long we keep it and how you can control it. It starts with the short version and the part specific to Cortex, followed by the rules that apply to all our apps and the information required in particular countries.
Last updated: November 5, 2026
The short version
- ODBS LLC is responsible for your personal data in Cortex. You can reach us at info@odbs.tech.
- When you send a message, Cortex sends your conversation, with the files and links you attach, to the AI provider of the model you choose. OpenAI also processes some of your messages to write conversation titles, to run memory and to search project files.
- Your conversations are stored on our servers so that you can return to them. People you share a link or a project with can read what you share with them.
- Cortex shows no ads. It uses Mixpanel for app analytics and Sentry for crash reports, both in their EU regions.
- You can delete conversations and memories in the app. To delete your account and all its data, write to info@odbs.tech.
- We use your data to provide Cortex and the features you choose, to keep it secure and working, and to meet our legal obligations.
- We do not sell your personal data, do not use it for targeted advertising and do not share it with data brokers.
- We do not use your data to train our own AI models. Where a feature uses a third-party AI service, this policy says what is sent and why.
- You can access, correct, export and delete your data and withdraw your consent. See section 9 for how.
This summary helps you find your way; the full policy below is what applies.
1. Who we are
Cortex is made by ODBS LLC (“ODBS”, “we”, “us”), a limited liability company organised in Wyoming, United States, at 30 N Gould St, Ste N, Sheridan, WY 82801, United States. ODBS LLC is the controller responsible for the processing described in this policy, unless this policy says otherwise.
This policy covers the Cortex app, its online services, its website and our support. It does not cover services run by others that you use with Cortex, such as app stores, sign-in providers or payment providers; their own privacy policies apply to them.
For any question about privacy or to exercise your rights, write to info@odbs.tech. Please include “Cortex” in your message.
2. How Cortex uses your data
What stays on your device and what goes to our servers
Cortex works through our servers. Your messages, the files and links you attach, your conversations, projects, memories, assistants and scheduled prompts are stored on our servers, and your messages are sent from there to the AI provider of the model you choose.
On your device, the app keeps a random identifier and the key that connects it to our servers in the device’s secure storage, together with your settings. When you speak a message, your device’s own speech recognition, provided by Apple or Google, turns your voice into text; Cortex receives only the text, never the audio.
Your account
When you first open the mobile app, it creates an account for you automatically, without a name, an e-mail address or a password. For it we store a random device identifier generated by the app, the name of your device model (for example “Apple iPhone 15 Pro”), the platform, the operating system and app versions, the language and region settings of your device, your time zone, the screen size and, if you allow notifications, a push notification token.
In the web app you sign in with an e-mail address and a password, which we store only in hashed form, or with Google, from which we receive your Google account ID, e-mail address, name and profile picture. For each signed-in browser we keep a session record with its IP address and browser details, to keep your account secure; a cookie on our server’s domain keeps you signed in, and the browser stores a security token. We send account e-mails, such as e-mail verification and password reset messages.
If you link the mobile app to your web account, where the app offers it, the conversations, projects, memories, assistants, scheduled prompts, subscriptions and credits of the app’s account move to your web account, and we send you an e-mail about the new device.
Conversations, files and links
We store your conversations: their titles, your messages, the answers, which model wrote each answer, the processing used and its cost, your votes on answers, pinned messages and the summaries you ask for. When you compare models, we store each model’s answer.
Images and PDF files you attach, up to 10 MB each, are stored in Amazon S3 in Frankfurt, Germany (EU), and sent to the AI provider with the message they belong to. When you attach a link, our server visits the page and extracts up to 25,000 characters of its text, which is stored with your message and sent to the AI provider; for YouTube links we read only the video’s basic information.
When you delete a conversation or clear your chat history, it disappears from the app at once and its shared link stops working. We currently keep its messages and attached files on our servers until your account is deleted. To have them deleted, write to info@odbs.tech.
How your messages reach the AI providers
Your prompts and attached files are sent to the AI provider that runs the model you choose. Each answer in the app shows which model wrote it. With Auto, the beginning of your message is sent to an AI model that picks the model for you; when you compare models, your message is sent to each model you compare.
A request contains our instructions for the model, your conversation so far, the files and link text you attached, and, where they apply, the instructions and relevant passages of a project, the instructions of an assistant, your tone and custom instructions, your memories and the current date in your time zone. We do not send your name, your e-mail address, your account ID or your device identifier.
Whatever model you choose, OpenAI also receives the first message of each conversation to write its title, your recent messages when memory is turned on (see below), and the files of a project and your messages in that project, to make them searchable.
Where your plan and the model support it, the model can search the web while it answers. The search is run by the AI provider’s own search tool, for example OpenAI’s web search, Google Search or Perplexity, based on your conversation.
Each provider processes your requests under its own API terms and privacy policy, which set how long it keeps them and whether it may use them to improve its services. Requests to OpenAI are sent with storage turned on, so that a conversation can continue from the previous answer; OpenAI keeps them for up to 30 days. Models offered through OpenRouter, including models marked as free, are run by other companies that receive your request and, depending on their own terms, may keep it and use it to improve their models. Do not send information you would not share with these providers.
Memory
Memory is off until you turn it on, and is part of the Plus and Pro plans. When it is on, every few messages your recent messages are sent to OpenAI to find facts about you worth remembering, such as your name, age, location, language, work, preferences and goals. We store up to 50 such facts, together with the conversation they came from, and you can add facts yourself. Your memories are added to your requests to every model.
You can see, search and delete your memories one by one or all at once in Settings, Memory.
Projects, shared links and assistants
Projects: the owner of a project can invite people with a link that works once, for anyone who has it, for 7 days. Members can read all conversations in the project, including those of other members, its instructions and its files; editors can also write in it and change its files. When a member is removed, the conversations they had in the project stay visible to the other members. The invitation page on our website shows the project’s name, the role and the note the owner wrote.
Shared links: when you share a conversation, anyone who has the link can read its title, its messages and the names of the models that answered, without signing in, as the conversation is at the moment they open it, including messages you add later. Attachments and images are not shown. Link previews in messaging apps can show the beginning of your first message. The link works until you delete the conversation; shared pages are not indexed by search engines.
Assistants: assistants you create are private. If you publish one to the community, every Cortex user can find it and read its name, description and instructions.
Scheduled prompts and notifications
A scheduled prompt runs at the time you set, in your time zone, and its answer is added to a conversation. We then send a notification to your devices through Expo’s push service and Apple or Google; it shows the conversation’s title and the beginning of your prompt, which may be visible on your lock screen. We also send notifications when your credits run low or a scheduled prompt is paused, and occasional announcements to groups of users by platform and language. You can turn notifications off in your device’s settings.
Feedback and reports
If you send feedback in the app, we store your message, its category, the app and operating system versions and the platform. If you report an answer in the mobile app, we store the reason, the model and up to 2,000 characters of the reported answer, and our team reviews it.
Purchases and credits
Subscriptions are sold through the App Store and Google Play; we never see your card details. RevenueCat verifies purchases and keeps your plan in step with the store; it receives the app’s random device identifier and the purchase information the store provides. We store your plan, your credit balance and the purchase events RevenueCat sends us, in full.
Analytics, crash reports and logs
The mobile app sends usage events to Mixpanel, in its EU region: for example when the app is opened, which screens you view, when you send a message (with the model, the provider and the number of attachments, but not the text), how you vote, when you report an answer and paywall and purchase events. They are linked to the app’s random device identifier and include the platform and app version. The web app sends no analytics.
If the app or our servers fail, an error report is sent to Sentry, in its EU region. Reports contain technical information and are configured not to include your IP address or personal details; there are no screen recordings. Our server’s request logs record the time, the address called, the result and the first characters of the access key of each request, but not your IP address or your messages.
The app may ask you to rate it in the App Store or Google Play and checks the store for a newer version; the stores handle this under their own policies.
Our team’s access
Authorised members of our team can view accounts, conversations, including deleted ones, files, memories, feedback, reports, sign-in sessions and purchase records in an internal admin console, when this is needed for support, security, investigating misuse or reports, or billing. Access is limited to company accounts from approved networks.
Service providers and where data is processed
The models the app offers change over time. Depending on the model you choose, your request goes to one of these AI providers, each in the country stated:
- OpenAI (United States): GPT models, image and file understanding, web search, conversation titles, memory and project search.
- Anthropic (United States): Claude models.
- Google (United States): Gemini models and Google Search for their web search.
- DeepSeek (China): DeepSeek models.
- xAI (United States): Grok models.
- Mistral AI (France): Mistral models.
- Groq (United States): open models from other developers, such as those labelled Meta in the app.
- OpenRouter (United States): forwards requests for some models, including free ones, to the company that runs them, which also receives your request.
- Perplexity (United States) and Alibaba Cloud (Singapore): when the app offers their models.
We also use these providers to run Cortex:
- Amazon Web Services: our servers and database, and storage of your files in Frankfurt, Germany (EU).
- Cloudflare (United States, global network): network protection and delivery for our servers, the web app and this website.
- RevenueCat (United States): purchase verification and subscription status.
- Apple and Google: in-app purchases, push notifications, speech recognition on your device and Google sign-in, under their own privacy policies.
- Expo (United States): delivery of push notifications.
- Resend (United States): account e-mails.
- Mixpanel (EU region): app analytics.
- Sentry (EU region): crash and performance reports.
- Better Stack: storage of our server logs.
How long we keep data
- Your account, conversations, messages, attached files, projects, assistants and scheduled prompts: until your account is deleted. Deleted conversations are hidden from you at once, but we keep them until your account is deleted unless you ask us to delete them earlier.
- Memories, scheduled prompts and assistants you delete, and files you delete from a project: deleted at once.
- Shared links: until you delete the conversation. Project invitation links: until they are used, withdrawn or 7 days old.
- Sign-in sessions of the web app, with their IP address: until your account is deleted.
- Purchase records and credit history: as long as we need them for accounting and tax, also after account deletion.
- Feedback and reports: until your account is deleted, unless we need a report longer to deal with misuse.
- Data at the AI providers: as their own terms set; OpenAI keeps requests for up to 30 days.
- Analytics events, crash reports and server logs: for the periods set in our accounts with Mixpanel, Sentry and Better Stack.
Your choices in Cortex
- Delete a conversation: open it and choose Delete Conversation. Clear all conversations: Settings, Clear Chat History.
- Export a conversation, where your plan includes it: open it and choose Export.
- See, add or delete memories, or delete them all: Settings, Memory.
- Delete an assistant, a scheduled prompt, a project or a project file in the app.
- Stop sharing a conversation: delete the conversation.
- Delete your account and all its data: write to info@odbs.tech from the e-mail address of your web account, or tell us your device and how to identify it in the app. Deleting the app does not delete your account or cancel a subscription.
- Sign out of every browser: in the web app’s settings.
- Notifications, microphone, camera and photos: allow or turn off access in your device’s settings.
Legal bases for Cortex
- Sending your messages, files and links to the AI providers, storing your conversations, projects, assistants and scheduled prompts, sharing what you choose to share, your account and your purchases: contract, to provide the service you asked for.
- Memory: your consent, given when you turn it on, which you can withdraw by turning it off and deleting your memories.
- Push notifications: your consent, given in your device’s settings.
- Analytics, crash reports, server logs, session records, abuse reports and our team’s access: our legitimate interests in keeping the service secure, fixing errors, preventing misuse and improving the app.
- Purchase and tax records: legal obligation.
3. Our legal bases
Where the law requires a legal basis for processing personal data, such as the EU and UK General Data Protection Regulation (GDPR), Türkiye’s Personal Data Protection Law (KVKK) or Brazil’s LGPD, we rely on the following bases, as described for each use in the part of this policy specific to Cortex:
- Contract: to provide Cortex, your account and the features and purchases you ask for.
- Consent: where we ask for it, for example for optional analytics or for sending content to a third-party AI service. You can withdraw your consent at any time in the app or by writing to us; this does not affect processing that took place before.
- Legitimate interests: to keep the service secure, prevent fraud and abuse, fix errors and answer your requests, where these interests are not overridden by your rights. You can object to this processing.
- Legal obligation: to keep records required by law, such as tax and purchase records, and to answer lawful requests from authorities.
Some data is needed to provide Cortex; without it, the app or a feature cannot work. Where data is optional, the app tells you or lets you choose.
5. AI and automated features
Where Cortex uses artificial intelligence, this policy describes for each feature what data is used, where it is processed, whether it leaves your device and, for third-party AI services, what the provider may do with the data it receives. We do not use your personal data to train our own AI models.
Results of AI features are produced automatically. We do not use them to make decisions about you that have legal or similarly significant effects. If you think a result is wrong or harmful, you can tell us at info@odbs.tech.
6. International transfers
ODBS is based in the United States, and our service providers process data in the countries stated for Cortex. When personal data is transferred from one country to another, we use the safeguards the law requires, such as adequacy decisions, the EU-US Data Privacy Framework where a provider is certified, the European Commission’s standard contractual clauses and their UK and Swiss equivalents, and the mechanisms provided by other laws, such as the KVKK and the LGPD.
You can ask us for more information about the safeguards for a particular transfer by writing to info@odbs.tech.
7. How long we keep data
We keep personal data only for as long as it is needed for the purposes described in this policy. The part specific to Cortex lists the main periods. In general:
- Your account and your content are kept until you delete them or your account, unless a shorter period is stated.
- When you delete your account, we delete its data or remove everything in it that identifies you, except for data we must keep to meet legal obligations, to resolve disputes or to protect against fraud and abuse, which we keep only as long as needed for that purpose.
- Backups are overwritten on their normal schedule, and deleted data disappears from them when that cycle ends.
- Purchase and tax records are kept for the period the law requires.
- Data that no longer identifies anyone may be kept for statistics.
8. How we protect data
We use technical and organisational measures appropriate to the risk to protect personal data, such as encryption in transit, encrypted storage where our providers offer it, access controls, limiting access to people and providers who need it, and monitoring for misuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the authorities as the law requires.
9. Your rights and choices
Depending on where you live, you have some or all of the following rights. We respect them for everyone where we reasonably can:
- to know whether we process your personal data and to get a copy of it;
- to have inaccurate data corrected and incomplete data completed;
- to have your data deleted;
- to receive the data you gave us in a portable format and to have it transmitted to another provider where technically feasible;
- to restrict or object to processing, including processing based on our legitimate interests and direct marketing;
- to withdraw your consent at any time, without affecting processing that took place before;
- not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you;
- to appeal our answer to your request, where your law provides for it, and to complain to a data protection authority.
Many of these choices are available directly in the app, as described for Cortex, such as exporting or deleting your data and turning optional features off. You can also write to info@odbs.tech from the e-mail address you use with Cortex, or tell us how to identify your account. We may need to verify your identity before we act, answer within the time the law sets (usually one month, or 30 days in Türkiye, extendable where the law allows) and do not charge a fee unless a request is manifestly unfounded or excessive. You may use an authorised agent where your law allows it; we may ask for proof of the authorisation. We will not treat you differently for exercising your rights.
10. Children
Cortex is for people aged 18 or older and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe that a minor has given us personal data, write to info@odbs.tech and we will delete it.
11. This website
This website has no user accounts. It stores one cookie, NEXT_LOCALE, to remember the language you choose; it is necessary for the site to work as you asked and contains no identifier.
The site is delivered and protected by Cloudflare, which processes technical request data, such as your IP address and browser information, to deliver the site and to protect it from attacks.
We may use Cloudflare Web Analytics, which counts visits without cookies, without fingerprinting and without tracking you across sites, to understand how the website is used.
We do not use advertising or tracking cookies on this website.
Links to send us an e-mail open your own e-mail app; nothing is sent until you send it.
Because we do not track you across websites, the website and the app do not change their behaviour in response to browser Do Not Track signals; where the law requires it, we honour Global Privacy Control signals as a request not to sell or share personal data, which we do not do in any case.
12. Changes to this policy
We update this policy when Cortex, our providers or the law change. The date at the top shows the latest version, and we keep earlier versions available on request. If a change materially affects how we use your data, we will tell you in advance, for example in the app or by e-mail, and where the law requires it we will ask for your consent again.
13. Additional information for the European Economic Area, the United Kingdom and Switzerland
ODBS LLC is the controller. Our legal bases for each use are described in section 3 and in the part specific to Cortex. You have the rights under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection described in section 9.
You can lodge a complaint with the data protection authority of the country where you live or work or where an alleged infringement took place, for example the Information Commissioner’s Office in the United Kingdom or the Federal Data Protection and Information Commissioner in Switzerland. We would appreciate the chance to address your concern first at info@odbs.tech.
14. Additional information for the United States
Depending on the state where you live, such as California, Colorado, Connecticut, Virginia or Texas, you may have the rights described in section 9, including the rights to know, access, correct, delete and port your personal data, to opt out of its sale, of targeted advertising and of profiling, and to limit the use of sensitive personal data. To exercise them, write to info@odbs.tech. If we decline your request, you can appeal by replying to our answer with the subject “Appeal”; if your appeal is denied, you can contact your state attorney general.
We do not sell personal data or share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use sensitive personal data, such as health information, for purposes other than providing the service you asked for and the other purposes the law permits. We do not use personal data to train large language models.
Categories of personal data we collect, their sources, purposes, the categories of recipients and retention periods are described in the part specific to Cortex and in section 4 and section 7. California residents may also ask which personal information, if any, we disclosed to third parties for their direct marketing purposes; we do not make such disclosures.
15. Information notice for Türkiye (KVKK)
This section is our information notice under Article 10 of Türkiye’s Personal Data Protection Law No. 6698 (KVKK). The data controller is ODBS LLC. The personal data processed, the purposes and the legal reasons are described in the part specific to Cortex and in section 3; we collect personal data electronically through the app, its server, the website and our support, on the legal grounds in Articles 5 and 6 of the KVKK, such as the performance of a contract, our legitimate interests, legal obligations and, where required, your explicit consent.
Personal data is transferred to our service providers and, where necessary, to authorities, for the purposes described in this policy, including to service providers abroad on the grounds and with the safeguards provided in Article 9 of the KVKK.
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed, to request information about it, to learn the purpose of the processing and whether it is used accordingly, to know the third parties in Türkiye or abroad to whom it is transferred, to request its correction or deletion and the notification of these actions to those third parties, to object to a result against you arising from its analysis exclusively by automated systems, and to claim compensation for damage arising from unlawful processing. You can send your request to info@odbs.tech from the e-mail address registered with us, or in the other ways set out in the Communiqué on the Principles and Procedures for Requests to the Data Controller. We answer without charge within 30 days at the latest. You may also complain to the Personal Data Protection Board.
16. Additional information for Brazil (LGPD)
If you are in Brazil, you have the rights in Article 18 of the General Personal Data Protection Law (LGPD), including confirmation of processing, access, correction, making unnecessary or excessive data unidentifiable, blocking it or deleting it, portability, information about the public and private entities with which we share data, information about the possibility of refusing consent and its consequences, and withdrawal of consent. To exercise them or for any question about the processing of your data, write to info@odbs.tech. You may also petition the National Data Protection Authority (ANPD).
17. Additional information for other countries
- Canada, including Québec: you have rights of access and correction and, in Québec, rights relating to portability and to automated decisions. Questions and requests about privacy can be sent to info@odbs.tech, and you may complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d’accès à l’information.
- Japan: we handle personal information under the Act on the Protection of Personal Information. Our service providers abroad are listed for Cortex; you can ask us at info@odbs.tech about the measures they take and the personal information protection systems of their countries, and request disclosure, correction, suspension of use or deletion.
- South Korea: you can request access, correction, deletion or suspension of processing at info@odbs.tech. The personal data transferred abroad, the recipients, their countries, the purposes and the retention periods are described for Cortex; you can refuse such transfers by not using the features that require them or by deleting your account.
- India: you can request access, correction, completion, updating and erasure of your personal data, nominate another person to exercise your rights, and raise a grievance with us at info@odbs.tech; if it is not resolved, you may complain to the Data Protection Board of India.
- Australia: we handle personal information in line with the Australian Privacy Principles. You may complain to us at info@odbs.tech and, if you are not satisfied with our answer, to the Office of the Australian Information Commissioner.
- Everywhere else: you have the rights that the law of your country gives you, and you can exercise them by writing to info@odbs.tech.
18. Contact
ODBS LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. E-mail: info@odbs.tech. Please include “Cortex” in your message.