Skip to main content
Download — FreeNo credit card required

Privacy Policy

Last updated: October 13, 2026

Overview

CoreLock is designed with privacy in mind. The scan runs on your device and needs no account. Optional features (AI explanations, Ask CoreLock, file reputation checks and sync) send limited data to our servers or partners, described below; they are off until you turn them on in Settings › Privacy. Signing in, threat list updates and update checks also contact our servers. We do not collect your personal files.

What We Collect

When you scan your Mac:

  • The scan runs on your device. Your Security Score is computed on your device.
  • AI explanations (off by default; you must be signed in): for each scan you start, a summary is sent to our servers and on to our AI provider: your 25 busiest programs (program name, process ID, CPU and memory use), the number of network connections and of distinct remote addresses for the 15 apps with the most connections (not the addresses), CPU, memory and disk totals, cache and temporary-file sizes, the number of large files, and uptime. Never your files. The provider is Anthropic's Claude, called directly or through OpenRouter; if those fail, OpenRouter may route the request to Google Gemini or Meta Llama.
  • File fingerprints: CoreLock computes SHA-256 fingerprints (not contents) of files in the folders it scans and compares them with a list built into the app. Only if you turn on File reputation checks (off by default) are the fingerprints sent to our malware-hash database; a fingerprint checked in the last 7 days isn't sent again.
  • Threat list updates (on by default) download malware and bad-host lists from CoreLock and from public security feeds. Nothing about what is on your Mac is sent; requests for CoreLock's own lists carry your sign-in and the list version you have.
  • Update checks: when the app opens and every 4 hours, CoreLock asks corelock.net for the newest version and sends a random ID made for your copy of the app.

When you create an account:

  • Email address (for authentication and billing)
  • Name (if provided via Google or Apple OAuth)
  • Subscription status (plan type, billing cycle)
  • Your Mac's name, macOS version, chip type, CoreLock version and a device identifier (to enforce device limits)

When you buy CoreLock or use Restore Purchase:

  • For every paid checkout we record the email address you gave Stripe, your Stripe customer and subscription or payment IDs, the plan and its status, whether or not it is linked to a CoreLock account yet. This is how a purchase reaches your account when you sign in with that email or restore it. Card details stay with Stripe.
  • Restore Purchase (corelock.net/restore): we store the email address you enter, your account ID, the request time, the number of code attempts and a salted hash of the 6-digit code (never the code itself). We store this whether or not the address matches a purchase, and delete it after 90 days. If an unclaimed purchase matches, we email the code, through our email provider Resend, to the address on that purchase. That email shows the email address of the account you are signed in with.

On Pro and Business plans, if you turn on sync:

  • Scan results (Security Score, issue counts, timestamps — not raw system data)
  • Fix history (which fixes ran and when)
  • Chat conversations that an earlier version of CoreLock saved (the full text)
  • Two settings: how often CoreLock checks, and whether it syncs

Sync is off until you turn it on in Settings › Privacy. Free accounts are not synced.

If you join a CoreLock Business team:

  • After each scan, your Mac's name, health score and issue counts are shared with your team's admins.

When you use Ask CoreLock:

  • Ask CoreLock needs you to be signed in and AI explanations to be on. Your question and the conversation so far, plus at most the one finding you choose to ask about, are sent through our servers to OpenRouter for an answer.

What CoreLock keeps on your Mac (stays on your Mac, never uploaded):

  • Decoy files. As a ransomware warning sign, CoreLock keeps one small hidden decoy file in each of your Desktop, Documents and Downloads folders (named .corelock-decoy- followed by an ID for this install) and notifies you if something changes or deletes one. CoreLock removes them when you quit it. It also removes, once, the decoy files with believable names (for example Financial-Report-2025.pdf) that versions before 2.0 left behind.
  • Recovery copies (versions before 2.0 only). CoreLock 1.x kept short-lived copies of recently changed files in a hidden folder, ~/.corelock-rollback. CoreLock 2.0 does not make them. If that folder is still on your Mac, you can delete it.
  • Decoy files and any recovery copies are never uploaded.

What the app never collects or transmits:

  • Your files, documents, or downloads (only file fingerprints are checked, never the contents)
  • Raw network traffic or packet contents
  • Keystroke data or screen content
  • Your web browsing history

How We Use Your Data

  • To provide and maintain the CoreLock service
  • To process subscription payments via Stripe
  • To sync your scan results and fix history to your account, if you turn on sync (Pro and Business)
  • To provide AI explanations and Ask CoreLock answers, if you turn them on (see What We Collect for what is sent and to whom)
  • To send important product updates (you can unsubscribe anytime)

Third-Party Services

  • Supabase — Authentication, AI analysis requests, and cloud database (for cloud sync on Pro and Business)
  • Anthropic — AI explanations of the scan summary described above (directly, or through OpenRouter)
  • Stripe — Payment processing for Pro and Team subscriptions
  • Resend — Sends email from CoreLock, including purchase confirmations and Restore Purchase codes.
  • OpenRouter — Routes Ask CoreLock messages to a third-party model (Meta Llama 3.3, Moonshot AI Kimi K2.5, or Google Gemini 2.0 Flash), and may carry AI explanations to Anthropic's Claude or, as a fallback, Google Gemini or Meta Llama. We do not control or vouch for those providers' retention or training policies; see their terms.
  • Vercel — Website hosting

We do not sell, share, or rent your personal data to any third party for marketing purposes.

Data Storage & Security

Account data is stored in Supabase (PostgreSQL) with encryption at rest. API keys you enter in the desktop app are encrypted using your operating system's keychain (macOS Keychain). All network communication uses TLS 1.3 encryption.

Data Retention

We retain your data for the following periods:

  • Account data — Retained while your account is active. Deleted within 30 days of account deletion request.
  • Scan summaries — Retained for 12 months, then automatically purged.
  • Chat history — Retained while your account is active. Deleted with account deletion.
  • Payment records — Retained for 7 years as required by tax and financial regulations.
  • Usage logs — Anonymized and aggregated after 90 days.
  • Restore Purchase records — The email address you entered, your account ID, request times, code attempts and the salted code hash. Deleted after 90 days, whether or not the address matched a purchase.

Your Rights

You have the right to:

  • Access your personal data
  • Delete your account and all associated data
  • Export your data in a portable format
  • Correct inaccurate personal data
  • Ask us to delete synced data at any time
  • Unsubscribe from emails
  • Object to processing of your data
  • Withdraw consent where we rely on it

To exercise these rights, contact us at info@corelock.net. We will respond within 30 days.

European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

  • Legal basis for processing — We process your data based on: (a) performance of our contract with you, which covers providing the app, AI analysis of your scan summary, AI chat, cloud sync on Pro and Business plans, and billing; (b) our legitimate interests in operating, securing and improving CoreLock and this website, including website analytics; (c) legal obligations such as tax record keeping; and (d) your consent, only for optional emails such as the newsletter.
  • Data portability — You may request a copy of your data in a structured, machine-readable format.
  • Right to erasure — You may request deletion of your personal data. We will comply within 30 days unless we have a legal obligation to retain it.
  • Right to object — You may object to processing based on legitimate interests at any time.
  • Data transfers — Your data is stored on servers in the United States (Supabase/AWS). AI analysis and chat requests are processed by our AI providers, which may also be outside your country. We rely on standard contractual clauses to ensure adequate data protection.
  • Supervisory authority — You have the right to lodge a complaint with your local data protection authority.

California Users (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to know — You may request the categories and specific pieces of personal information we have collected about you.
  • Right to delete — You may request deletion of your personal information.
  • Right to opt out of sale — We do not sell your personal information. We do not share your data with third parties for their marketing purposes.
  • Right to non-discrimination — We will not discriminate against you for exercising your privacy rights.

To submit a verifiable consumer request, email info@corelock.net. We will verify your identity and respond within 45 days.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users via email within 72 hours of becoming aware of the breach. We will also notify relevant supervisory authorities as required by applicable law.

Cookies & Website Analytics

This section covers the CoreLock website (corelock.net), which is separate from the CoreLock app. The website uses essential cookies required for the site to function (for example, Stripe checkout sessions) and the following analytics and measurement tools to understand how the site is used:

  • Google Analytics 4 — aggregate traffic and page analytics (sets _ga cookies)
  • Microsoft Clarity — anonymized session analytics and heatmaps, which may include recordings of page interactions (sets _clck/_clsk cookies)
  • Vercel Analytics & Speed Insights — privacy-friendly, first-party performance metrics
  • A referral cookie (up to 180 days) if you arrive via a referral or affiliate link, used only to attribute referrals
  • A campaign cookie (first_touch, 30 days) if you first arrive from an ad or a tagged link. It keeps only that link's campaign tags (utm_ parameters and the ad platform's click ID), the page you landed on and when; if you buy, they are added to your Stripe checkout so the purchase can be attributed to the campaign
  • Basic server-side request logs (IP address, approximate location, page, and referrer) used for security and abuse prevention
  • Meta Pixel — used only if and when we run advertising, to measure ad performance

These tools apply to the website only. The CoreLock app's scanning behavior is described in "What We Collect" above.

Children's Privacy

CoreLock is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at info@corelock.net and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes via email or in-app notification at least 30 days before changes take effect. Continued use of CoreLock after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at info@corelock.net.