Cora
Legal

Privacy Policy

Effective date: October 12, 2026

Back to home

Cora IQ ("we", "us", "our") operates the Cora mobile application and related cloud services. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Account credentials are managed securely through Cora Cloud. We do not store your raw password; credentials are hashed and stored using industry-standard practices.

1.2 Tank Profile Data

When you create a tank profile, we store the following in Cora Cloud:

1.3 Water Parameter Data

We store water chemistry parameters (pH, alkalinity, calcium, magnesium, nitrate, phosphate, salinity, temperature, ORP, and others) that you enter manually, import from a Neptune™ Apex controller, or receive from Cora devices. All parameter data is stored in Cora Cloud under your user account.

1.4 ICP Report Data

When you upload an ICP (Inductively Coupled Plasma) water analysis report:

Results sent by a laboratory (“Send to Cora”). If you ask a partner laboratory to send your ICP result to Cora, the laboratory sends us your email address, the result PDF and its report number, and may also send the measured values, the sample type and the sample date. We match the email address with your Cora account and add the result to your account, where it is stored and analyzed exactly like a report you upload. If you have more than one aquarium, the result waits in your account until you choose the aquarium it belongs to. You can also email your own ICP result to icp@in.coraiq.tech; we add it to the account registered under the sender’s address.

If no Cora account uses the email address a laboratory sent, we tell the laboratory only that there is no account, delete the PDF and values straight away, and keep a record of the submission without your email address for 90 days. The result is not added to an account created later.

A laboratory can see whether a result it sent was delivered. It can see Cora’s analysis of that result (the health score, the assessment of each element and the written analysis) only while you have turned on Share Cora’s analysis with labs in the app. It is off unless you turn it on, and you can turn it off at any time. A laboratory can withdraw or correct a result it sent; we tell you when it does.

1.5 Health Reports

When you generate a health report:

1.6 Cora Assistant (Text)

When you use the text-based Cora Assistant:

1.7 Cora Assistant (Voice)

When you use the voice-based Cora Assistant:

1.8 Livestock Tracking

When you track livestock (coral, fish, invertebrates), the species, name, date added, and notes are stored in Cora Cloud under your user account.

1.9 Journal Entries

When you create journal entries:

1.10 Maintenance Scheduler

When you create maintenance tasks, the task name, schedule, and completion history are stored in Cora Cloud. Push notifications for due tasks are delivered through Cora Cloud.

1.11 Parameter Alerts

When you configure parameter alerts, your alert thresholds and notification preferences are stored in Cora Cloud. Push notifications for triggered alerts are delivered through Cora Cloud.

1.12 Push Notifications

1.13 Neptune Apex Integration

When you connect a Neptune Apex controller:

All product names and trademarks are the property of their respective owners. Cora is not affiliated with, sponsored by, or endorsed by these manufacturers unless expressly stated otherwise. Some devices are connected through APIs that are not officially supported by their manufacturers; support will be updated as official APIs arrive.

1.14 AquaWiz™ Integration

When you link an AquaWiz KH Controller, Cora signs in to AquaWiz's online service on your behalf and reads that controller's measurements. Unlike the Neptune Apex integration, this one is not local; it runs in Cora Cloud, so your AquaWiz sign-in is held on our servers rather than only on your phone:

1.15 Cora Devices

When you pair a Cora hardware device:

1.16 Local Storage

The app stores the following data locally on your device using encrypted storage:

This local data is not transmitted to our servers unless explicitly stated otherwise in this policy.

1.17 Crash Reports

If the app stops unexpectedly or a screen fails to load, the app sends a crash report to Cora Cloud so we can find and fix the fault. A crash report contains:

Crash reports do not include your name, email address, tank data, photos or messages. Crash reporting is on by default. You can turn it off at any time in the app under Settings > “Send crash reports”.

1.18 Subscriptions

If you buy a Cora subscription, the payment is handled by the Apple App Store or Google Play under their own terms; we never receive your card or bank details. To know which plan your account has, we use a subscription management provider. It receives your Cora account identifier and the purchase records the store issues for your subscription (the plan, purchase and renewal dates, whether it will renew or was cancelled, and the store country and currency), and tells Cora Cloud which plan is active on your account.

1.19 Cameras

When you add a camera to Cora (for example a Wyze Cam or a Tapo camera):

2. How We Use Your Information

We use your information to:

3. Service Providers

Cora Cloud and the Cora Assistant are operated on secure, industry-leading third-party cloud infrastructure and AI processing providers. These providers act as our sub-processors under data-processing agreements and are bound by confidentiality and security obligations that provide the same or equal protection for your data as described in this policy. They process data only as necessary to deliver Cora features on our behalf.

AI processing provider: OpenAI. The Cora Assistant is powered by OpenAI. When you use the assistant (text chat, voice conversation, health reports or ICP analysis), your question or voice message, together with the tank parameters and readings, livestock list, journal entries and connected-device information needed to answer it, is transmitted to OpenAI, which generates the reply and returns it to us. OpenAI processes this data solely to produce your response. Its handling of data submitted through its API is described in the OpenAI Privacy Policy and the OpenAI enterprise privacy commitments. No data is sent to OpenAI until you have accepted the in-app data-sharing disclosure described in Section 4; if you decline, the assistant is not used and nothing is transmitted.

Email provider. Results emailed to icp@in.coraiq.tech are received by our email provider, which passes the attached reports to Cora Cloud. We keep the attached PDFs and a minimal technical record of each message, not its text, subject or addresses.

Subscription management provider. Receives your account identifier and the store’s purchase records for your subscription, and processes them only to tell Cora Cloud which plan is active (Section 1.18).

Where your data is processed. Cora Cloud, our AI processing provider, our email provider and our subscription management provider process data in the United States. When personal data is transferred from the European Economic Area, the United Kingdom or Switzerland, we rely on the safeguards the law provides, such as the European Commission’s Standard Contractual Clauses or an adequacy decision, including the EU-U.S. Data Privacy Framework where the recipient is certified.

In addition, the following optional sign-in methods are provided directly to you, each governed by its own privacy policy:

4. Data Consent

We ask for your permission before any of your data is sent for AI processing. The first time you use the Cora Assistant, the app presents an in-app disclosure that states what data will be sent and who it is sent to, and requires you to tap “Agree & Continue” before anything is transmitted. If you decline, nothing is sent.

You can turn consent off at any time from the data consent toggle in Settings. While consent is on, the Cora Assistant may use your saved tank history, parameter data, livestock, journal entries and connected-device information to provide personalized guidance. While it is off, no assistant request is sent and none of your data is transmitted for AI processing.

5. Data Sharing

We do not sell, rent, or trade your personal information. Your data may be shared with third parties only in the following circumstances:

6. Data Retention

6.1 Anonymized Aquarium Data

When you delete your account, a copy of your aquarium's non-identifying data (tank type, tank volume, water parameter history, lighting schedule, and general livestock categories) may be retained in fully anonymized form to support reef-keeping research and improve Cora's guidance. This anonymized data contains no name, email address, account identifier, device identifier, free-text notes, or photos, and cannot be linked back to you or your account.

You can turn this off at any time before deleting your account in the app under Settings > Cora Assistant > "Contribute anonymized tank data". With the switch off, your aquarium data is permanently deleted together with everything else.

7. Account Deletion and Your Rights

You can delete your account at any time from within the app (Settings > Delete Account). When you delete your account:

Under applicable data protection laws (including GDPR), you may also have the right to:

To exercise these rights, contact us at the address below.

8. Children's Privacy

Cora is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

9. Permissions

Cora may request the following device permissions:

You can deny any permission, but related features may not work correctly.

10. Security

We use industry-standard security measures to protect your data, including:

The security of your local network, device, and account credentials is your responsibility.

11. Changes to This Policy

We may update this Privacy Policy as the app evolves. The effective date at the top of this page indicates the latest revision. Continued use of the app after changes constitutes acceptance of the updated policy. If we make material changes, we will make reasonable efforts to notify you.

12. Contact

For questions about this Privacy Policy or your data: