Privacy Policy

Who we are

Coral is made by Lior Pesoa, an individual based in Israel (“Coral”, “we”, “us”). We are responsible for the personal data described here. Questions or requests go to hello@usecoral.app.

Coral is still in development. This policy covers this website and the Coral apps for Mac and iPhone as they work today. We’ll update it before we start selling Coral, and whenever how we handle data changes.

This website

The waitlist

When you join the waitlist, we store:

• your email address,
• which form you used (top or bottom of the page),
• the page that referred you, if your browser sends it.

We use your email only to tell you when Coral is ready and to send occasional news about it. Each email has a way to stop them, or write to hello@usecoral.app. We keep your email until Coral launches and you’ve had a chance to get it, or until you ask us to remove it.

Abuse protection

To stop automated sign-ups, we briefly check your IP address against recent attempts. It stays in memory for about ten minutes and is never written to our database.

Your companion

If you pick a companion on the page, your choice is saved in your own browser’s local storage so it’s still there next time. It never reaches us.

No tracking

We don’t use analytics, advertising or tracking cookies. Our hosting provider keeps standard server logs (such as IP address, browser type and the page requested) for security and reliability, for a short time.

The Coral app for Mac

Coral watches the coding agents you run (such as Claude Code, Codex and OpenCode) so it can show you when one needs you. To do that it reads their session files, hook events and terminal state on your Mac. All of this, along with the Briefs, history, memory and rules Coral keeps, is stored on your Mac and is not sent to us.

What can leave your Mac

• Briefs, routing and memory. To write each agent’s Brief, route a voice or typed request to the right agent, and keep project memory, Coral sends short excerpts of agent transcripts to an AI model. It does this through your own Claude Code login, so these requests go to Anthropic under your account and Anthropic’s terms, not through our servers. You can turn memory off per project.
• Voice. Speech is turned into text on your Mac with Apple’s on-device recognition. Audio is not sent anywhere.
• Your answers and images. When you answer an agent, or paste or drop an image for it, Coral passes that to the agent you chose. What the agent does with it is governed by that agent’s provider.
• Buttons and scripts. Custom buttons run the scripts and Shortcuts you set up, on your Mac.

Permissions

Coral asks macOS for Accessibility, Microphone, Speech Recognition, Screen Recording, Notifications and Automation access, each for the feature named when it asks. You can turn any of them off in System Settings.

The Coral app for iPhone and Apple Watch

When you pair an iPhone, your Mac sends it summaries of what your agents are doing and what’s waiting on you, and the iPhone sends back your answers. Your iPhone never receives full transcripts.

• End-to-end encryption. Every message is encrypted on one device for the other device’s key. Our relay (run on Supabase) passes messages along but cannot read them.
• Short-lived storage. If a device is offline, the relay holds its encrypted messages until they’re delivered, and deletes them after 24 hours at most.
• Anonymous device identity. Each device signs in to the relay with an anonymous identity. We don’t ask for your name or email in the app.
• Notifications. To send notifications and Live Activities, we store your iPhone’s Apple push token, linked to its anonymous identity. Pushes carry encrypted content that your iPhone decrypts; Apple and we see only a generic line like “An agent needs you”. We keep a record that a push was sent, for rate limiting, for one hour.
• On the same Wi-Fi, your Mac and iPhone can talk directly, with the same encryption, and the relay isn’t used.

Unpairing a device on your Mac or iPhone deletes its keys and tells the relay to drop the link.

Who we share data with

We use a few providers to run Coral. They process data only on our behalf:

• Supabase, for the waitlist database and the encrypted relay.
• Our website host, to serve this site.
• Apple, to deliver push notifications.
• An email provider, when we email the waitlist.

When Coral goes on sale, payments will be handled by a payment provider acting as merchant of record. They will process your payment details under their own privacy policy; we won’t see your card number.

We don’t sell or rent personal data, and we don’t share it for advertising. We may disclose data if the law requires it.

Our providers may process data outside your country, including in the United States and the European Union. Where required, we rely on appropriate safeguards such as standard contractual clauses.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, or to delete it, and you can object to how we use it. Write to hello@usecoral.app and we’ll answer within 30 days. Depending on where you live (for example under Israel’s Privacy Protection Law or the EU and UK GDPR), you may also complain to your local data protection authority.

Most of what Coral keeps is on your own devices, and you can delete it yourself: in Coral’s Settings, by unpairing devices, or by uninstalling the app.

Security

We protect data in transit with encryption, keep relay content end-to-end encrypted, and restrict access to our databases. No system is perfectly secure, but we’ll tell you promptly if a breach affects your data.

Children

Coral is not meant for children under 16, and we don’t knowingly collect their data.

Changes

If we change this policy, we’ll update the date at the top. If a change is significant, we’ll tell you by email or in the app before it takes effect.

Contact

Lior Pesoa, Israel · hello@usecoral.app