Updated: 2026-11-03 · Privacy notice version: 2026-11-03.2
Scope and contact
HCore operates note.coreli.top for public technical notes and comments. This notice covers Notes itself. The main-site privacy notice and shared terms explain the shared account service. Contact HCore through the contact page or email@coreli.top. Do not send passwords, verification codes or session tokens.
Reading, search and external resources
Public notes do not require an account. Quartz search downloads a public content index and matches keywords in your browser. Notes does not use the main site’s Cloudflare AI Search or send queries to a generative model. Only public notes are published; private Notion content is not imported into this search.
Noto Sans SC and JetBrains Mono are served locally. Pages, fonts and scripts still require network requests. Vercel hosts the site; Cloudflare provides DNS, proxying and security. They may process request times, IP addresses, browser information and security logs under their own configurations and policies. There is no promise of a single retention period or instant deletion.
GitBook, Notion, GitHub and other external links open another service only when followed. A note may also cite external images or resources; loading them sends necessary request information to that source, as indicated by the individual page.
Shared accounts and comments
Notes uses the same Clerk instance and accounts as the main site, with no separate registration system. Essential cookies, components and requests maintain sign-in and security. Optional Notes preferences do not delete these cookies. The main site’s server rules still control registration, recovery, MFA, email uniqueness and Owner permissions; a display name cannot grant a role.
Notes’ same-origin comment API verifies Clerk sessions and accesses the shared Supabase community data. Display names, avatars, public text, reply relationships and interaction counts may be read publicly. Private email addresses, internal identity keys, security logs and report contents are not public author information. Votes, bookmarks, notifications, blocks, reports and appeals follow existing account permissions. Bookmarks and blocks are private account data.
Moderation may hide or delete prohibited content and retains necessary audit records. Authors keep their original rights under the shared terms. Closing a public profile does not remove comments already published or copies saved elsewhere. Notes does not read your private mailbox or Steam session.
Account activity and security logs
The main site records verified Clerk events and successful account transactions. Reading or refreshing a note is not a login. The site does not invent earlier history or failed logins it cannot establish. Each account retains at most its latest 20 personal log entries; administrator accounts separately retain their latest 20 administrator-login entries. Backend transactions prune older entries.
When supplied by a trusted event, logs include time, outcome, source IP, approximate region, browser and device category. Unknown operating systems or models remain unspecified. Reading Notes does not add device collection. Logs are private and excluded from activity calendars. Passwords, codes, tokens, cookies and raw event payloads are not stored. Notes does not create a separate security-log database.
Local preferences and optional analytics
Notes currently enables no Google Analytics, PostHog, Vercel Web Analytics, Cloudflare Web Analytics or Speed Insights visitor SDK. This change adds no Sentry browser monitoring. Quartz analytics is disabled. Necessary hosting and security logs are separate from visitor analytics; a Cookie button cannot undo network requests already made.
Theme, reader mode and sign-in storage support the functions you choose. Optional local reading history starts off and keeps only the 50 most recent note titles and URLs in this browser. It is not uploaded, linked to an account or shared with the main site. See the Cookie policy for keys and controls. GPC is never treated as permission to track. A new optional purpose would require updated information and any necessary consent.
Retention and deletion
| Data | Actual boundary |
|---|---|
| Notes preference cookie | 180 days in this browser; clearing it or a configuration revision can prompt again |
| Theme | Locally until changed, cleared or evicted; reader mode stays in the current page session only |
| Optional reading history | At most 50 entries; disabling or clearing it removes local entries, with no server copy |
| Profiles and public comments | Shared account rules apply until edited, deleted or account closure; replies may keep anonymous structural placeholders |
| Ordinary community audits, resolved reports and notifications | Main-site jobs clean records older than 180 days; dedicated security ledgers and management audits have separate rules |
| Login security logs | The latest 20 entries per account per log stream; account deletion removes associated personal logs and comparison fingerprints |
| Hosting/security logs and provider backups | Actual provider configuration and rotation apply; no uniform automatic deletion schedule is claimed |
Account deletion requires recent verification and may finish in stages, with retry tasks for failed services. Closing a page or success at one provider does not mean all deletion has finished. Registration anti-abuse summaries, review audits and backups have separate limits in the main privacy notice. Cookie settings manage local optional storage, not account deletion.
Providers, international processing and rights
The existing services are Vercel hosting, Cloudflare networking/security, Clerk authentication and Supabase profiles/community data. Resend, Upstash, Neon and R2 have specific main-site verification, contact-mail, rate-limit and storage roles. Installing an SDK does not mean Notes performs the same collection. Processing may occur outside your country or region; local-only storage cannot be guaranteed. Accepting a notice does not waive additional legal requirements.
Use the shared account centre to access, correct, export or request account deletion. Change local preferences here or in the footer. Contact HCore for copies, deletion, objections or review of a restriction or report you cannot handle yourself. Withdrawal does not invalidate earlier lawful processing or necessary retention. Identity checks use proportionate session or original-email verification, never your password or MFA backup codes. Progress is normally provided within 15 working days, subject to any shorter statutory deadline; provider delays will be explained. You may still complain to a competent authority or seek legal remedies.
The service is not directed at children. Those below the age of independent consent should obtain legally required guardian permission. Do not submit unrelated sensitive or children’s data. Incidents affecting personal information will be contained and notified as applicable; material new purposes will be explained separately.
Provider policies: Clerk, Supabase, Vercel, Cloudflare.
Terms · Cookie policy and settings · Open source · Back to notes