Privacy

HCore operates coreli.top and note.coreli.top. This page covers main-site features and shared account and community data. Read the Notes privacy notice for that site’s reading, search and local preferences. Both sites use the same account terms, with separate optional Cookie choices.

Optional public profile pages

Your page is private by default. Only after you separately confirm publication in Public page settings will visitors see your avatar, address, account display name, public bio, and any tags, links and projects you choose to include at /u/your-address. Sign-in emails, phone numbers, internal user IDs, risk scores and private preferences are excluded. Leave out sensitive information. Project covers accept restricted GitHub image URLs; attachments cannot be uploaded. Viewing a cover sends an image request and necessary network information directly to GitHub, without your Coreli security logs.

Your bio, projects and page options are saved as a separately published snapshot. Your account display name and avatar use the current trusted public identity projection. We record the consent time and privacy-notice version. You can unpublish at any time. These pages are not cached by this website and are not displayed after unpublishing, restriction or deletion. External screenshots, search-engine history and copies saved by visitors cannot reliably be recalled. Pages are excluded from the sitemap and marked noindex, which does not make their links secret.

Avatar cropping, zooming and positioning happen locally in your browser. You can cancel before confirming; only the cropped avatar is uploaded to Clerk. Use images you are entitled to upload. The SMS-verification entry is not enabled, so it does not collect numbers or send messages. Activation requires separate configuration and review.

Operator, scope and contact

This notice covers coreli.top public pages, website accounts, contact features and relevant private mail-desk processing operated by HCore under the Coreli name. Use the Contact page or [email protected] for privacy, account and security requests. Third-party sites have their own policies. We do not sell your profile or build cross-site advertising profiles. A registration acknowledgement does not authorize every future use.

Purposes and necessity

Identifiers, email proof, sessions and details you choose to save provide requested account services. Limits, human verification, stable identity digests and reviews help prevent impersonation, duplicates and resource abuse. Contact information supports communication you initiate. Public content is available without an account. Refusing necessary data may prevent the corresponding feature without affecting unrelated public content. Optional analytics are separate from necessary services. Processing that legally requires consent, separate consent or another condition should start only when that condition is satisfied.

Accounts, contact messages and email

Clerk manages registration, sign-in, email, username, avatar, passwords, MFA and sessions. Its scripts, account components and necessary cookies maintain authentication and security. Passwords submitted for registration or recovery travel through this site’s HTTPS backend to Clerk; they are not stored in the website database, application logs or browser storage. Website accounts never grant private mail-desk access. Registration does not require a phone; existing optional telephone authentication data, where present, remains with Clerk.

The site provides public discussions and signed-in community interactions. It does not offer online payments or automatic renewal. Google Tag Manager (GTM-TPPKZXK3) loads only after Google Analytics consent. Vercel site analytics, product analytics and performance metrics have separate controls. See the sections below and the cookie policy. Contact submissions send your chosen name, subject and message through Vercel and Resend to the operator. Resend Receiving handles mail sent to the configured coreli.top addresses. For private search, read/star/archive features, message bodies and correspondence metadata may be synchronized to protected Neon storage; attachments may be sent over encrypted connections to private Cloudflare R2 storage. They are not publicly accessible media. Relevant provider policies also apply. The mail/contact backend uses hashed source identifiers and short-lived Upstash or memory counters to limit abuse.

Website profiles and email uniqueness

Saving your account profile stores the display name, bio, language, theme, Clerk user ID and creation/update times in Supabase. Server checks and database permissions isolate users; profiles are not published as public homepages. You can edit permitted fields, export your profile or use recent reauthentication and the site’s permanent-deletion action to delete the profile and Clerk account. Other deletion routes or failures may require manual coordination.

Each email is limited to one website account. Known provider case, Gmail-dot and supported alias rules detect duplicates. New registration requires a primary address and rejects +, # and = subaddresses and recognized Yahoo disposable subaddresses. Broader rate-limit grouping never merges distinct unknown-domain mailboxes for recovery. Sign-in emails cannot be added, removed or replaced by the user; contact us for a verified, coordinated identity change. New registrations record the accepted terms and privacy versions in Clerk private metadata with the acceptance timestamp; browser storage is not the server’s consent record.

Community and cross-site accounts

Discussions on coreli.top and comments on note.coreli.top share Clerk accounts and Supabase. Your chosen name, avatar, posted text and interaction counts can be public. Sign-in emails, internal Clerk IDs, risk information and device details are not public author fields. Names are unique across both sites. Previous names are held for 30 days; names associated with deleted accounts are held for at least 30 days.

Supabase stores posts, threaded replies, upvotes, bookmark references, blocks, notification preferences, reports, appeals, restrictions and necessary moderation records. Notifications mainly contain event and object references. Bookmarks and blocks are private account data; blocking changes your view rather than banning someone. Public comment activity is off by default, and posts appear on your profile only when you choose them. Making a profile private does not delete public discussions.

Your account center provides your activity, notifications, bookmarks, report outcomes, data export and deletion. Deletion removes the sign-in identity before erasing content and personal links; anonymous placeholders can preserve reply structure. Cross-service failures retain a retryable job and are reported as incomplete. Routine cleanup removes ordinary community audits, resolved reports and notifications older than 180 days. Necessary legacy-permission markers, minimal deletion-idempotency records and the existing registration-security ledger have separate retention. Reading history stays in this browser for the current site, without automatic upload or cross-device synchronization.

Public profiles can show explicitly selected published posts. Comments require both the profile comment switch and the Public activity community preference. The calendar counts only eligible selected posts and comments from the past year, grouped in China Standard Time; sign-ins, security events and moderation actions are excluded. Unpublishing, withdrawing activity consent, hiding content or restricting an account stops the relevant subsequent reads. External copies cannot be recalled.

Account activity and sign-in security logs

Once the log service is enabled, verified Clerk notifications confirm successful sign-ins, session endings or revocations, and identifiable security-setting changes. Profile, display-name and public-profile changes are recorded in the same transaction as a successful save. Page visits and refreshes are not sign-ins. History before integration is not fabricated, and these events do not provide a complete record of failed sign-in attempts.

Each account retains its latest 20 personal events. Administrator accounts separately retain their latest 20 administrator sign-ins. Oldest records are removed transactionally. Events include their type, time and result, plus source IP, IP-inferred region, browser and device type when actually provided by Clerk. Unsupported operating-system, hardware-model or other fields are shown as not provided. Ordinary profile saves do not separately collect IP or device data. Irreversible comparison fingerprints identify later security-setting changes; separate digests prevent duplicate deliveries. Passwords, codes, tokens, cookies and original webhook bodies are not stored.

Account holders can read their own logs. Administrator sign-ins and cross-account security records require the verified owner or an auditor with recent two-factor verification. Logs never enter public profiles or activity calendars. Account deletion removes these personal logs, deduplication digests and comparison fingerprints. Management audits and the existing registration security ledger keep their separate retention rules and are not erased by the 20-event limit. Clerk’s own processing and retention remain subject to its privacy policy.

Registration and recovery security

Cloudflare Turnstile processes necessary browser/network signals; see Cloudflare’s policy. Registration and recovery also require server checks, email proof delivered by Resend and quotas. Redis temporarily stores HMAC email/network summaries, counters, code digests and encrypted delivery emails. Supabase stores pseudonymous identity digests, risk scores, reasons and review decisions for authorized backend/administrator use. New accounts can have quotas or require review; unknown domains are not permanently banned merely because they are absent from the common-provider list. Use Contact to appeal mistakes.

Recovery credentials bind the account and version at issuance, so deletion, re-creation or conflicting indexes cannot transfer them to another account. Changing a password does not remove MFA. Generic verification responses avoid publicly confirming whether an address is registered. If a code is missing, check spam folders and wait for the displayed cooldown before retrying or requesting help. The registration ledger does not retain raw IP addresses; hosting and security providers can still process network addresses independently. The verification cookie is HttpOnly, lasts about one hour and never substitutes for human verification.

Retention and deletion boundaries

Periods depend on successful deletion markers and cleanup tasks; deletion is not simultaneous across services. Restricted provider backups, legally required records or necessary dispute material may remain until rotation or the necessary period ends. We will explain limits where backup records cannot be immediately removed individually. Anonymous visits may no longer be reliably attributable to you; we do not add tracking identifiers just to find them. Security digests are pseudonymous, not a guarantee of irreversible anonymity in every circumstance. Cleanup failures or deletion through other management interfaces can require manual reconciliation.

Device storage

Choosing a theme stores it locally in localStorage without automatically uploading it. Preferences you explicitly save to your account are separate. Remember account stores your sign-in identifier, never a password, verification code or token, and does not extend a session.

Lake Town uses this site’s browser localStorage to save the player position, direction and view; object positions and states, the held object and activity progress (coreli-lake-town-v2). Tutorial completion, graphics quality and the optional time preview use coreli-town-tutorial-v3, coreli-town-quality and coreli-town-hour. Game progress is written about every five seconds while playing. These saves stay in the browser and are not uploaded or synced to an account by the save feature. The site sets no expiry for these entries; the browser may clear them under its own storage policy.

The town uses CacheStorage for versioned public models and textures so downloaded assets can be reused. When versions change, the site prunes older town caches and keeps up to three previous versions; the browser may also evict caches to manage storage. You can clear Coreli site data in your browser settings. This may reset town progress, tutorial status, graphics choice and time preview; removed models and textures may need to download again. You can also clear other local site data through your browser at any time.

Public-page analytics

On your first visit, choose Accept all, Essential only or Customize. Google Analytics, Vercel site analytics, product analytics and performance metrics have separate controls and start off. Before a choice or after rejection, the corresponding site-managed scripts stay unloaded. GPC keeps optional analytics off; ordinary DNT does not override choices saved in Cookie settings. Essential sign-in, security checks and server logs do not depend on analytics consent.

When Google Analytics is enabled, Google Tag Manager can run the operator’s tags to measure public-page visits and technical device information. Site page events include addresses without queries/fragments, page titles, the previous public page, page type and content language. Scroll depth is recorded at 25%, 50% and 75%. Events do not include account identity or form content. Advertising storage, advertising user data and advertising personalization remain denied. Google’s processing is subject to its privacy policy. Scripts and measurement requests go directly to Google domains; the Cloudflare /metrics/ tag gateway is paused. Active tags and retention depend on the published container and GA4 property settings.

When product analytics is enabled, PostHog measures public page visits and fixed interactions with exploration, tools, search and recommendations: public place and tool categories, search method, result counts, clicked result ranks and coarse duration buckets. Feature flags and interface experiments use the same optional analytics gate. Events are not associated with Clerk users and exclude raw queries, tool input, filenames, mail and passwords. URL queries and fragments are removed. Identifiers stay in current-page memory, without analytics cookies or persistent storage. Recording, automatic click/form capture, heatmaps and console capture are disabled. Requests still pass through PostHog.

When Vercel site analytics is enabled, Vercel Web Analytics records views of allowlisted public pages. Account, authentication, profile, mail and API routes are excluded, and query strings and fragments are removed from the current page address. Vercel may also record visit time, referrer, approximate location and browser, operating-system and device categories. It does not use third-party cookies; Vercel creates a visitor hash from the request and discards it after 24 hours. Vercel says its analytics events are not associated with an individual or IP address. GPC disables this collection. If product analytics is also enabled, page events may include only the existing allowlisted feature-flag values (booleans or control/test) to compare public interface variants. Those values are removed when either choice is withdrawn. See Vercel’s Web Analytics privacy notice.

Your choice is saved in this browser in coreli_consent for 180 days. Reopen Cookie settings in the footer to change it. Withdrawal clears safely identifiable Google analytics cookies and reloads the page to stop further optional measurement. Clearing cookies cannot retract requests already sent or data already processed; contact the operator about deletion.

Error monitoring, performance and network logs

Sentry monitors minimized technical errors. Browser error collection runs only on public routes and respects DNT/GPC; server collection also handles technical failures. Outgoing events retain fixed failure categories, error types, stack positions, build versions and artifact Debug IDs, hiding dynamic messages and removing user profiles, request bodies/headers, cookies, query parameters, logs and breadcrumbs. Fixed categories of page, resource, scene and public API timings are sampled at 10%; browser performance collection requires the Performance metrics choice, is disabled by GPC, and is not disabled by ordinary DNT. Recording, session tracking, automatic request content and database child spans remain disabled. Private source maps restore source locations without collecting runtime local variables or form values. Requests still reach Sentry’s service.

Vercel hosts the website and can process standard IP, request, browser and time information for delivery, security and maintenance. When performance metrics are enabled, Speed Insights samples public-page load/interaction metrics, paths and technical device/browser categories. The site removes URL queries/fragments, excludes authentication/account/mail routes and skips the browser collector with GPC; ordinary DNT does not override the saved performance choice. See Speed Insights privacy.

Cloudflare provides DNS, proxying, WAF, the edge gateway, Turnstile and private storage. It can process IPs, requests and security events. Cloudflare Web Analytics uses manual installation and loads only when performance metrics are enabled, measuring page timing and basic traffic. Withdrawal unloads it through a page refresh. It does not write cookies or persistent browser storage. Necessary network, security and server logs are independent of analytics consent. See Cloudflare’s collection details.

Providers, recipients and international processing

Site search uses Cloudflare AI Search by default. Clicking Search, pressing Enter or selecting a suggestion sends the query through Coreli to Cloudflare to retrieve indexed public pages from coreli.top. It does not automatically generate an AI answer. Please leave out personal information. Selecting Local only matches the public index in your browser without sending the query. Results combine public pages, guide summaries, tool descriptions and site updates; external GitBook and Notion full text is not currently included. Coreli filters out accounts, personal profiles, mail, sign-in and registration pages, and unpublished material. Recommendations turn a public document ID into its public title and keywords for retrieval; visitor profile data is not sent. Local results remain available during service failures or rate limits. Redis stores short-lived public results, request coordination and rate limits. Cache keys use irreversible query or source-address digests; raw queries are excluded from Coreli analytics, logs and cache keys, and raw source addresses are excluded from this feature’s Redis data. Digests and limits expire and are not persistent visitor identities. Cloudflare receives actively submitted search text; see Cloudflare’s privacy policy.

Providers may operate outside your country or region, and requests may pass through international nodes. We cannot guarantee processing only in mainland China or your location. Contact us before submitting data requiring location-restricted processing; do not submit it if those conditions cannot be met. Provider disclosures are limited to requested services and necessary security purposes. Any additional notice, separate consent, assessment or other transfer arrangement required by law is not waived by accepting this notice. Providers can also process data independently for their own security/compliance under their policies.

External resources, Steam and Minecraft tools

Google Fonts receives requests for fonts. GitHub, Notion, QQ, Douyin and other linked sites are independent services governed by their policies when opened. The About page’s Steam widget reads the operator’s public activity, level, current game, mini-profile background and a small set of total playtimes through the backend, with brief caching. It does not fetch your Steam account or game records or the operator’s recent two-week play history. Steam hosts displayed media, which can generate browser requests; motion respects reduced-motion preferences. The Steam API key is never sent to visitors.

The About page reads the operator’s fixed Java server status through a cached backend TCP query. Its check time is backend processing time, not in-game ping. The general Minecraft checker sends your entered domain/IP directly from the browser to mcstatus.io only when you submit it; Coreli does not proxy or store that lookup address. Its timing is browser-to-API round trip. mcstatus.io may process network information under its own policy.

CPU load, memory, disk and uptime are operator-server aggregates obtained through a briefly cached, encrypted, token-authenticated backend connection. The widget does not read your device resources or disclose collector credentials, monitored host address, purpose labels, processes or paths.

Your rights, withdrawal and appeals

Use your account page to view, correct and export your profile, sign out or request deletion. For other data, Contact or [email protected] can receive requests for copies, correction, deletion, objections to risk decisions, human review or withdrawal of applicable consent. Withdrawal does not invalidate prior lawful processing or automatically remove information still needed for necessary security or legal retention. We will explain refusal, partial handling or delays. Complaints to competent authorities and applicable legal remedies remain available.

Describe the feature and desired action without including passwords, full codes, tokens, identity documents or unrelated sensitive information. To prevent unauthorized export/deletion, we use an existing session, existing mailbox or other proportionate checks, never passwords or MFA backup codes. We normally reply with progress within 15 working days; any shorter applicable legal deadline takes priority. Complex requests or provider deletion delays will be explained.

Minors, incidents and changes

The site is not directed to children. Users below the local age of independent consent should obtain a guardian’s help and legally required consent. Do not submit unnecessary identity, health, financial or children’s information. Individuals and guardians may contact us about inappropriate collection and request deletion/restriction.

Reasonable measures include HTTPS, server authorization, database permissions, short-lived codes and limits; no system is guaranteed risk-free. If an incident may affect personal data, we will contain impact, investigate and provide necessary information and response steps through available contact channels or site notices as required. Material changes will be identified here. A new purpose needing additional consent will be presented separately rather than relying on an earlier checkbox.

Document versions and consent records

Terms, the privacy notice and the cookie policy have separate document versions. Cookie consent has its own configuration revision. Layout-only updates do not reset analytics choices. New optional purposes or changes requiring fresh consent must wait for the required consent. Registration keeps the version and time actually accepted on the server, without rewriting old records as acceptance of new terms. Accepting account terms does not authorize analytics.