Coralflavor

GDPR overview

The GDPR is never mentioned on Coralflavor's site. Neither the privacy policy nor the terms refer to the GDPR, the CCPA or any other data protection regulation. No data protection officer is named, no Article 27 representative is designated for the European Union, and no data processing agreement is published or offered. No subprocessor list exists either: Google Analytics is the only third-party service named, and the policy states that Coralflavor is not responsible for its privacy practices. That absence is consistent with the scope the publisher sets for itself, since the policy states that the website is intended only for users located in the United States, with the laws of the United States and the State of California as governing law. Privacy questions go to a single Proton Mail address published on the privacy and terms pages, which is not presented as a GDPR contact.

Who owns the data?

Coralflavor's privacy policy, last updated on 21 July 2026, describes a service built around keeping as little as possible rather than one that claims ownership. Conversations are not permanently stored unless save mode is switched on, and the user can disable saving or delete individual chats at any time. The email address collected at sign-up is held by Coralflavor and used for transactional and promotional messages, with an unsubscribe option. Deleting the account from Settings > Danger Zone removes the account and every saved chat, but the credits record is expressly kept. What the site publishes therefore covers control and erasure rather than ownership as such: the user decides what survives, except for the credits ledger and the email trail.

Reuse rights

According to the privacy policy, chat content is processed transiently to generate a response and is not retained once that response has been delivered. Coralflavor states that user data is never passed to the models and that every model it calls enforces zero data retention, so prompts and generated answers are neither stored as server-side logs nor recycled as training material. IP addresses are not permanently stored either. The email address is used for transactional and promotional messages, and users can unsubscribe. Google Analytics separately collects pages visited, time spent, browser and device type, and a general geographic region. On the output side, the terms place responsibility for prompts and for any use of the answers on the user, who may reuse what the model produces without asking permission, within the prohibited-use list the terms set out: breaking the law, exploiting others, attempting to generate CSAM, malware and spam.

Data retention & training

Hosting summary

Coralflavor publishes no hosting information at all: no country, no region, no trust or security page and no subprocessor list. The only security statement is that SSL encryption is enforced on the website, alongside the claim that no prompt logs are kept on the servers. What can be observed technically is not presented by the publisher as a hosting declaration and should not be read as one: the domain resolves to 172.67.144.1, an anycast address in Cloudflare's AS13335 seen from a San Francisco node in the United States, while authentication is handled by Firebase Auth and analytics by Google Tag Manager, both loaded from Google domains on the home page. Anycast routing means the node observed says nothing reliable about where data is actually processed or stored. In practice, a reader who needs the jurisdiction of the infrastructure, the identity of the hosting provider or the location of any backup will not find it on the site, and there is no data processing agreement to fall back on. The only jurisdictional anchor published is the governing law: United States, State of California.