1. Who we are
CORE MDM is an Android device management service made up of the CORE MDM app, the web installer and the web console (together, "the Service"). It is operated by CORE MDM ("we", "us"). We are responsible for the personal information described in this policy.
If you manage phones used by other people, such as employees, students or your children, you decide which phones are managed and which rules apply. For information about those phones, you are the one in control of how it's used, and we process it on your behalf.
2. What we collect
| Information | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, a user ID, and your password (stored in encrypted form by our sign-in provider; we can't see it). | You, when you create an account or sign in. |
| Device details | Manufacturer and model, Android version, IMEI, serial number, Android ID, and a hardware ID made from one of these. | The CORE MDM app on the phone. |
| Device status | Online or offline, and the time the phone was last seen. | The app, about once a minute while it runs. |
| Push token | A token that lets us send instant commands to the phone. | The app, through Firebase Cloud Messaging. |
| Rules and commands | The rules you turn on (for example, "block app installs"), commands you send (lock, alarm, reboot, lockdown, wipe), your private DNS setting and the kiosk list of allowed apps. | You, in the web console or the app. |
| Activity log | Each action taken in the console: what it was, which device, the time, your email and user ID, and your browser's user-agent string. | The web console, automatically. |
| Pre-registered devices | IMEI, a group name and a one-time enrollment code, for devices registered before they're set up. | Platform administrators. |
3. What we don't collect
CORE MDM controls what a phone can do. It does not read what's on it. We do not collect:
- location or GPS data;
- contacts, messages, emails, photos, files or call logs;
- the websites visited or the apps used (see Content filter);
- anything for advertising. There are no ads, analytics or tracking tools in the app or the console.
The app shows some information, such as battery level and network status, on the phone's own screen. That information stays on the phone.
4. How we use it
- To run the Service: to link a phone to your account, show it in your console, and deliver your rules and commands to it.
- To keep it secure: to sign you in, keep the activity log, prevent misuse, and investigate problems.
- To support you: to answer your questions and fix problems with your devices.
- To meet legal obligations: where the law requires it.
We rely on these legal bases: providing the Service you asked for (contract); keeping the Service secure and working (legitimate interests); and complying with the law. We never sell personal information or use it for advertising.
5. Who can see it
- You. A phone is linked to the account that signed in on it. Only that account can see and manage it in the console.
- Our platform administrators. They can view all devices and the activity log, and send commands, to provide support, keep the Service secure and prevent abuse. Every action is recorded in the activity log.
- Service providers who run parts of the Service for us (see below).
- Authorities, if the law requires it, or to protect someone's safety or our legal rights.
- A buyer or successor, if our business is sold or merged, under the same protections.
6. Service providers
- Google Firebase (Google LLC): sign-in, database, and push messages to the phone.
- Our hosting provider hosts this website.
- Google Fonts supplies the website's font. Your browser contacts Google to load it.
- jsDelivr supplies the code libraries the web installer uses to talk to the phone over USB.
- Cloudflare or Google DNS, if you use the content filter (see below).
These providers process information only to provide their service and under their own privacy terms.
7. Content filter and DNS
The content filter runs on the phone. When an app or website looks up an address, the filter checks it on the phone and passes allowed lookups to a DNS server: Cloudflare (1.1.1.1) by default, or another server chosen on the phone. If you turn on "Private DNS" in the console, the phone uses the DNS provider you entered.
Those DNS providers receive the addresses the phone looks up, under their own privacy policies. CORE MDM does not record or upload the sites visited.
8. The web installer
The installer runs entirely in your browser. It sends the CORE MDM app to the phone directly over the USB cable and does not upload anything about the phone to us.
To connect, your browser creates a security key and saves it on this computer, so the phone can recognise it next time. The key stays in your browser. You can remove it by clearing this site's data in your browser settings.
9. How long we keep it
- Account and device records: for as long as your account and devices are active. When you ask us to delete a device or your account, we delete the records promptly.
- Activity log: kept as a tamper-proof security record for as long as it's needed for security and preventing abuse, then deleted.
- Backups and legal holds: copies may remain in backups for a short time, or longer if the law requires it.
10. Security
Information is encrypted in transit. Access to the database is restricted by rules that let each account reach only its own devices. Only a small number of verified administrators have wider access, and their actions are logged. No system is perfectly secure, so please use a strong, unique password and keep it private. Anyone with your password can control your phones.
11. Your choices and rights
Depending on where you live, you may have the right to:
- see the personal information we hold about you and get a copy;
- correct information that's wrong;
- have your information deleted;
- object to or restrict how we use it;
- complain to your local data protection authority.
To use any of these rights, contact the CORE MDM team. If you use a phone managed by someone else, such as your employer or school, contact them first: they control that phone's information.
To stop a phone sending information, remove it from management and uninstall CORE MDM, or factory reset it.
12. Children
CORE MDM accounts are for adults. Parents and guardians may use CORE MDM to manage a child's phone. We collect only the device information described above, not the child's own personal content. If you believe a child has created an account, contact us and we'll delete it.
13. International transfers
Our service providers may store and process information in the United States and other countries. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.
14. Changes to this policy
If we make significant changes, we'll update the date above and let account holders know before the changes take effect.
15. Contact
Questions about privacy? Contact the CORE MDM team.