KORA Privacy Policy

Version 2026-09-11 — draft for review. Bracketed passages still need to be completed or validated.

This text says what data KORA holds about you, why, where it sits, who can see it and how you take it back. It describes what the application actually does today, not what it might do one day.

Data controller: [LEGAL ENTITY AND ADDRESS]. Contact: [CONTACT ADDRESS].

1. What we collect

What you give us at sign-up: your email address, a password, a display name, a public handle, your date of birth, your country and the interests you tick. The biography is optional.

Your password is never visible to us: it is kept as a cryptographic hash by the authentication service, and we can neither read it nor give it back to you.

What you post: your videos and their files, captions, comments, your likes, your follows, your reposts.

What use produces: the creation date of each item, the blocks you set, the reports you file.

What we do not collect: we do not ask for your location, we do not access your contacts or address book, and we use no advertising trackers and no third-party analytics. The application shows no advertising. We sell no data.

2. Why

Your email address and password identify you and let you come back to your account. The display name, handle, country, biography and interests make up your profile, which is public within the application. Your videos and comments are published because that is the point of the service.

Your date of birth serves only to check that you are eighteen or older. It is shown to no one.

Reports and blocks serve moderation — that is, protecting the other people present.

3. Who sees what

Public, visible to everyone in the application: your display name, your handle, your country, your biography, your interests, your published videos, their captions and your comments.

Visible to you alone: your email address, your date of birth, the list of accounts you have blocked.

Visible to moderation: reports, with the reason you wrote. At the moment of a report we keep the name of the author concerned and an excerpt of the content, so that a decision remains possible even if the content has since disappeared.

An important point, to be read in full. Video files are stored in a publicly readable space: anyone who knows a file's exact address can open it, including without a KORA account, and including after you have unpublished the video in the application. Unpublishing removes the video from the feed, not the file from storage. Only deleting the video or your account erases the file. Do not post on KORA what you would not want circulating.

4. Where your data is

Our data is hosted with Supabase, which runs on Amazon Web Services infrastructure. The project is currently located in the United States (us-east-1 region). If you live in Africa or in Europe, your data is therefore transferred and processed outside your country.

[TO BE VALIDATED: the legal basis for this transfer under the applicable law — GDPR where people in the European Union are concerned, and the national data protection laws of the countries served. To review with a lawyer; and to revisit if the project is moved to a region closer to its users.]

We share your data with no other company, apart from the host above, which acts on our behalf. We may be required to disclose it to a judicial authority upon a lawful order.

5. For how long

Your data is kept as long as your account exists.

When you delete your account, the following are erased immediately and permanently: your profile, your videos and their files, your comments, your likes, your follows, your reposts, your blocks and your authentication account. This deletion is irreversible: we keep no backup that would allow it to be undone.

Two exceptions, which we would rather state:

Reports you have filed remain, but stripped of your identity: the row stays, the link to your account is erased. The reason is simple — someone harassed who reports and then leaves should not take with them the record of what they endured.

[DECISION TO BE MADE: content under an open report. Should it be kept offline for a set period, and how long? To settle with a lawyer, then to be written here — and the text will have to match what the code actually does.]

6. Your rights

At any time you may:

View and correct your profile from within the application.

Delete a video, a comment, or your entire account, from Profile then Settings.

Request a copy of the data concerning you, or ask any question about this text, by writing to [CONTACT ADDRESS]. We answer within [DELAY TO BE SET — one month is the usual period].

If you believe your rights have not been respected, you may lodge a complaint with the data protection authority of your country.

7. Security

Traffic between the application and our servers is encrypted. Access to data is governed by rules enforced by the database itself, not by the application alone: one account cannot read another's private data, even if the application were modified.

No system is infallible. In the event of a data breach presenting a risk to you, we will inform you and notify the competent authority.

8. Children

KORA is not intended for people under eighteen and we do not knowingly collect their data. If you believe an account belongs to a minor, write to us at [CONTACT ADDRESS]: we will delete it.

9. Changes

We will revise this text. Each version carries a date. Where a change is significant, we will tell you in the application before it takes effect.