KORA Privacy Policy

Version 2026-10-21

This text says what data KORA holds about you, why, where it sits, who can see it and how you take it back. It describes what the application actually does today, not what it might do one day.

Data controller: KORA Social Network, a business registered in Québec (Canada), whose address is 300-204, rue du Saint-Sacrement, Montréal, Québec H2Y 1W8, Canada. Contact: contact@korasocialnetwork.africa (or by post: KORA Social Network, 300-204, rue du Saint-Sacrement, Montréal (Québec) H2Y 1W8, Canada). Person in charge of the protection of personal information: the owner of the business, reachable at privacy@korasocialnetwork.africa. Representative in the European Union (Article 27 GDPR): KORA will shortly appoint a representative established in the European Union; their name and address will appear here as soon as they are appointed. Until then, write to privacy@korasocialnetwork.africa.

If you are in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) applies to your data, in addition to the Canadian and Québec laws to which KORA is subject.

1. What we collect

What you give us at sign-up: your email address, a password, a display name, a public handle, your date of birth, your country, the application language and the interests you tick. The biography is optional. You can then choose, in your settings, the languages of the videos you want to see.

Your password is never visible to us: it is kept as a cryptographic hash by the authentication service, and we can neither read it nor give it back to you.

What you post: your videos and their files, captions, comments, your likes, your follows, your reposts.

Your follows and follow requests: whom you follow, who follows you, the requests you send and receive, and the answer given to them.

Your private messages: the text of the messages you exchange with other members, the videos you send them (the message carries a link to the video, not a copy), the date of each message and the date you last opened the conversation.

Your follow log: a dated list of the requests you have received and what you did with them, and of your own actions (request sent, follow, unfollow).

What you watch: unless you have paused it, we keep the list of videos you have watched for at least two seconds, with the date of the last time: this is your watch history. Your own videos are not included.

Your choices about your videos: whether or not you allow other members to download them.

If you offer support: the address of your payment page, as you declare it. This feature is suspended for now: no link can currently be declared. We receive neither the amount of a donation, nor the means of payment, nor the identity of the giver: the payment happens at your provider, outside KORA.

What use produces: the creation date of each item, the blocks you set, the reports you file.

What the application measures: when you open it or come back to it, how long you watch a video and how long it takes to start, when you post or share a video, when a post fails and when the application runs into an error. Each measurement comes with your phone's model, its operating system, the application version, the type of network (Wi-Fi, 3G, 4G…), the interface language and an identifier drawn at random at installation, which disappears when you uninstall the application. If you installed KORA from a link carrying a campaign name (a creator's or an event's, for example), we keep that name. These measurements contain neither your videos, nor your text, nor your location.

What we do not collect: we do not ask for your location, we do not access your contacts or address book, and we use no advertising trackers and no third-party analytics. The application shows no advertising. We sell no data.

The measurements described above are made by KORA itself, without any third-party tool.

2. Why

Your email address and password identify you and let you come back to your account. The handle, country, biography and interests make up your profile, which is public within the application. The display name you give at sign-up is not shown in the application, which displays only your handle; it remains stored with your profile. Your videos and comments are published because that is the point of the service.

Your interests and the languages you have chosen are also used, together with the accounts you follow, to filter the videos offered to you. You can change these choices at any time in your settings.

Your email address is also used to write to you about your account: sign-up confirmation, password reset, moderation decisions that concern you, and confirmation that your account has been deleted. We send you no newsletter and no advertising.

Your date of birth serves only to check that you are eighteen or older. It is shown to no one.

Your watch history is used only to let you find a video you have already seen. It is used neither for advertising nor to choose the videos shown to you.

Follow requests let you decide who follows you: a follow takes effect only once accepted. One exception: when you follow someone, you thereby agree that they may follow you back, and their follow is accepted automatically. Writing to a member who is not a mutual follower counts as a follow request; while it remains unanswered, you can send them only one message.

The follow log lets you know who followed you, when and how.

Your private messages serve only to be delivered to the person you write to. No one at KORA reads them, except moderation when a conversation is reported (see § 3). They are used neither for advertising nor to choose the videos shown to you.

Reports and blocks serve moderation — that is, protecting the other people present.

Usage measurements tell us whether KORA keeps its promises — whether people come back, whether they post, whether videos start quickly, especially on slow networks — and help us fix what does not work. They are used neither for advertising nor to choose the videos shown to you. We look at them as overall figures.

2a. On what basis

Each use described above rests on one of the following bases.

The contract between us — the Community Guidelines, which you accept at sign-up: your account and profile, your posts, comments and likes, your follows and your follow log, your private messages, your watch history, the choice of videos suggested to you and the emails about your account. Without this data, we could not provide the service.

Our legitimate interest in protecting people and in running KORA: age verification, reports, blocks and moderation, the email fingerprint kept after a sanction, database backups and usage measurements. You may object to these uses (see § 6); we act on your objection unless a compelling reason — protecting another person, for example — overrides it.

A legal obligation: answering a lawful order from an authority, notifying a data breach, reporting content involving a minor to the authorities.

We rely on your consent for no other use. If that were to change, we would ask you for it separately, and you could withdraw it at any time.

No decision that significantly affects you is taken by fully automated means: every report is examined by a person.

3. Who sees what

Public, visible to everyone in the application: your handle, your country, your biography, your interests, your published videos, their captions, your comments, and your follows once accepted (whom you follow, who follows you).

Public once approved: the payment link you declare, shown on your profile and, if you ask for it, on your videos (feature suspended for now).

Visible only to the two people concerned: a pending follow request. A refusal is silent: the person who asked is not told.

Visible to you and to the person you write to: your private messages. A block, in either direction, cuts off the conversation: it disappears for both of you and no one can write in it any more. If you decline a request that came with a message, that message disappears for you.

Visible to you alone: your email address, your date of birth, the list of accounts you have blocked, your follow log.

Also visible to you alone: your watch history, in the “History” tab of your profile.

Visible to a video's author: the accounts that liked it (their handle and profile photo). Everyone else sees only the number of likes.

Visible to moderation: reports, with the reason you wrote. At the moment of a report we keep the name of the author concerned and an excerpt of the content, so that a decision remains possible even if the content has since disappeared. For a reported conversation, it is the database itself — not the application — that copies, at the moment of the report, the last thirty messages exchanged between the two people, with their date and author. That is all moderation sees of the messaging.

Visible to the KORA team only: usage measurements (see § 1), viewed as overall figures.

How your videos are protected. A published video can only be played through a signed, temporary address, which our servers issue only after checking that the person watching is entitled to see it. Unpublishing a video, deleting your account, or blocking someone therefore genuinely stops the video being reachable, not merely displayed.

A published video can nevertheless be watched, recorded and passed on by the people who can see it. Do not post on KORA what you would not want circulating.

Downloads. If you leave them on — the default setting — other members can save a copy of your videos on their phone, marked “KORA @your handle”. You can turn this off for all your new videos in your settings, or video by video. This applies from then on: a copy already saved is beyond our control.

4. Where your data is

Four providers, for four different things.

Your account and your text — profile, captions, comments, follows, private messages — sit with a specialised database host, which runs on the infrastructure of a major cloud computing provider. They are currently located in the European Union (Frankfurt, Germany).

Usage measurements are kept in the same place as your account.

Your videos are entrusted to a global video delivery network, which transcodes them and delivers them from servers spread around the world, close to whoever is watching. That is what lets a video adapt to a slow connection instead of being sent as-is.

The emails we send you (see § 2) go through an email delivery service, which receives your email address and the content of the message for that purpose. It processes these emails from the European Union (Ireland).

The messages you write to us (at our contact addresses) are received in a business email service provided by a major cloud computing provider, whose servers are spread around the world.

If you live outside the European Union — in Africa or Canada, for example — your data is therefore transferred and processed outside your country.

These transfers are governed by the Canadian and Québec laws on the protection of personal information, to which KORA is subject as a business established in Québec.

If you are in the European Union, your data may also leave it: to Canada, where KORA is established, which the European Commission recognises as providing adequate protection; and to our providers when they process it elsewhere, notably in the United States. Those transfers are covered by the standard contractual clauses adopted by the European Commission, included in our contracts with these providers, and, for those that have joined it, by the EU–U.S. Data Privacy Framework. You may ask us for a copy at privacy@korasocialnetwork.africa.

We share your data with no other company, apart from the four providers above, which act on our behalf and on our instructions. We may be required to disclose it to a judicial authority upon a lawful order.

If the operation of KORA were entrusted to another company of the same group, or transferred to a successor (merger, reorganisation, sale of the business), your data and this policy would follow the application, under the same conditions and for the same purposes. We would inform you in the application before the change takes effect.

5. For how long

Your data is kept as long as your account exists.

When you delete your account, the following are erased immediately and permanently: your profile, your videos and their files, your comments, your likes, your follows and follow requests, your follow log, your reposts, your blocks, your watch history, your conversations and your authentication account. A conversation then disappears on both sides: the messages you sent are erased for the person you were writing to as well, and theirs for you. This deletion is irreversible: we never restore a deleted account. The database's automatic backups, used only to recover from a failure, still contain this data for at most seven days, then are overwritten. Emails already sent to you obviously cannot be recalled; the email delivery service keeps a technical record of them for a limited time, then erases it.

Usage measurements are kept for thirteen months at most, then erased. They are also erased, without waiting, when you delete your account, including those your phone recorded before you signed up.

A few clarifications, which we would rather state:

Reports you have filed remain, but stripped of your identity: the row stays, the link to your account is erased. The reason is simple — someone harassed who reports and then leaves should not take with them the record of what they endured.

Content under a report is not kept aside: it is deleted from our servers like any other content, whether you remove it yourself or delete your account. Only the report itself remains, with the author's name and the excerpt recorded when it was made (see § 3).

After a deletion as a sanction, a fingerprint of your email address is kept for six months. It is a one-way value (SHA-256): on its own, it does not reveal the address. Its only use is to refuse a new sign-up with the same address during those six months (see the Community Guidelines, § 5); it is then erased. Nothing of the kind is kept when you delete your account yourself.

Watch history is kept for 90 days at most: a video watched longer ago drops out on its own. You can clear or pause it at any time.

The follow log is kept for 90 days at most, then erased.

Private messages are kept as long as both accounts exist. Messaging does not yet allow a message to be deleted once sent. A conversation is erased, on both sides, as soon as either person deletes their account. A reported conversation leaves, like any report, the excerpt recorded at the time it was made.

6. Your rights

At any time you may:

View and correct your profile from within the application.

Delete a video, a comment, or your entire account, from Profile then Settings.

Clear or pause your watch history, from Settings then My activity.

Request a copy of the data concerning you, including in a structured, machine-readable format, so that you can pass it on to another service.

Ask for the correction or erasure of anything you cannot correct or delete yourself in the application.

Object to the uses based on our legitimate interest (see § 2a), in particular usage measurements, or ask for their restriction while we examine your request.

To exercise these rights, or to ask any question about this text, write to privacy@korasocialnetwork.africa (or by post: KORA Social Network, 300-204, rue du Saint-Sacrement, Montréal (Québec) H2Y 1W8, Canada). We answer within 21 days. We may ask you to confirm your identity, normally by writing to us from your account's email address.

If you believe your rights have not been respected, you may lodge a complaint with the data protection authority of your country. In the European Union, that is the authority of the country where you live, where you work or where the infringement took place — the CNIL in France or the Data Protection Authority in Belgium, for example. In Québec, it is the Commission d'accès à l'information.

7. Security

Traffic between the application and our servers is encrypted. Access to data is governed by rules enforced by the database itself, not by the application alone: one account cannot read another's private data, even if the application were modified.

Your private messages are encrypted in transit and on our servers, but they are not end-to-end encrypted: they remain readable by our systems, which is what allows a reported conversation to be moderated. Do not write in them what you would not entrust to an online service.

No system is infallible. In the event of a data breach presenting a risk to you, we will inform you and notify the competent authority.

8. Children

KORA is not intended for people under eighteen and we do not knowingly collect their data. If you believe an account belongs to a minor, write to us at privacy@korasocialnetwork.africa (or by post: KORA Social Network, 300-204, rue du Saint-Sacrement, Montréal (Québec) H2Y 1W8, Canada): we will delete it.

9. Changes

We will revise this text. Each version carries a date. Where a change is significant, we will tell you in the application before it takes effect.