Privacy Policy

1. Who This Applies To

Kora accounts are created and managed by adults (18+). Children and other family members are added as names within a parent or guardian's account — they do not have separate logins, cannot be contacted directly by Kora, and do not provide their own information to us. Any information about a child (such as a first name) is provided and controlled entirely by the parent/guardian account holder.

Kora is not directed at children and we do not knowingly collect information directly from anyone under 18.

2. Information We Collect

Account information: name, email address, and authentication details (including via Google sign-in, where you choose to use it).

Family and household content you create: family member names, calendar events, shopping lists, meal plans, to-do items, and family invite codes used to link household members' accounts.

Newsletter scanning feature: if you use this feature, images of school newsletters you upload are processed to extract event and date information. See Section 4 for how this is processed.

Technical information: device type, browser, general usage data, and information needed to keep the app secure and functioning (such as session data for staying signed in).

We do not collect payment information at this time, as Kora is currently free to use.

3. How We Use Information

We use your information to:

• Provide and operate the app (calendars, lists, invites, notifications)
• Authenticate your account and keep you signed in
• Send transactional emails (e.g. sign-in codes, invite notifications, password resets)
• Maintain security and prevent misuse
• Improve the app based on how it's used

We do not sell your information, and we do not use family or household content for advertising.

4. Third Parties We Work With

Kora is built on infrastructure provided by trusted service providers, who process data on our behalf:

• Lovable Cloud / Supabase — hosts our database and authentication systems, and stores account and household data.
• Resend — sends transactional emails (sign-in, invites, notifications) on our behalf via our domain.
• Anthropic (Claude API) — processes uploaded newsletter images to extract text and dates when you use the newsletter scanning feature. Images are sent for processing and are not used by Anthropic to train their models under our commercial terms.

These providers are only permitted to use your information to provide services to Kora, not for their own purposes.

5. Data Storage and Security

Your data is stored on secure servers operated by our infrastructure providers. We use industry-standard measures, including encrypted connections and access controls, to protect your information. No system is 100% secure, and we can't guarantee absolute security, but we take reasonable steps to protect your data.

6. Data Retention

We retain your information for as long as your account is active. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where we're required to retain it for legal reasons.

7. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data

To exercise these rights, contact us at hello@korafamily.app.

8. Cookies and Local Storage

Kora uses browser local storage to keep you signed in and to make the app work as a Progressive Web App (PWA), including offline access to some features. We do not use third-party advertising cookies.

9. International Data Transfers

Some of our service providers may process or store data outside New Zealand (including the United States). Where this occurs, we take reasonable steps to ensure your information continues to receive an appropriate level of protection.

9a. International Users

Kora is operated from New Zealand and this Privacy Policy is written under New Zealand law. If you access Kora from outside New Zealand, including from the United States, United Kingdom, European Union, or elsewhere, you understand that your information will be processed in accordance with this policy and New Zealand law, in addition to any local laws that may apply to you.

If you are located in the UK or European Union, you may have additional rights under the UK GDPR or EU GDPR, including the right to data portability and the right to request erasure of your data. We will honor reasonable requests made under these rights on the same basis as our Section 7 (Your Rights), regardless of your location.

Kora is not directed at children, and we do not knowingly collect personal information directly from children under 13 (or the relevant age of digital consent in your jurisdiction). As described in Section 1, any information about a child is provided and controlled entirely by their parent or guardian, and children do not create their own accounts or provide their own data to us. If you believe a child has provided us with personal information directly, contact us at hello@korafamily.app and we will take steps to remove it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify users via email or in-app notice. Continued use of Kora after changes take effect means you accept the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or how your information is handled, contact us at:

hello@korafamily.app