DRAFT — pending legal review. Highlighted parts are not decided yet.

Koruya Privacy Policy

Important: Koruya is not an official emergency service. If your life is in danger, call the official emergency line now (your local emergency number).

1. Controller and contact

Koruya is operated by Koruya ([full legal name — to be filled in by counsel; address and registration number]) ("Koruya", "we"). For anything about your personal data: privacy@koruya.app. General support: support@koruya.app.

Representative in the European Union and the United Kingdom: [whether to appoint a GDPR Art. 27 / UK GDPR Art. 27 representative — decision]. Data protection officer: [whether one is required — legal assessment].

2. Without an account

If you use Koruya without an account, your data stays on your device: emergency contacts, medical card, plans, SOS and alert history, your last location. Android backup is turned off, so this data is not copied to Google backups. Sign-in data is encrypted in the system's secure storage. Sensitive local records are also encrypted on the device with AES-256-GCM; the key is kept in the Android Keystore or the iOS Keychain. Encrypted: the emergency and medical profile, the medical card for responders, saved and watched places, household and family plans, pet profiles, personal plans (medication backup, assistance needs, power plan, home inventory, damage journal), the document vault and notes. Deliberately not encrypted: SOS records, emergency contacts, safety circles and the location sharing consent (SOS must work even when the key store cannot be read); the alert history, your last location and the map cache are also kept unencrypted in the app's private storage. Encryption starts on the next start after the key has been safely stored. Each account's on-device data is kept separate: someone using the same device with another account, or without one, does not see yours.

3. Device registration for disaster alerts (no account needed)

So that you can receive disaster alerts without signing in, when you allow notifications your device is registered with our notification server under a random identifier the app creates for this installation. The registration holds:

the random installation identifier and a hash (SHA-256) of the installation key;
the notification token (Firebase Cloud Messaging), platform, app language and version;
your country code (two letters, e.g. TR): taken from the country the app uses (your choice, the mobile network or SIM, or the country worked out on the phone from your location); no coordinates are sent. It is used only to choose which country a Koruya announcement (§7) goes to; counts never show groups of fewer than 20 devices [takes effect with the announcements feature — decision];
your Koruya announcement preferences (service announcements and preparedness reminders, each on or off) and when you changed them;
your hazard type preferences, "critical only" and quiet hours settings and your time zone offset;
only if you turn it on separately, your approximate area of about 5 km (geohash5); it is forgotten if not confirmed again within 30 days and deleted when you withdraw it;
the last-seen time and notification delivery records.

It does not contain your name, e-mail, phone or exact location. Your IP address is not stored; only a salted hash is kept for at most 2 hours to limit abuse. When you turn notifications off the registration is withdrawn (token and area deleted); a registration unused for 60 days is deleted. When you sign in it is linked to your account, and when you sign out it becomes an account-free registration again.

4. With a cloud account

When you sign in, the following is stored with our provider Supabase in [region]:

account: e-mail, password (only Supabase's hash), language;
profile: name, phone, country, profile photo (location data removed), and organisation and role details if you request verification; the times you accepted the terms and the notices;
emergency profile and health information (if you enter them): date of birth, gender, city/district, address hint, second phone, mobility, special needs, emergency note; blood type, allergies, chronic conditions, medication, medical devices, disability, pregnancy, organ donation, doctor's note. We store them in the cloud only with the separate explicit consent you give on the Emergency Profile screen. Without it they stay on your device and the emergency screens keep working. You can withdraw your consent on the same screen at any time; after that nothing more is sent;
your emergency contacts: the name, phone, e-mail and relationship of the people you add. Please let them know;
"I'm safe" check-ins and the names of your offline regions;
family group (if you use it): the group name and members, the status and note you share, your location if you turn on location sharing, an SOS you share with your family and your location at that moment, and the calendar entries and meeting points you share. Group members see these. Invite links work once and expire.

5. Location

We use your location for nearby disaster alerts, weather, nearby critical places, routes and SOS. Location permission is asked with the system's own dialog when a feature first needs it; if you say no, the rest of the app keeps working.

Location in the background is used only during an open SOS: when you start an SOS, a foreground service with an ongoing notification keeps your latest position on the SOS. It stops when the SOS ends, when you tap Stop or when its time limit is reached. The "Allow all the time" permission is asked separately and is optional.
Outside an SOS, the background check for nearby disasters only uses the last location saved on the device; no new position is read.
Koruya's servers do not store your location unless you turn on location sharing in a family group or share an SOS with your family.
To get information, coordinates (mostly rounded to 1–2 decimals) are sent to the data sources in §8. A critical places search never sends your exact position, only the centre of the grid cell it falls in (about 1–5 km). These requests do not include your name or account id.

6. SOS and sharing

The emergency call button opens your phone app with your country's emergency number checked against an official source; you start the call. In a country whose number could not be verified, Koruya never dials a number by itself and opens your phone's dialer empty.

"Share location" and SOS sharing hand a text to the app you pick (SMS, WhatsApp, etc.): your name, the time, your coordinates and a map link. You send the message; Koruya does not send these messages through its own servers and cannot confirm delivery. If you share an SOS with your family group, the SOS record and your location go to the family server; without a connection the device retries once it is back online. A responder handoff packet may include medical information if you choose so.

7. Notifications

Notification permission is asked with the system's dialog; you can refuse it or turn it off later. Disaster alerts are delivered through Google Firebase Cloud Messaging (Android and iOS); Google processes the notification token and the delivered notification for this service. The app's own local alerts are created on the device. Koruya does not send advertising notifications.

Koruya announcements [take effect with the announcements feature — decision]: apart from disaster alerts, the Koruya team may send two kinds of announcement: service announcements (e.g. a delay on the alert server, a security update being needed) and preparedness reminders (e.g. a drill day, seasonal preparedness). They carry the label "Koruya announcement" and come through a separate notification channel; they are not official alerts, never look like one, never come full screen or with an alarm sound, and are held back while an official event is active in your area. You can turn each kind off separately in Settings; doing so does not affect disaster alerts. Service announcements start on; preparedness reminders start off in the European Union / EEA and the United Kingdom until you turn them on, and on elsewhere. Announcements respect your quiet hours and are limited in number [daily and weekly cap — decision]. Targeting uses only language, country code, platform, app version, account status and your hazard type preferences; your exact location is not used. Advertising, sponsor promotion or other companies' products are never sent as notifications. A commercial message (e.g. a Koruya+ / Koruya Pro offer) may be sent only if you separately and expressly agree; none is sent today [commercial electronic message consent and IYS — legal confirmation].

8. Data sources and service providers

Services through which Koruya receives or passes on data about you:

Supabase (database, authentication, file storage, server functions): cloud account, family group, device registration — [region];
Google Firebase Cloud Messaging: notification delivery;
Cloudflare (R2 storage, maps.koruya.app; Cloudflare is a US company, R2 storage location Eastern Europe — eeur [a location hint; data residency commitment — legal review]): offline map, road and emergency places packs and (when this feature is on) air quality and pollen tiles; no coordinates are sent, but the name of an automatically downloaded province pack can show your province, and the name of an air quality or pollen tile your approximate area (a 6-degree square, roughly 670 km across);
Google Firebase Crashlytics (§9; can be turned off in Settings): crash and error reports — Google, USA;
your device's geocoder (Google on Android, Apple on iOS): the city/district name for a coordinate;
e-mail delivery (account confirmation and password reset): [SMTP provider — decision].

Public data sources we read (your account id is never sent to any of them):

rounded coordinates go to: MET Norway (Norwegian Meteorological Institute; forecast and warnings), Open-Meteo when enabled (air quality and floods), USGS and EMSC (earthquakes), the U.S. National Weather Service (NWS) in the United States;
the search text you type goes to: GDELT (news search). Place search runs in the city directory on your phone (GeoNames); the search text is not sent;
the store version sends no request to the OpenStreetMap community servers (the tile server, Overpass, Nominatim, the FOSSGIS and OSRM routing servers): the map, critical places and AEDs come only from downloaded packs. Only developer / test builds send these servers the map area shown, a grid cell, start and destination and the search text (the Overpass fallback maps.mail.ru is in Russia);
no location goes to: GDACS, NASA EONET, NASA FIRMS, the NOAA tsunami warning centres, the USGS Volcano Hazards Program, GeoNet (New Zealand), the USGS, NOAA and NASA news feeds.

Each of these sources has its own privacy terms. Their licences and credits are listed in the app under Settings → Data sources and licences.

9. Crash reports

If the app crashes or an error occurs, a report may go to Google Firebase Crashlytics (Google, USA) so that we can find and fix the bug. A report contains the type of the error and its cleaned text (e-mail addresses, phone numbers, coordinates, address queries, identity numbers and keys are removed), the line of the app's code where it happened, your device model, OS, app version, memory and storage state. Your name, account, location, contacts, health information, alert and SOS content, screenshots and the screens you opened are never sent. Crashlytics adds a random installation id that is not linked to your account. You can turn this off at any time in Settings → Privacy → Crash Reports: collection stops and the reports waiting on your phone are deleted. In the European Union / European Economic Area and the United Kingdom, and while your country is not known, it stays off until you turn it on; in other countries it starts on [KVKK Art. 9 transfer and on-by-default — legal review].

10. Purposes and legal bases

We process your data for these purposes and on these bases [every line pending legal review]:

providing the account and the features you ask for — performance of a contract (GDPR Art. 6(1)(b), KVKK Art. 5/2-c);
emergency features (SOS, emergency contacts, responder packet) — vital interests (GDPR Art. 6(1)(d), KVKK Art. 5/2-b) and contract;
storing health information in the cloud — explicit consent (GDPR Art. 9(2)(a), KVKK Art. 6);
the notification area — consent (GDPR Art. 6(1)(a)) [KVKK basis — decision];
Koruya announcements and the country code — performance of the contract for service announcements, legitimate interest for preparedness reminders; consent for preparedness reminders in the EU / EEA and the United Kingdom (GDPR Art. 6(1)(a)); both can always be turned off [KVKK basis and scope of Law No. 6563 — legal confirmation];
crash reports — consent in the EU / EEA and the United Kingdom (GDPR Art. 6(1)(a)), elsewhere legitimate interest in a reliable app, always possible to turn off [KVKK basis — decision];
security, abuse prevention and debugging — legitimate interests (GDPR Art. 6(1)(f), KVKK Art. 5/2-f);
legal obligations (GDPR Art. 6(1)(c), KVKK Art. 5/2-ç).

We do not use your data for automated decision-making or profiling; we do not sell it, do not use it for advertising and do not share it with third parties for advertising.

11. International transfers

Supabase, Google (Firebase Cloud Messaging and Crashlytics, USA), Cloudflare and the data sources in §8 may be outside your country (for example the EU, the United Kingdom, the United States, Norway; in test builds only, the Overpass fallback in Russia). Transfer safeguards: [GDPR Art. 46 standard contractual clauses or adequacy decisions; KVKK Art. 9 standard contract notified to the Board or explicit consent; the providers' data processing agreements — decision].

12. Retention

Cloud account and profile: until you delete your account [warning and deletion after 24 months without sign-in — decision].
Health information: deleted when you withdraw consent or delete your account [deadline for deleting the cloud copy after withdrawal — decision].
Family SOS records: 30 days after the SOS ends; shared location immediately when the permission is turned off.
Family status updates: 30 days. Used or expired invites: 30 days. Membership records: 180 days.
Account-free device registration: after 60 days without use; the area cell if not confirmed again within 30 days; delivery records after 30 days.
Country code and announcement preferences: deleted with the device registration; delivery and open records of Koruya announcements after 30 days [decision].
Server and security logs: [period — decision].
Crash reports: 90 days in Firebase Crashlytics, then deleted by Google; reports waiting on your phone, at once when you turn crash reports off.
Support and deletion request correspondence: [1 year — decision] after the request is completed.
Data on your device: deleted when you uninstall the app or choose so on the account deletion screen.

13. Your rights

Depending on where you live, you can access, correct and delete your data, restrict or object to its processing, receive it in a portable format and withdraw consent at any time. Withdrawing consent does not affect processing before it. Requests: privacy@koruya.app. We answer within [30 days — KVKK at most 30 days]; we may ask you to write from your account's e-mail to confirm it is you.

Additional information for your region:

Türkiye (KVKK): the rights in KVKK Art. 11. Details are in the KVKK Information Notice. If you are not satisfied with our answer you can complain to the Personal Data Protection Board.
European Union and EEA (GDPR): the rights in Arts. 15–22; you can complain to the data protection authority of your country.
United Kingdom (UK GDPR): the same rights; you can complain to the Information Commissioner's Office (ICO).
United States — California (CCPA/CPRA) and similar state laws: the rights to know, delete, correct and limit the use of sensitive personal information. Koruya does not sell your personal information and does not share it for cross-context behavioural advertising; we will not treat you differently for using these rights. You may also use an authorised agent.
Brazil (LGPD): the rights in Art. 18; you can petition the ANPD.
Canada (PIPEDA and provincial laws): the rights of access and correction; you can complain to the Office of the Privacy Commissioner of Canada (OPC).
Japan (APPI): the rights to request disclosure, correction, suspension of use and information about records of provision to third parties.
Singapore (PDPA): the rights of access and correction; you can withdraw consent.

14. Deleting your account

Delete your account in the app under Profile → Account → Delete account. If you cannot use the app, follow the steps at https://koruya.app/delete-account or write from your account's e-mail to privacy@koruya.app. Deleting your account deletes your profile, emergency and health profiles, contacts, check-ins and photo, and your family-group membership, statuses, SOS records and the calendar entries and meeting points you shared. A group you created stays for its other members, without a creator. Data on your device is deleted by the choice on the account deletion screen or when you uninstall the app.

15. Security

HTTPS, row-level access rules, a private photo store, Android backup turned off, sensitive local records encrypted on the device (§2). No system is perfectly secure; if a breach happens we will inform you and the competent authority within the period the law sets. If you found a security vulnerability: security@koruya.app.

16. Children

To open an account you must be at least the age shown on the sign-up screen for your country (for example 13–16 in the EU depending on the country, 13 in the United States and the United Kingdom) [age table — legal review]. Below that age a parent or guardian must agree. We do not knowingly collect data from children below that age without a parent's consent; if we learn of it we delete it. Using Koruya without an account keeps the data on the device and is open to everyone.

17. Changes

We will tell you in the app about important changes, and ask for consent again where consent is required. Effective date: [date].