Trust & privacy
You have the right to know what you entrust to Koruya. Here we write only what is true today, and we say plainly what is not there yet.
Our principles
Your personal data is never sold
We do not sell or rent your data, and we do not use it for advertising.
Works without an account
Without an account, your information stays on your phone only.
Location only when needed
Location permission is asked the first time a feature needs it; in the background it is used only when you start an SOS.
Sensitive details encrypted
Sensitive records such as your medical card and plans are encrypted on your phone.
Privacy and data protection
Our privacy policy explains in detail which data we process and why. The texts are drafts for now: they will be published with an effective date once legal review is complete.
For any request about your personal data: privacy@koruya.app
Service providers
The services we use to run Koruya, and what for:
- Supabase: Accounts, family groups and device registration for notifications (database and authentication).
- Google Firebase Cloud Messaging: Delivering notifications to your phone.
- Google Firebase Crashlytics: Crash and error reports. Can be turned off in the app's settings.
- Cloudflare: Distributing offline map packs, and this website.
Server regions will be listed here and in the privacy policy once verified; we do not publish a region we have not verified.
Security
- Every connection is encrypted with HTTPS.
- Row-level access rules on the server: everyone can reach only their own data.
- Sensitive records are encrypted on the phone with AES-256-GCM; the key stays in the phone's secure storage.
- The admin panel requires two-step verification and logs every action.
Found a security issue? Write to us: security@koruya.app
Certifications
Today we hold no independent security certification (such as ISO 27001 or SOC 2). When we do, it will be listed here with its date.
Accessibility
Our goal is WCAG 2.2 AA. This site has not been independently audited yet. Known gap: site translations and fonts for Arabic, Hindi and Chinese are not ready yet.
If you run into a barrier, tell us: support@koruya.app
This site
This site uses no cookies and does not track your visit. Your appearance (light / dark) and language-suggestion choices are stored only in your browser and never sent to us.
Service status
The status of our services has its own page. When a service's status is unknown, it says “unknown” — never “operational”. status.koruya.app