PENDING LEGAL REVIEW — this text has not been approved by a lawyer. Highlighted parts are not decided yet.
Cookies and Similar Technologies Policy
Koruya's site (koruya.app), web app (app.koruya.app) and status page (status.koruya.app) set no cookies and use no analytics, advertising or tracking tools. Your browser keeps only the first-party storage listed below, which the service needs to work. That is why no cookie banner is shown [assessment that no banner is needed — legal confirmation].
1. In short
- Cookies: Koruya's own code writes no cookie anywhere and our servers send no Set-Cookie header.
- Similar technologies: browser storage (localStorage, sessionStorage, IndexedDB). It is used only to keep your choices and the records you enter in the web app on your device; none of it is for advertising or profiling and Koruya does not read it to send it anywhere.
- No third-party scripts: Google Analytics, Cloudflare Web Analytics, the Facebook pixel, Hotjar, Sentry and the like are not loaded. Fonts come from Koruya's own server.
2. koruya.app (site)
- koruya.theme (localStorage): the light / dark appearance you chose. Not personal data. Removed when you choose "system".
- koruya.siteLang (localStorage): the site language you chose. Not personal data.
- koruya.langBand (localStorage): that you closed the language suggestion bar. Not personal data.
The site's forms keep nothing in the browser; the status page (status.koruya.app) uses no storage at all.
3. app.koruya.app (web app)
Strictly necessary (the service itself):
- sb-‹project›-auth-token (sessionStorage by default; localStorage if "remember me" is ticked): your Supabase session — access and refresh token and your account details (including e-mail). Removed when the tab closes or, with "remember me", when you sign out.
- sb-‹project›-auth-token-code-verifier (localStorage): a one-time security value (PKCE) for e-mail links and Sign in with Google. Removed when the flow ends.
- koruya.pendingConsents (localStorage): the agreements you gave at sign-up with your e-mail, name and country, waiting to be written to your profile at first sign-in. Removed once the profile is complete; not used if older than 14 days, and removed when it is next read.
- koruya.pendingInvite (sessionStorage): the token of a family invite you opened. Removed when used or when the tab closes.
- koruya.authNext (sessionStorage): the web app page to return to after Sign in with Google. Removed on the sign-in return or when the tab closes.
- IndexedDB "koruya-web" (records and meta): the emergency contacts, health information, document vault, damage and plan records, go-bag list, alert preferences and publishing follows you enter in the web app. Health and vault records are encrypted with a non-exportable AES-256-GCM key, which is kept here too. Kept until you use "delete the data in this browser" or clear the browser's data; never sent to the cloud.
- koruya.consents.v1 (localStorage): the record of which legal text you accepted or withdrew, with document id, version, language, time and purpose. Used to know whether a new major version needs your agreement again.
Functional (your choices):
- koruya.auth.remember: the "remember me" choice; removed when you sign out.
- koruya.country, koruya.lang, koruya.theme, koruya.textScale, koruya.side: country, language, appearance, text size, sidebar.
- koruya.ref: the reference point you chose on the map (latitude, longitude, time) — this is location data; kept until you remove it.
- koruya.recent: what you used last in the command palette.
- koruya.inbox.read, koruya.content.help.feedback, koruya.content.notes.show, koruya.yayin.il, koruya.learn.settings, koruya.learn.summary: read marks, your help feedback, note visibility, the province you chose, lesson settings and summary. The older koruya.learn.v1 is removed once moved to the new format.
- koruya.content.news.v1: a cache of NASA EONET news (not personal data).
The web app tells its other tabs that data changed through a BroadcastChannel; this is not storage.
4. Admin panel (Koruya team only)
admin.koruya.app is protected by Cloudflare Access; Cloudflare sets its own strictly necessary cookie for the signed-in team member's session (e.g. CF_Authorization) [cookie name and lifetime to be confirmed in the Cloudflare dashboard]. The panel's Supabase session is kept only in memory and ends when the page reloads. The panel may connect to Google's font server (Google Fonts) for missing font characters and keeps the app files in the browser cache (service worker).
5. Other services we connect to
- For map tiles the web app connects only to Koruya's maps.koruya.app server, and for alerts to USGS, EMSC, GDACS, MET Norway and NASA EONET, without sending cookies; these services see your IP address.
- If you choose Sign in with Google, you are redirected to Google's and Supabase's own pages during sign-in; those pages may set their own cookies under their own policies.
- Cloudflare may in some cases set its own strictly necessary cookie for network security (e.g. bot protection) [Cloudflare zone setting to be confirmed in the dashboard].
6. You are in control
You can delete site data at any time in your browser's settings. In the web app, Settings → "delete the data in this browser" deletes the local records; signing out ends the session. Blocking storage stops the web app's sign-in and local records from working. Questions: privacy@koruya.app.