Koruya
Search
Get the app

PENDING LEGAL REVIEW — this text has not been approved by a lawyer. Highlighted parts are not decided yet.

Koruya Privacy Policy

Document KRY-PRIVACY · version 2.0.0 · effective 2026-11-15 · Status: PENDING LEGAL REVIEW

Important: Koruya is not a public authority or an official emergency service; it does not replace official warnings or emergency services. If your life is in danger, call the official emergency line now (your local emergency number).

1. Controller and contact

The data controller operating Koruya: operator details (legal name, address, registration number) will be published soon ("Koruya", "we"). For anything about your personal data: privacy@koruya.app. General support: support@koruya.app. How to make a request and the time limits are set out on the Contact and Requests page.

Representative in the European Union: not decided yet; will be published soon. Representative in the United Kingdom: not decided yet; will be published soon. Data protection officer: not decided yet; will be published soon. VERBİS (Turkish data controller registry): VERBİS registration status will be published soon.

Read this policy together with: the KVKK Information Notice, the Health Data Notice, the Location and Disaster Communication Notice, the Cookies and Similar Technologies Policy, Service Providers and International Transfers, the Emergency Safety Notice and Account and Data Deletion. All of them are in the app under Settings → Legal and privacy and on koruya.app's legal pages (https://koruya.app/en/privacy/).

2. Without an account

If you use Koruya without an account, your data stays on your device: emergency contacts, medical card, plans, SOS and alert history, your last location. Android backup is turned off, so this data is not copied to Google backups. Sign-in data is encrypted in the system's secure storage. Sensitive local records are also encrypted on the device with AES-256-GCM; the key is kept in the Android Keystore or the iOS Keychain. Encrypted: the emergency and medical profile, the medical card for responders, saved and watched places, household and family plans, pet profiles, personal plans (medication backup, assistance needs, power plan, home inventory, damage journal), the document vault and notes. Deliberately not encrypted: SOS records, emergency contacts, safety circles and the location sharing consent (SOS must work even when the key store cannot be read); the alert history, your last location and the map cache are also kept unencrypted in the app's private storage. Encryption starts on the next start after the key has been safely stored; during the switch the old plain copy is kept until two successful starts. Each account's on-device data is kept separate: someone using the same device with another account, or without one, does not see yours.

Web app (app.koruya.app): the health, emergency contact, document vault, damage, plan and go-bag records you enter in the web app are kept only in this browser (IndexedDB); today they are not synced to the cloud. Health and vault records are encrypted in the browser with a non-exportable AES-256-GCM key. They are deleted when you clear the browser's data or use "delete the data in this browser" in Settings. Every key the browser keeps is listed in the Cookies and Similar Technologies Policy.

3. Device registration for disaster alerts (server notifications)

This section does not apply to today's store version: alerts are created on the phone by checking public data sources regularly and shown as local notifications; your device is not registered with any notification server and Firebase is not started. The registration below takes effect when server notifications (push) are switched on; you will be told in the app before that happens [decision and date for switching push on — owner].

When push is on and you allow notifications, your device is registered with our notification server under a random identifier the app creates for this installation. The registration holds:

  • the random installation identifier and a hash (SHA-256) of the installation key;
  • the notification token (Firebase Cloud Messaging), platform, app language and version;
  • your country code (two letters, e.g. TR): taken from the country the app uses (your choice, the mobile network or SIM, or the country worked out on the phone from your location); no coordinates are sent. It is used only to choose which country a Koruya announcement (§7) goes to; counts never show groups of fewer than 20 devices [takes effect with the announcements feature — decision];
  • your Koruya announcement preferences (service announcements and preparedness reminders, each on or off) and when you changed them;
  • your hazard type preferences, "critical only" and quiet hours settings and your time zone offset;
  • only if you turn it on separately, your approximate area of about 5 km (geohash5); it is forgotten if not confirmed again within 30 days and deleted when you withdraw it;
  • the last-seen time and notification delivery records.

It does not contain your name, e-mail, phone or exact location. Your IP address is not stored; only a salted hash is kept for at most 2 hours to limit abuse. When you turn notifications off the registration is withdrawn (token and area deleted). A device linked to an account and unused for 90 days is revoked (token and area deleted) and the row is deleted 30 days later; an account-free registration unused for 60 days is deleted [the account-free rule takes effect with push]. When you sign in it is linked to your account, and when you sign out it becomes an account-free registration again.

4. With a cloud account

When you sign in, the following is stored with our provider Supabase; our project runs in the European Union (AWS eu-west-1, Ireland) according to the provider's project settings [region] (contractual data location commitment pending legal review):

  • account: e-mail, password (only Supabase's hash), language; if you sign in with Google, the e-mail, name and account id Google provides;
  • profile: name, phone, country, profile and cover photo (location data removed), and organisation and role details if you request verification; the times you accepted the terms and the notices;
  • emergency profile and health information (if you enter them): date of birth, gender, city/district, address hint, second phone, mobility, special needs, emergency note; blood type, allergies, chronic conditions, medication, medical devices, disability, pregnancy, organ donation, doctor's note. We store them in the cloud only with the separate explicit consent you give on the Emergency Profile screen; the server also refuses to write them without a consent record. Without it they stay on your device and the emergency screens keep working. You can withdraw your consent on the same screen at any time; the cloud copy is then deleted and nothing more is sent. Details: Health Data Notice;
  • your emergency contacts: the name, phone, e-mail and relationship of the people you add. They are third parties; it is your responsibility to let them know;
  • "I'm safe" check-ins (status, note and, only if you turn on "add location", your coordinates at that moment) and the names of your offline regions;
  • family group (if you use it): the group name and members, the status and note you share, your location if you turn on location sharing, an SOS you share with your family and your location at that moment, and the calendar entries and meeting points you share. Group members see these. Invite links work once and expire;
  • account audit records for security (e.g. a change of sign-in method, a deletion request).

Account confirmation and password reset e-mails are sent through Resend from Koruya's own account address on the koruya.app domain; Resend processes the recipient address and the e-mail's content (the confirmation link).

Publishing and administration: the name, short biography and links of Koruya team members who write posts are published on their author page on koruya.app; actions in the admin panel are written to an audit log. This data concerns team members only [legal basis for author data and what happens when someone leaves the team — legal].

Closed beta application form: the beta application form on koruya.app was closed on 2026-11-15; no new applications are accepted (the server answers 410). If you applied earlier, the e-mail and application details you gave are kept in a separate table, not linked to an account. You can ask for them to be deleted at privacy@koruya.app [retention and deletion of earlier applications — owner decision].

5. Location

We use your location for nearby disaster alerts, weather, nearby critical places and SOS. Location permission is asked with the system's own dialog, after a short explanation in the app, when a feature first needs it; if you say no, the rest of the app keeps working. Details: Location and Disaster Communication Notice.

  • During an SOS: when you start an SOS, a foreground service with an ongoing notification tries to keep your latest position on the SOS. It stops when the SOS ends, when you tap Stop or when its time limit is reached. The store version does not ask for the "Allow all the time" (background) location permission; the service runs with "while using the app" and location updates may stop if Android fully closes the app.
  • Outside an SOS, the background check for nearby disasters only uses the last location saved on the device; no new position is read.
  • Koruya's servers store your location only if you turn on location sharing in a family group, share an SOS with your family, or add your location to an "I'm safe" check-in with "add location".
  • To get information, coordinates (mostly rounded to 1–2 decimals) are sent to the data sources in §8. These requests do not include your name or account id; the source sees the IP address the request comes from.

6. SOS and sharing

The emergency call button opens your phone app with your country's emergency number checked against an official source; you start the call. In a country whose number could not be verified, Koruya never dials a number by itself and opens your phone's dialer empty.

"Share location" and SOS sharing hand a text to the app you pick (SMS, WhatsApp, etc.): your name, the time, your coordinates and a map link. You send the message; Koruya does not send these messages through its own servers and cannot confirm delivery. If you share an SOS with your family group, the SOS record and your location go to the family server; without a connection the device retries once it is back online. A responder handoff packet may include medical information if you choose so.

7. Notifications

Notification permission is asked with the system's dialog; you can refuse it or turn it off later. In the store version notifications are created on the device (local notifications). When server notifications (push) are switched on, disaster alerts are delivered through Google Firebase Cloud Messaging (Android and iOS); Google processes the notification token and the delivered notification for this service. Koruya does not send advertising notifications.

Koruya announcements [take effect with the announcements feature — decision]: apart from disaster alerts, the Koruya team may send two kinds of announcement: service announcements (e.g. a delay on the alert server, a security update being needed) and preparedness reminders (e.g. a drill day, seasonal preparedness). They carry the label "Koruya announcement" and come through a separate notification channel; they are not official alerts, never look like one, never come full screen or with an alarm sound, and are held back while an official event is active in your area. You can turn each kind off separately in Settings; doing so does not affect disaster alerts. Service announcements start on; preparedness reminders start off in the European Union / EEA and the United Kingdom until you turn them on, and on elsewhere. Announcements respect your quiet hours and are limited in number [daily and weekly cap — decision]. Targeting uses only language, country code, platform, app version, account status and your hazard type preferences; your exact location is not used. Advertising, sponsor promotion or other companies' products are never sent as notifications. A commercial message (e.g. a Koruya+ / Koruya Pro offer) may be sent only if you separately and expressly agree; none is sent today [commercial electronic message consent and IYS — legal confirmation].

8. Data sources and service providers

Services through which Koruya receives or passes on data about you (full list and countries: Service Providers and International Transfers):

  • Supabase (database, authentication, file storage, server functions): cloud account, family group, account deletion — EU (eu-west-1) [legal confirmation];
  • Cloudflare (a US company): the koruya.app site, the app.koruya.app web app, the admin panel and its access control (Cloudflare Access), content and map delivery (R2 storage location Eastern Europe — eeur [a location hint; data residency commitment — legal review]), e-mail routing. Offline map, road and emergency places packs carry no coordinates, but the name of an automatically downloaded province pack can show your province. Your IP address reaches Cloudflare with every request;
  • Resend: sending account confirmation and password reset e-mails [chosen region — to be confirmed by the owner];
  • Google: Sign in with Google (if you choose it); Firebase Cloud Messaging once push is switched on; Firebase Crashlytics in a version that includes crash reports and only while it is on (§9); on Android, the address service that turns a coordinate into a city/district name; distribution through Google Play;
  • Apple: once the iOS version is published, Sign in with Apple, the App Store and the iOS address service [no iOS version yet].

Public data sources we read (your account id is never sent to any of them; they see your IP address):

  • rounded coordinates go to: MET Norway (Norwegian Meteorological Institute; forecast and warnings), USGS and EMSC (earthquakes), the U.S. National Weather Service (NWS) in the United States; Open-Meteo (air quality and floods) only in a build allowed to use it;
  • the search text you type goes to: GDELT (news search). Place search runs in the city directory on your phone (GeoNames); the search text is not sent;
  • the store version sends no request to the OpenStreetMap community servers (the tile server, Overpass, Nominatim, the FOSSGIS and OSRM routing servers): the map and critical places come only from downloaded packs. Only developer / test builds send these servers the map area shown, a grid cell, start and destination and the search text (the Overpass fallback maps.mail.ru is in Russia);
  • no location goes to: GDACS, NASA EONET, the NOAA tsunami warning centres, the USGS Volcano Hazards Program, GeoNet (New Zealand), the USGS, NOAA and NASA news feeds. NASA FIRMS fire data is queried through our own server for a fixed area; your location is not sent.

Each of these sources has its own privacy terms. Their licences and credits are listed in the app under Settings → Data sources and licences and on the Copyright, Licences and Attributions page.

9. Crash reports

Today's store version contains no crash reporting (Crashlytics). In a version that includes it, if the app crashes or an error occurs, a report may go to Google Firebase Crashlytics (Google, USA) so that we can find and fix the bug. A report contains the type of the error and its cleaned text (e-mail addresses, phone numbers, coordinates, address queries, identity numbers and keys are removed), the line of the app's code where it happened, your device model, OS, app version, memory and storage state. Your name, account, location, contacts, health information, alert and SOS content, screenshots and the screens you opened are never sent. Crashlytics adds a random installation id that is not linked to your account. You can turn this off at any time in Settings → Privacy → Crash Reports: collection stops and the reports waiting on your phone are deleted. In the European Union / European Economic Area and the United Kingdom, and while your country is not known, it stays off until you turn it on; in other countries it starts on [KVKK Art. 9 transfer and on-by-default in Türkiye — legal review].

Koruya contains no analytics, advertising or tracking software; the app, the web app and the site send no usage statistics.

10. Purposes and legal bases

We process your data for these purposes and on these bases [every line pending legal review]:

  • providing the account and the features you ask for — performance of a contract (GDPR Art. 6(1)(b), KVKK Art. 5/2-c);
  • emergency features (SOS, emergency contacts, responder packet) — vital interests (GDPR Art. 6(1)(d), KVKK Art. 5/2-b) and contract;
  • storing health information in the cloud — explicit consent (GDPR Art. 9(2)(a), KVKK Art. 6);
  • the notification area — consent (GDPR Art. 6(1)(a)) [KVKK basis — decision];
  • Koruya announcements and the country code — performance of the contract for service announcements, legitimate interest for preparedness reminders; consent for preparedness reminders in the EU / EEA and the United Kingdom (GDPR Art. 6(1)(a)); both can always be turned off [KVKK basis and scope of Law No. 6563 — legal confirmation];
  • crash reports — consent in the EU / EEA and the United Kingdom (GDPR Art. 6(1)(a)), elsewhere legitimate interest in a reliable app, always possible to turn off [KVKK basis — decision];
  • third-party data such as emergency contacts and family members — performance of the contract and vital interests [legal confirmation];
  • security, abuse prevention, debugging and account audit records — legitimate interests (GDPR Art. 6(1)(f), KVKK Art. 5/2-f);
  • legal obligations (GDPR Art. 6(1)(c), KVKK Art. 5/2-ç).

We do not use your data for automated decision-making or profiling; we do not sell it, do not use it for advertising and do not share it with third parties for advertising.

11. International transfers

Supabase (EU), Cloudflare (a US company), Resend, Google (USA), Apple (USA) and the data sources in §8 may be outside your country (for example the EU, the United Kingdom, the United States, Norway; in test builds only, the Overpass fallback in Russia). Countries and details are on the Service Providers and International Transfers page. Transfer safeguards: [GDPR Art. 46 standard contractual clauses or adequacy decisions; KVKK Art. 9 standard contract notified to the Board or explicit consent; the providers' data processing agreements — decision].

12. Retention

  • Cloud account and profile: until you delete your account [warning and deletion period for inactive accounts — decision].
  • Health information: deleted when you withdraw consent or delete your account; the record of giving and withdrawing consent is deleted with the account [keeping a minimal record as proof of consent — legal decision].
  • Family SOS records: 30 days after the SOS ends; shared location immediately when the permission is turned off.
  • Family status updates: 30 days. Used or expired invites: 30 days. Membership records: 180 days. Meeting points and calendar entries: until you or the group delete them.
  • "I'm safe" check-ins (including the location if you added it), emergency contacts and role verification requests: until you delete your account [automatic deletion period — decision].
  • Device registration once server notifications are on: the periods in §3; the area cell if not confirmed again within 30 days; delivery records after 30 days.
  • Country code and announcement preferences: deleted with the device registration; delivery and open records of Koruya announcements after 30 days [decision].
  • Server, Cloudflare and security logs: the providers' platform periods [period — to be confirmed by the owner].
  • Crash reports (only in a version with this feature): 90 days in Firebase Crashlytics, then deleted by Google; reports waiting on your phone, at once when you turn crash reports off.
  • Support and deletion request correspondence: [1 year — decision] after the request is completed.
  • Publishing revision history: 2 years.
  • Closed beta applications: [period — owner decision].
  • Data on your device and in your browser: deleted when you uninstall the app or clear the browser's data, or choose so on the account deletion screen.

13. Your rights

Depending on where you live, you can access, correct and delete your data, restrict or object to its processing, receive it in a portable format and withdraw consent at any time. Withdrawing consent does not affect processing before it. Requests: privacy@koruya.app. We answer within [30 days — KVKK at most 30 days]; we may ask you to write from your account's e-mail to confirm it is you. How to apply and what follows: the Contact and Requests page.

Additional information for your region:

  • Türkiye (KVKK): the rights in KVKK Art. 11. Details are in the KVKK Information Notice. If you are not satisfied with our answer you can complain to the Personal Data Protection Board.
  • European Union and EEA (GDPR): the rights in Arts. 15–22; you can complain to the data protection authority of your country.
  • United Kingdom (UK GDPR): the same rights; you can complain to the Information Commissioner's Office (ICO).
  • United States — California (CCPA/CPRA) and similar state laws: the rights to know, delete, correct and limit the use of sensitive personal information. Koruya does not sell your personal information and does not share it for cross-context behavioural advertising; we will not treat you differently for using these rights. You may also use an authorised agent.
  • Brazil (LGPD): the rights in Art. 18; you can petition the ANPD.
  • Canada (PIPEDA and provincial laws): the rights of access and correction; you can complain to the Office of the Privacy Commissioner of Canada (OPC).
  • Japan (APPI): the rights to request disclosure, correction, suspension of use and information about records of provision to third parties.
  • Singapore (PDPA): the rights of access and correction; you can withdraw consent.

14. Deleting your account

Delete your account in the app under Profile → Account → Delete account. If you cannot use the app, follow the steps at https://koruya.app/en/delete-account/ or write from your account's e-mail to privacy@koruya.app. Account deletion is switched off in the web app today; use the mobile app or the e-mail route. Deleting your account deletes your profile, emergency and health profiles, contacts, check-ins and photos, and your family-group membership, statuses, SOS records and the calendar entries and meeting points you shared. A group you created stays for its other members, without a creator. Data on your device is deleted by the choice on the account deletion screen or when you uninstall the app. Details and what is not deleted: Account and Data Deletion.

15. Security

HTTPS, row-level access rules, a private photo store, Android backup turned off, sensitive local records encrypted on the device (§2), the admin panel protected by Cloudflare Access and an administrator list. No system is perfectly secure; if a breach happens we will inform you and the competent authority within the period the law sets. If you found a security vulnerability: account@koruya.app (Reporting a Security Vulnerability page).

16. Children

To open an account you must be at least the age shown on the sign-up screen for your country (for example 13–16 in the EU depending on the country, 13 in the United States and the United Kingdom) [age table — legal review]. Below that age a parent or guardian must agree. We do not knowingly collect data from children below that age without a parent's consent; if we learn of it we delete it. Using Koruya without an account keeps the data on the device and is open to everyone.

17. Changes and versions

Every document shows its document id, version and effective date at the top. We will tell you in the app about important changes (a new major version), and ask you to agree again where consent is required and for the terms of use; your agreements are recorded on your device with the document id, version, language and time. Effective date: [date — after legal approval].