Koruya
Search
Get the app

Trust & privacy

You have the right to know what you entrust to Koruya. Here we write only what is true today, and we say plainly what is not there yet.

Your personal data is never sold

We do not sell or rent your data, and we do not use it for advertising.

Works without an account

Without an account, your information stays on your phone only.

Location only when needed

Location permission is asked the first time a feature needs it; in the background it is used only when you start an SOS.

Sensitive details encrypted

Sensitive records such as your medical card and plans are encrypted on your phone.

Privacy and data protection

Our privacy policy explains in detail which data we process and why. The texts are drafts for now: they will be published with an effective date once legal review is complete.

All of Koruya's legal texts are published from one source, in the same version as in the app. All of them are pending legal review.

For any request about your personal data: privacy@koruya.app

Service providers

The services we use to run Koruya, and what for:

  • Supabase: Account, profile, health profile with consent and the family group (database and authentication); European Union, eu-west-1.
  • Cloudflare: This site, the web app, the admin panel access control, delivery of content and offline map packs, e-mail routing.
  • Resend: Sending account confirmation and password reset e-mails.
  • Google: Sign in with Google (if you choose it) and Google Play. Server notifications (Firebase Cloud Messaging) and crash reports (Crashlytics) are not in today's store version; if they are switched on, the privacy policy is updated first.

Full list, data sent and countries: the Service providers and international transfers page.

Security

  • Every connection is encrypted with HTTPS.
  • Row-level access rules on the server: everyone can reach only their own data.
  • Sensitive records are encrypted on the phone with AES-256-GCM; the key stays in the phone's secure storage.
  • The admin panel requires two-step verification and logs every action.

Found a security issue? Write to us: account@koruya.app · Report a vulnerability · security.txt

Certifications

Today we hold no independent security certification (such as ISO 27001 or SOC 2). When we do, it will be listed here with its date.

Accessibility

Our goal is WCAG 2.2 AA. This site has not been independently audited yet. Known gap: site translations and fonts for Arabic, Hindi and Chinese are not ready yet.

If you run into a barrier, tell us: support@koruya.app

This site

This site uses no cookies and does not track your visit. Your appearance (light / dark) and language-suggestion choices are stored only in your browser and never sent to us.

Service status

The status of our services has its own page. When a service's status is unknown, it says “unknown” — never “operational”. status.koruya.app