Kora — Privacy Policy
Last updated: 13 August 2026 · Version 1.0
Kora helps small business owners understand their money. This page explains exactly what the app stores, what it sends elsewhere, who else can see it, and what it never touches. It is written to be understood, not to protect anyone legally.
1. The short version
What Kora does not do
- No advertising. There are no ads in Kora and no advertising networks inside it.
- Nothing is sold. Your information is never sold, rented, or shared with anyone for marketing.
- No tracking. There is no analytics code, no behaviour tracking and no crash reporting in the app. Nothing reports what you do back to anybody.
- No email or phone number needed. An account is a username and a password. Nothing else.
- No access to your phone. Kora cannot read your contacts, photos, camera, files, messages or location.
- It works offline. The app is fully usable with no internet at all.
What Kora does hold
The business records you type in: sales, expenses, products and prices, stock, and credit given to customers — including any customer names and phone numbers you enter. All of it stays on your phone unless you choose to create an account, in which case a copy is also kept on a server so you can get it back if your phone is lost.
2. Using Kora without an account
You can use every part of Kora without signing up — recording sales, tracking expenses, the calculators, and all of the lessons.
If you never create an account, everything you enter stays on your phone. It is not sent anywhere. Nobody else can see it. There is no copy on any server.
What is stored on the phone:
| What | Details |
|---|---|
| Business details | Name and type of your business |
| Sales | Amount, date, what was sold, how it was paid for |
| Expenses | Amount, date, category, your notes |
| Products | Name, cost price, selling price, stock count |
| Credit (udhaar) | Customer name, phone number, amount owed, whether it has been paid |
| Goals | Targets you set for yourself |
| Learning | Which lessons you have opened or finished |
| Settings | Your language, and whether the Mentor is on |
The Android setting that copies app data to Google Drive automatically has been switched off in Kora, specifically so that your customers' names and debts are not backed up to Google without you asking.
3. If you create an account
An account exists for one reason: so your records come back if your phone is lost, stolen, broken or replaced.
What creating one requires
- A username you choose
- A password you choose
- A recovery code the app generates for you
No email address. No phone number. No real name. Nothing that identifies you personally is asked for, and nothing is verified.
What is then copied to the server
All of the records in the table above, so they can be restored. That includes the customer names and phone numbers you have entered against credit records.
The recovery code
Kora stores only a scrambled, one-way version of your recovery code — never the code itself. This means nobody can read it back, including the developer. If you lose both your password and your recovery code, your account cannot be recovered by anyone. That is why the app tells you to write the code down.
4. Information about other people
When you record credit, you may type in another person's name and phone number. That person has not installed Kora and has not agreed to anything. It is worth being clear about what that means.
- Those details are treated exactly like the rest of your records: kept on your phone, and copied to the server only if you have an account.
- They are never sent to the AI Mentor.
- They are never used for anything except showing you your own records.
- They are never used to contact that person. Kora does not send messages. When you tap to remind a customer, your own WhatsApp opens with a message you can read and edit before sending — Kora sends nothing on your behalf.
You remain responsible for the information you enter about other people. If someone asks you to remove their details, you can delete that record in the app and the deletion is carried through to the server on the next sync. If you need help with this, write to the address in section 15.
You can also simply not enter it. A first name alone, or no name at all, is enough for Kora to work.
5. The AI Mentor
The Mentor answers questions about your business. It is optional and switched off with one tap in Settings, and the rest of Kora works exactly the same without it.
When you ask a question, it travels through Kora's own server to Google's Gemini AI. Kora's server holds the key that allows this, so the key is never inside the app on your phone.
What is sent
- Your business name and type
- Totals — sales, cost of goods, expenses, profit, margin, and the total amount of credit outstanding
- The same totals for the last 30 days, split into fixed and variable costs
- Your product names, with their cost and selling prices
- The question you typed, and the earlier messages in that conversation
What is never sent
Customer names and phone numbers are never included. Only the total amount owed to you is sent, never who owes it.
Because your question is sent exactly as you typed it, please do not type a customer's name or number into a question. The app warns you about this in Settings for the same reason.
What Kora's server keeps
Only the time of each request and which account made it, so that the number of questions per hour can be limited. The content of your questions and the answers is not stored on Kora's server.
What Google does with the request is governed by their own terms, linked in the next section.
6. Companies that help run Kora
Kora uses two outside services. Neither is given your information for their own purposes.
| Who | What they do | What they receive |
|---|---|---|
| Supabase | Stores your records and runs the sign-in system | Everything in section 3 — but only if you have an account. Privacy policy |
| Google (Gemini API) | Answers Mentor questions | Only what is listed in section 5. Terms |
Typefaces are bundled inside the app, so displaying text does not fetch anything from Google.
Kora is distributed through the Google Play Store, which collects its own information about downloads under Google's privacy policy. That is outside Kora's control.
Nobody else receives your information. It is not sold, rented, or shared with advertisers, data brokers, lenders, or anyone else.
7. Where the information is kept
If you have an account, your records are stored on Supabase servers in [your Supabase region — check Project Settings → General]. Mentor requests are processed by Google, which may handle them outside your country.
If you do not have an account, nothing leaves your phone.
8. How it is protected
- Separated by account. The database enforces, at its own level, that an account can only ever read and write its own rows. This is not left to the app to get right.
- Encrypted in transit. Everything between the app and the servers travels over HTTPS.
- Passwords and recovery codes are hashed. They are stored scrambled and one-way, so they cannot be read back by anyone.
- The AI key never ships in the app. It lives only on the server, so unpacking the app cannot expose it.
- Automatic Android backup is off, so your records are not silently copied to Google Drive.
Being straight about the limits. Records on your phone are stored in an ordinary database file. It is protected by your phone's own screen lock and encryption, but Kora does not add a second layer on top. Any person or app with full access to your unlocked phone could read it. No system is completely secure, and this one is built and maintained by one person.
9. How long it is kept
Your records are kept until you delete them. There is no automatic expiry — a business's own history is the thing the app exists to build.
Deleted records are marked as deleted and removed from the servers. Records of Mentor request times are kept for a short period only, for rate limiting.
If an account is unused for a long time it is not deleted automatically. You can ask for it to be removed at any time.
10. Your rights
You can, at any time:
- See everything held about you — it is all visible inside the app
- Correct anything, by editing it in the app
- Delete everything, using Settings → Delete all my data (see the next section)
- Withdraw consent — switch the Mentor off, or sign out to stop syncing, and carry on using the app
- Ask a person — write to the address in section 15 with any request about your information
Requests are answered within 30 days. There is no charge.
11. Deleting everything
In the app: Settings → Delete all my data.
This removes the copy on the server first, and then wipes the phone. It cannot be undone, and there is no backup to restore from afterwards.
Uninstalling is not the same thing. Removing the app clears the phone, but if you have an account the copy on the server stays. Use Delete all my data first, or email the address below and ask for the account to be deleted.
12. Permissions the app asks for
Two, and no others:
| Permission | Why |
|---|---|
INTERNET |
To sync your records if you have an account, and to ask the Mentor a question |
ACCESS_NETWORK_STATE |
To check whether you have a connection, so the app can wait rather than fail |
Kora does not request location, contacts, camera, microphone, storage, SMS, or call logs.
13. Children
Kora is intended for people running a business and is not directed at children under 13. It does not knowingly collect information from them. If you believe a child has provided information through Kora, write to the address below and it will be deleted.
14. Changes to this policy
If this policy changes, the date and version at the top change with it. Anything significant — a new company receiving your information, or a new kind of information being collected — will be announced inside the app before it takes effect.
15. Contact and complaints
Kora
galacticfighter47@gmail.com
Write about anything: a question, a correction, a request to delete your account, or a complaint about how your information has been handled. You will get a reply within 30 days.
Kora is an independent project, not a registered company. This policy describes the app's actual behaviour as of the date at the top of this page. It has been written to be accurate and readable rather than comprehensive in a legal sense, and it is not legal advice.