Privacy policy

Who we are

korot is operated by TechMaker (techmaker.io), the data controller for the personal data described in this policy. For anything about privacy, write to hello@korot.app.

What we collect

Your email when you sign in, the names and greetings you write in your cards, the cards we create for you, your subscription status, and limited technical data needed to secure the service (such as a hashed IP address and your device and browser type).

We never collect payment details; Paddle processes them on the website, and Apple and Google in the app.

Signing in with Google or Apple

If you sign in with Google or Apple, we receive from that provider an identifier for your account there and your email address (with Apple, possibly a private relay address that hides your real one). The first time you sign in with Apple, we also receive your name if you choose to share it, and we keep it on your account. We never receive your password, your contacts or any other data from that account.

We use this data only to sign you in and keep your cards with your account; we never sell it or use it for ads. When you delete your account, we also revoke korot's access at Apple, and you can remove korot at any time in your Google or Apple account settings.

How we use it, and our legal bases

To create, keep and share your cards, run your account and subscription, and send sign-in codes and notifications about your orders: to perform our agreement with you.

To protect the service from fraud and abuse, find and fix errors, and count visits without identifying you: our legitimate interest in a safe service that works well.

To measure our ads: your consent where the law requires it, otherwise our legitimate interest, which you can refuse at any time as described below.

To keep payment and subscription records: our legal obligations.

We do not sell your personal data.

Payments and Paddle

When you subscribe on the website, Paddle processes the payment as Merchant of Record and collects what it needs to complete it (such as your name, email, billing address, payment method and tax location) under its own privacy notice. We never receive or store your full card details.

• Paddle privacy notice

Ads measurement

We use Meta to measure and improve our ads on Facebook and Instagram. When this runs on the website, it sends your IP address, browser type, Meta's cookies, what you do on public pages (such as viewing a card or starting a subscription), the plan's price and currency when you buy, and a hashed account id that does not reveal who you are. We never send your email or the text of your cards.

If you visit from the United Kingdom, the European Economic Area or Switzerland, we ask you first, and ad measurement on the website runs only after you allow it. Everywhere else it is on unless you decline it, which you can do at any time with the "No thanks" button at the bottom of this page. Wherever you are, once you decline, we respect it.

In the app, events such as opening the app, making and sharing a card, and subscribing (with its price) are sent to Meta with an anonymous app id, and RevenueCat reports subscription renewals to Meta. Your advertising identifier is used only with your permission: Apple's tracking request on iOS, and your in-app consent on Android.

You can withdraw at any time: on this page on the website ("No thanks" or "Change my choice"), in iOS Privacy & Security → Tracking, or by deleting your advertising ID in Android settings.

Cookies

We use a session cookie that keeps you signed in, one that remembers your ad-measurement choice, and a short-lived one that keeps the click id of a Meta ad. Meta's own cookies are added only when ad measurement runs, as described above. Our visit statistics from Plausible use no cookies.

Retention

Free cards stay downloadable for 72 hours (occasion cards until the day after the event, at most 30 days) and cards made on Lite or Plus for 30 days; their files are then deleted automatically. When you export the same design again, the newer file replaces the older one, which is deleted after 72 hours. Unused guest sessions are removed when they expire.

We keep your account data for as long as your account exists and delete it when you delete your account, as described below, except payment and subscription records, which we keep for as long as the law requires.

Service providers and who we share data with

We rely on trusted providers that process data on our behalf and only for the service: vxil (backend and data storage), Cloudflare (hosting, card rendering and bot protection), Amazon Web Services (sending sign-in codes and emails), Paddle (website payments, as Merchant of Record), Apple and Google (sign-in and app store payments), RevenueCat (in-app subscriptions), Meta (ads measurement), Expo (app updates), Sentry (error monitoring) and Plausible (cookieless, anonymous visit statistics).

We may also share data with our professional advisers, such as lawyers and accountants, when needed, and with authorities when the law requires it.

These providers may process your data outside your country. Where the law requires it, data leaving the UK, the European Economic Area or Switzerland is transferred under appropriate safeguards, such as Standard Contractual Clauses or adequacy decisions.

Security

All data between your device and korot travels encrypted over HTTPS, access to data is limited to what each service needs, and payment card details never reach us.

Children

korot is not meant for children under 13, and we do not knowingly collect their data. If you learn that a child has sent us personal data, write to us and we will delete it.

Your rights and deleting your data

You can delete your account at any time: on the website from the Account page, and in the app from Account, then Delete account. We delete your cards, designs and share links, end your sessions and cancel a website subscription, so you are not charged again. We cannot cancel App Store or Google Play subscriptions, so cancel those in the store. We keep only payment and subscription records, without your cards or designs, for as long as the law requires.

You can also ask to access, correct, delete, restrict or move your data, object to how we use it, and withdraw your consent at any time. Write to hello@korot.app and we will answer within one month. You also have the right to complain to the data protection authority in your country.

Changes to this policy

We may update this policy from time to time; the "Last updated" date above shows the latest version, and we will tell you about material changes.