Privacy Policy

Kurodo ("we", "us") is a privacy-first personal organization, focus, and executive-function assistant. This policy explains what personal data we process, why, and what rights you have. It applies to the Kurodo mobile applications and this website.

1. Data Controller

The data controller for Kurodo is the Kurodo development team. For all privacy inquiries, contact: privacy@kurodo.app

2. What We Collect

• Account data: email address and authentication credentials (managed by Supabase Auth).
• Content you create: tasks, brain dump recordings and transcripts, memory vault entries and photos, parked ideas, routines.
• Usage & gamification data: focus session durations, XP, streaks, badges — used only to power in-app features.
• Technical logs: IP address and access timestamps, retained as required by law for security purposes.

3. What We Do NOT Collect

• Biometric data never leaves your device. Face ID / fingerprint unlocking for the Memory Vault happens entirely in your device's secure enclave. We never receive it.
• No advertising identifiers, no cross-app tracking.
• No sale of personal data to any third party — ever.

4. AI Processing

When you use Voice Brain Dump, your recording is transcribed and the text is processed by an AI model (Google Gemini) to extract tasks, memories, and ideas. This processing happens only with your explicit in-app consent (Settings → AI Data Processing Consent), which you can withdraw at any time. Withdrawal disables AI extraction but not the rest of the app.

5. Where Your Data Lives

Data is stored on Supabase infrastructure with row-level security so that only your authenticated account can access your records. Data is cached locally on your device for offline-first use and encrypted at rest.

6. Retention & Deletion

You can permanently delete your account in the app (Settings → Permanently Delete My Account) or via the account deletion page. All personal content is erased immediately. Narrow categories are retained where law requires:

• Access/traffic logs: 1–2 years (Law No. 5651, Türkiye).
• Financial/billing records: 10 years (Tax & Commercial Codes).
• Deletion audit records: 3 years.

7. Your Rights

Under GDPR and KVKK you may request access, correction, erasure, restriction, portability, or object to processing. Email privacy@kurodo.app and we will respond within 30 days.

8. Children

Kurodo is not directed at children under 13.

9. Changes

We will announce material changes to this policy in-app and update the date above.