Skip to content

Privacy Policy

Last updated: 16 August 2026

Service: Kora Study (korastudy.com, app.korastudy.com)
Contact (privacy / data requests): privacy@korastudy.com
Contact (security): security@korastudy.com

1. Who we are

Kora Study (“Kora”, “we”, “us”) provides an AI-assisted study platform: course uploads, study plans, flashcards, practice exams, notes, lecture tools, and Ask Kora chat.

For GDPR purposes, the controller of your personal data is the operator of Kora Study reachable at privacy@korastudy.com.

2. What this policy covers

This policy applies to:

  • Our marketing site and product app
  • Accounts you create
  • Study content you upload or generate in the product
  • Related support and transactional emails

It does not cover third-party websites we link to (for example payment portals).

3. Information we collect

3.1 Account and profile

  • Name, email address
  • Authentication data via Firebase Authentication (email/password or Google sign-in)
  • Profile preferences (study schedule, theme, notification settings, university/program if you provide them)
  • Age confirmation and Terms/Privacy acceptance timestamps at signup
  • Subscription / plan status and Polar customer/subscription identifiers (not card numbers)

3.2 Study and product data

  • Modules, uploaded files (e.g. PDFs), resources, notes, flashcards, exams and answers, knowledge trees, cheat sheets, lecture-related data, study sessions and progress
  • Messages and attachments you send to Ask Kora and similar AI features
  • Feature suggestions and support requests you submit

3.3 Usage, diagnostics, and security

  • Product analytics events (PostHog), only if you consent to analytics cookies
  • Error and performance diagnostics (Sentry) to keep the service reliable
  • Technical logs (e.g. IP address, device/browser metadata, timestamps) as needed for security, abuse prevention, and rate limiting
  • AI usage metering (token/cost aggregates tied to your account for plan limits)
  • Optional web push device tokens (Firebase Cloud Messaging) when you enable notifications on a device

3.4 Payments

Payments are processed by Polar as merchant of record. We do not store full card numbers or CVV. We store subscription status and related billing identifiers needed to unlock features.

3.5 Information we do not intentionally collect

We do not ask for government ID, precise GPS location, or payment card PANs. Please do not upload highly sensitive personal data (e.g. medical records, passwords for other services) into study materials.

4. How we use your information

We use personal data to:

  • Provide and improve the service (accounts, study features, sync across devices)
  • Generate AI-assisted study outputs (plans, cards, exams, answers, summaries)
  • Authenticate you, secure accounts, and prevent abuse
  • Process subscriptions and manage plan entitlements
  • Send transactional emails (verification, password reset, welcome, important service notices)
  • Send study reminders you opt into (email and/or web push on devices you enable)
  • Respond to support and privacy requests
  • Comply with law and enforce our Terms
  • Understand product usage when you have consented to analytics

We do not sell your personal information. We do not use your study content to train our own foundation models. Third-party AI providers process prompts as needed to return results under their terms and our agreements with them.

5. AI processing (important)

Kora uses artificial intelligence (currently Anthropic) for features such as Ask Kora, PDF/course analysis, study plans, flashcards, practice exams, and related tools.

  • Content you upload or type (including course excerpts and chat) may be sent to our AI provider to generate results.
  • AI outputs can be wrong or incomplete. Verify important information yourself. Practice-exam mark schemes and tutoring answers are study aids, not official university marking.
  • Multiple-choice practice questions may be auto-scored against a stored correct option; other question types generally require self-marking against the scheme.

More detail may appear in-product as “AI-assisted” notices.

6. Legal bases (EEA/UK)

Where GDPR/UK GDPR applies, we typically rely on:

| Purpose | Legal basis | |---------|-------------| | Providing the contracted service (account, study features, billing status) | Contract (Art. 6(1)(b)) | | Security, fraud/abuse prevention, essential cookies | Legitimate interests (Art. 6(1)(f)) and/or contract | | Optional analytics cookies | Consent (Art. 6(1)(a)) | | Legal compliance | Legal obligation (Art. 6(1)(c)) | | Improving the product with aggregated insights | Legitimate interests, balanced against your rights |

You may withdraw analytics consent at any time (see Cookies / Settings).

7. Sharing and subprocessors

We share data with service providers who process it on our instructions:

| Provider | Role | |----------|------| | Google Firebase / Google Cloud | Authentication, database (Firestore), file storage, optional web push (FCM) | | Vercel | Hosting and delivery of the web apps | | Anthropic | AI model inference for study features | | PostHog | Product analytics (if you consent) | | Sentry | Error monitoring | | Polar | Payments / subscriptions (merchant of record) | | Resend | Transactional email delivery |

We may also disclose information if required by law, or to protect rights, safety, and the integrity of the service.

International transfers (e.g. to the US) may occur via these providers. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and provider compliance programmes.

8. Your study data

Your modules, uploads, notes, progress, and related study content are stored in your account and used to provide the product to you. We do not sell this content. Access by our team is limited to what is needed for support, security, abuse investigation, or legal compliance.

9. Retention

We retain account and study data while your account is active. After you delete your account, we delete or anonymise personal data from our primary systems (Firestore, Storage, Auth) and associated usage logs we can reasonably locate, subject to:

  • Short backup or log retention windows
  • Records we must keep for legal, tax, or dispute purposes
  • Aggregated statistics that no longer identify you

You can export a JSON copy of much of your account data from the product (Progress → Export Data) before deleting.

10. Your rights

Depending on where you live, you may have rights to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your account and data
  • Export / portability (JSON export in-app)
  • Restrict or object to certain processing
  • Withdraw consent (analytics) without affecting lawful processing based on other grounds
  • Lodge a complaint with a supervisory authority (EEA/UK)

How to exercise rights

  1. In-app: export data; delete account (Profile / account settings)
  2. Email: privacy@korastudy.com (include the email on your account)

We aim to respond within 30 days (or sooner where local law requires).

California residents: we do not “sell” personal information as commonly defined. If our analytics practices ever constitute “sharing” under CPRA, you can opt out by choosing Essential only cookies / disabling analytics in Settings.

11. Children

Kora is intended for users who are at least 16 years old. We do not knowingly create accounts for children under 16. If you believe a child under 16 has an account, contact privacy@korastudy.com and we will take appropriate steps.

12. Security

We use industry-standard measures appropriate to a SaaS product (HTTPS, authenticated APIs, access controls, rate limits). No method of transmission or storage is 100% secure. Report suspected vulnerabilities to security@korastudy.com.

13. Cookies

See our Cookie Policy. Essential cookies are required for sign-in. Analytics cookies require your consent.

14. Changes

We may update this policy from time to time. We will change the “Last updated” date and, for material changes, provide additional notice where appropriate (e.g. in-app or email).

15. Contact

  • Privacy / data requests: privacy@korastudy.com
  • Security: security@korastudy.com
  • General: hello@korastudy.com (if configured)

Last updated: 16 September 2026