Kora Privacy Policy

Kora is made by Tesserix Pty Ltd (ACN 694 070 865, ABN 59 694 070 865), a company registered in New South Wales, Australia. This policy covers the Kora apps for iOS and Android. For anything not covered here, our general privacy policy applies.

• Account details: your name, email address and password. Passwords are held by our sign-in service in hashed form; we never see them.
• Profile details you choose to give: sex, birth year, height, current weight and goal weight, used to work out your nutrition targets.
• What you log: meals, foods, water, weight and fasting, and the text you type to describe them.
• Meal photos and nutrition-label photos you take or pick. These are stored privately so we can show you what was logged and check the accuracy of our estimates.
• Voice notes you record to describe a meal. The audio is sent for transcription and is not stored on our servers; the transcript becomes part of your log.
• Health and fitness data, only if you connect Apple Health or Health Connect: steps, sleep, weight and exercise. Kora only reads this data; it never writes to either.
• Social activity, if you use it: friends, groups, challenges and what you choose to share with them.
• Coach conversations: the messages you exchange with Otto, Kora's nutrition coach.
• Diagnostics: crash reports and performance data, so we can fix problems. These do not include your meals or photos.

Kora does not use advertising identifiers, does not show ads, and does not track you across other apps or websites.

Kora uses AI services to turn photos, voice notes and text into nutrition estimates, to read nutrition labels, and to answer you as your coach. When you log a meal this way, the photo, audio or text is sent to one or more of these providers for that request only:

• Google (Gemini): meal photos, voice transcription, text, and search embeddings.
• Anthropic (Claude): a second check of photo and label results, and coach replies.
• Microsoft Azure (Document Intelligence): reading text on nutrition labels.
• OpenAI: understanding meals described in text.

We use these providers under terms that do not allow them to train their models on your data. We do not use your health data to train AI models. AI estimates can be wrong; Kora is not medical advice.

We use your data only to run Kora for you: to log and estimate your nutrition, show your progress, send the reminders you set, run the social features you join, keep your account secure, and improve the accuracy of our estimates. We do not sell your data, and we do not use health data for advertising or share it with data brokers.

• Google Cloud Platform: hosting, database and private photo storage.
• Cloudflare: DNS and network protection.
• The AI providers listed in section 03.
• Resend: sending sign-in codes by email.
• Sentry: crash reporting.
• Apple and Google: push notifications, if you turn them on.

Each provider processes data under its own agreement with us and only for the purpose we use it for.

Kora runs on Google Cloud Platform in the asia-south1 (Mumbai) region. The providers in section 03 and 05 may process data in other countries, including the United States and Australia. Data is encrypted in transit and at rest.

We keep your data while your account is open. When you delete your account, your profile, logs, photos, health data, social activity and coach conversations are deleted, and your sign-in identity is removed. We keep two things that contain none of your content: an anonymous count of AI usage for billing and capacity records, and AI performance records (which model ran, how long it took, whether it succeeded) labelled with a one-way code instead of your account.

• Export: More → Profile → Export my data gives you a copy of everything in your account.
• Delete: how to delete your Kora account, in the app or by email.
• Health access: you can disconnect Apple Health or Health Connect at any time in your phone's settings.
• Camera, microphone and photos are only used when you choose to log with them, and you can turn each off in your phone's settings.

Depending on where you live, you may also have rights to access, correct or object to how we use your data, under the Australian Privacy Principles, the GDPR, India's Digital Personal Data Protection Act or similar laws, and to complain to a data protection authority.

Kora is for adults. It is not directed at, or intended for, anyone under 18.

We will update the date at the top of this page whenever this policy changes, and tell you in the app if a change affects how we use your data. For questions or requests, email [email protected].