Privacy Policy

Last updated: 12 October 2026

The short version: KORA VIBES is a social app for Nigerian campuses and cities. We keep only what we need to run it. We never sell your data. Your calls are never recorded. Backups you choose to make go to your own Google Drive, not to us.

1. Who we are

KORA VIBES ("KORA", "we") runs the app at koravibes.app. For anything in this policy, contact us at spentdigitallabs@gmail.com.

2. What we collect

Data	Why
Account: email address, account ID, sign-in provider and authentication status	To create, authenticate and secure your account, prevent abuse and help you recover access
Profile: @username, display name, photo or emoji, bio, identity details you choose to provide, campus, state, city and privacy choices	To display your profile, apply your visibility choices and connect you to communities
Messages and content: text, replies, reactions, photos, voice notes, posts, comments, reports and group content you submit	To deliver and display the content to its intended room, group or recipient, and to provide moderation and safety tools
Community and product activity: rooms and groups joined, Cap, Kobo balance and transactions, streaks, referrals, votes, games, challenges and feature settings	To operate the app, calculate scores and balances, provide features, prevent fraud and resolve support requests
Location: device coordinates processed when you request a nearby-room or city check-in; the resulting area, city or state and check-in time	To find nearby communities or confirm a requested check-in. Coordinates are used for the request and are not saved to your profile; the resulting area may be saved
Device and connection data: push token, browser/device type, app activity and last-seen time	To deliver notifications, operate sessions, show online status according to your settings and protect the service
Network and diagnostic data: IP address, request time, endpoint and error information in hosting/security logs; a one-way hash of the IP address and a random browser/device identifier for abuse checks	Google Cloud processes network and request data to deliver and secure the app. KORA uses the hashed signals to detect automated, duplicate or fraudulent accounts and invite-reward abuse; it does not keep the raw IP as an abuse-prevention profile
Support and safety records: support messages, reports, moderation decisions and relevant account identifiers	To respond to requests, investigate reports and protect users and the service

3. What we do not collect or keep

Voice and video calls go directly between devices, or through a relay that passes media between participants. KORA does not record or store call or live-audio media.
We don't copy your phone's photo library, files or contacts.
We don't sell your data, and we don't use it for third-party advertising.

4. Google user data

Google services are optional. KORA requests access only when you choose the related feature and approve Google's consent screen. You can use KORA without connecting Drive or YouTube. We do not ask for your Google password; Google authenticates you and issues the permission needed for the selected feature.

Google sign-in

If you choose Continue with Google, Google and Firebase provide an account identifier and basic account information such as your email address, display name and profile photo, subject to the consent screen and your Google account settings. KORA uses this information to create or access your KORA account, show the name and photo you choose to use, and secure your session. KORA does not receive your Google password.

Google Drive backup

KORA requests the drive.appdata scope. This limits access to the private application-data folder created for KORA; it does not let KORA browse your other Drive files.
When you choose to back up, KORA writes the backup data you selected, such as your profile, your KORA conversations and groups, and media you chose to save. The backup is stored in your Google Drive, under your Google account, not in KORA's Drive.
The short-lived Drive access token is held in memory in your browser tab and is sent directly from your browser to Google Drive. KORA's application server does not receive or store that token.
You can remove backup files from the app or from the KORA app-data folder in Drive. You can also revoke KORA's Drive permission at Google Account permissions.

YouTube Live

KORA requests the youtube.force-ssl scope only when you choose to connect a YouTube channel for creator live streaming.
KORA uses the permission to identify the channel you connected, create and manage a broadcast and stream for a live session you request, and check that session's status and public viewer information. KORA does not use this permission to change unrelated channel settings or manage videos you did not create through the live feature.
For this feature, Google returns channel information (such as channel ID and title), broadcast and stream identifiers, title and description, privacy choice, broadcast status and thumbnail. KORA stores the channel details and an encrypted refresh token so you can use the feature again. The refresh token is encrypted on KORA's server and is used only to obtain access for the YouTube actions you request. The stream key is returned to your browser so your streaming software can send video directly to YouTube; KORA does not host or record the video.
The YouTube broadcast and any replay are hosted on your YouTube channel and are subject to your YouTube privacy choice and Google's terms. KORA displays the stream in the Arena and stores only the metadata needed to list and display it.
You can disconnect YouTube from the Go live screen. Disconnecting revokes the stored refresh token and deletes KORA's saved channel connection. You can also revoke KORA's permission at Google Account permissions. If Google revokes or expires the grant, KORA removes the unusable token and asks you to connect again.

Google API data limits

KORA's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide or improve the user-facing feature you requested. It is not sold, used for advertising, or used to build advertising profiles. It is not transferred to others except as necessary to provide or improve that feature, to comply with applicable law, or as part of a merger, acquisition or sale of assets with appropriate protections. People do not read Google user data except with your consent, when necessary for security, to comply with law, or to provide or improve the feature when the data has been aggregated or anonymized.

We retain Google data only for as long as needed for the feature described above. You can disconnect Google at any time using the controls above or Google's account-permissions page. Contact spentdigitallabs@gmail.com for help accessing or deleting data associated with your KORA account.

5. Who we share data with

We disclose only the data needed for the services below. Service providers process data on our behalf or under their own privacy terms as applicable; we do not sell personal information.

Google Firebase and Google Cloud: accounts, database, file storage, notifications and hosting.
Cloudflare: call relay and live audio when enabled. It passes media between participants; KORA does not record the media.
YouTube and Google APIs: channel connection, broadcast creation and stream delivery only when you choose to use YouTube Live.
Google Gemini: AI features. We send the prompt or content needed to answer the request you make; do not submit information you do not want processed for that request.
OpenStreetMap Nominatim: turns a location check-in into an area name.
Paystack: only if you buy Kobo. Paystack processes the payment; we store the amount, the reference and whether it succeeded, never your card details.

We may disclose data if the law requires it, or to protect people from harm.

6. What others can see

Public campus and city rooms can be read by anyone. Your DMs and private groups are visible only to their members. In Profile → Privacy, you control who can find you, send you chat requests and see your full profile. If you limit profile details to friends, other people can find you by @username, but they see your full profile only after you accept their chat request. Our moderators can see content that has been reported to them, but never your private chats otherwise.

7. How long we keep data

Unexpired chat photos and voice notes: for delivery and use in the chat; chat photos are designed to expire after 24 hours unless you save a copy.
Profile, messages and community content: until you delete the content or account, subject to backups, recipients' copies and legal or safety needs.
Google Drive backup files: in your Drive until you delete them. KORA does not control copies in your account.
YouTube refresh token: until you disconnect YouTube, delete your KORA account, or Google revokes the grant. Broadcast metadata remains while needed to show the live stream or replay in KORA.
Reports, support records, payment records and moderation logs: for the time needed to provide support, meet legal/accounting duties, resolve disputes and protect users.
Security and diagnostic records: for the limited period needed to investigate abuse, secure the service and troubleshoot problems.

8. Your rights

Under the Nigeria Data Protection Act 2023, and similar laws where you live, you can:

Access your data.
Download it: My data → Download my data.
Correct it.
Delete it.
Object to how it's used.

You can review and edit profile details in the app, download a copy of your data using My data → Download my data, and delete your account by emailing spentdigitallabs@gmail.com. We aim to respond to privacy requests within 30 days. Deleting your KORA account does not delete files you separately saved in Google Drive or videos and replays hosted by YouTube; remove those from the relevant Google service as well.

9. Children

KORA is for people aged 13 and over. If you're under 18, use KORA with a parent's or guardian's permission.

10. Security

We use encrypted connections (HTTPS), access rules on our database, and server-side checks. Sensitive tokens are stored encrypted. No system is perfectly secure, so please use a strong password.

11. Changes

If we change this policy, we'll update the date above and tell you in the app.