Kora Privacy Policy

Last updated: 9 October 2026

Kora is a mobile app that helps women through perimenopause keep track of their symptoms, cycles, training and nutrition. This policy explains what information Kora handles and how.

In short

• Kora has no accounts, and there is no server holding your health information. What you enter stays on your phone.
• We do not see, sell, advertise with or share your health information.
• Subscription payments are taken by Apple or Google. Whether your subscription is active is checked through RevenueCat; no health information is sent to it.
• If the app crashes, the technical details of the error go to Google Firebase Crashlytics, with none of your health information in them. You can turn this off in Settings.
• Basic technical events (that the app was opened, its version) go to Google Analytics for Firebase. Which parts of the app you use is sent only if you agree, and never what you log in them.

What is stored on your phone

What you enter is kept only on your device, in Kora's database and its settings:

• Profile: your name (optional), year of birth, height and weight, activity level, hormone therapy status and goals.
• Daily logs: sleep quality and duration, energy, mood, stress, soreness, symptoms and their severity, and your notes.
• Cycle and bleeding logs: period start and end dates, spotting, how heavy each day's bleeding was and the details you tick, such as clots, leaking or bleeding after sex.
• Your training and nutrition logs, including training you did outside Kora.
• Hot flushes you log as they happen: the time, and if you add them, how strong each one was and how long it lasted.
• Your own list of things that help during a hot flush, in your words.
• Nights: the times you woke in the night, and whether you woke sweating.
• Day marks: whether you made a day a gentle one, whether symptoms got in the way of your day, whether you missed work, and days you marked as having no hot flushes.
• Pain by body area, and any ongoing limitations you set, such as a sore knee.
• Appointments: their dates, who they are with, your notes, and your list of symptoms, topics and questions to raise.
• Treatments, prescribed medication, supplements and contraception, as you record them: what they are, and when you started, changed or stopped them. Kora only keeps this record for you; it never suggests a treatment.
• Experiments you run: which change you tried, its dates and the days you ticked.
• Taps on the home-screen widget or an app shortcut, such as a hot flush marked there. They wait on your phone until Kora adds them to your log.

This information is not sent to us or to anyone else. If your phone's own backup (iCloud or Google backup) is switched on, the operating system may include app data in that backup; those backups are Apple's and Google's services and follow their terms.

Apple Health and Health Connect

If you allow it, Kora reads only sleep, heart rate variability (HRV) and resting heart rate from Apple Health (iOS) or Health Connect (Android). This information is used on your phone only, to judge how recovered you are that day and to adjust your training. Kora never writes anything to these sources. This information is not used for advertising, marketing or data mining, and it is not shared with third parties. You can withdraw access at any time in the Health app or in Health Connect.

Subscriptions and RevenueCat

Kora Premium is a subscription. Payment is taken by Apple (App Store) or Google (Google Play); your card details never reach us. To check whether your subscription is active we use RevenueCat, Inc. Only the following reaches RevenueCat: an anonymous user ID created by the app, your purchase and subscription records (product, dates, status), device and operating-system details, and technical information such as country and currency. No health information is sent to RevenueCat. RevenueCat's privacy policy: https://www.revenuecat.com/privacy

Crash reports (Firebase Crashlytics)

When Kora crashes or meets an unexpected error, a crash report is sent to Google's Firebase Crashlytics service so that we can find and fix the problem. The report contains only: the technical details of the error (its type and the line of code where it happened), the app version, the device model, the operating system version, and a random identifier Crashlytics creates for this installation. Nothing you log, whether symptoms, cycles, sleep or any other health information, and neither your name nor your email address is ever added to it. Crash reports are not used for advertising or tracking. You can turn them off at any time in Settings > Privacy. Firebase's privacy and security information: https://firebase.google.com/support/privacy

Analytics (Google Analytics for Firebase)

Kora uses Google Analytics for Firebase in two separate tiers.

Technical data, always sent, without your consent: that the app was opened, that onboarding was completed, that the subscription screen was shown (with only which part of Premium led to it), that a purchase or restore went through (without the price), the app version, the operating system and its version, the device model, and the country and language settings. None of this says anything about your health. We collect it on the basis of technical necessity and our legitimate interest in keeping the app working and finding out whether it is used at all.

Usage statistics, only with your explicit consent: which parts of the app you open (for example the check-in, the calendar, breathing, the library), each at most once a day, and roughly how long you have used Kora (in ranges such as "7 to 13 days"). Because which parts you use can say something about your health, this is sent only if you say yes. Kora asks once, from your third day; the answer is off until you agree. You can change it at any time in Settings > Privacy > Usage statistics, and from then on nothing more is sent.

Never sent, in either tier: what you log or its values (symptoms, their severity, hot flushes, bleeding, sleep, mood, weight), dates of your periods, how many of anything you logged, your notes or any text you type, your name, your email address, your contacts, or any information from Apple Health or Health Connect.

Google acts as our processor. Analytics data may be processed on Google's servers outside your country, including in the United States, under Google's data processing terms. It is not used for advertising or marketing, it is not sold, and it is not used to track you across other apps or websites: the advertising identifier is not collected, ad personalisation and ad storage are turned off, and no user ID is set. Analytics data is kept for 2 months and then deleted. Deleting all data in Settings also resets the analytics identifier on your phone, so what is sent afterwards cannot be linked to what was sent before. Google's information: https://firebase.google.com/support/privacy

Notifications

Kora's reminders, such as the morning check-in or a reminder before an appointment, are local notifications scheduled on your phone; none of them is sent from a server.

Exporting and sharing

The export options in Settings and in Insights write your information to a file and let you share it with an app of your choice. This happens only when you ask for it. A file you share is subject to the rules of wherever you send it.

Backups

"Back up my data" writes all your records and settings to one file and opens the share sheet so you can save it where you choose (Drive, iCloud Files, email). The file is not encrypted; it holds your health information, so keep it somewhere you trust. "Restore from a backup" reads the file you choose and puts it in place of what is on the phone. The file is never sent to us.

App lock

If you turn on the app lock, Kora asks for your phone's own lock (Face ID, fingerprint or passcode) when it opens. The operating system does the check; Kora never sees or stores face or fingerprint data.

Deleting your information

Deleting all data from Settings permanently removes all of Kora's information from your phone, turns usage statistics off and resets the analytics identifier. Uninstalling the app removes it as well. To cancel a subscription, use the subscription settings of the App Store or Google Play.

Advertising

Kora contains no advertising and no ad tracking. Nothing about you is sold or shared for marketing. The only reporting is the crash reports and analytics described above.

Children

Kora is not designed for people under 18.

Your rights

Your rights under the Turkish Personal Data Protection Law (KVKK) and the EU General Data Protection Regulation (GDPR) are unaffected. Because your health information is kept only on your phone, we cannot access it; you can view, export and delete it inside the app. For requests about your subscription records, write to us.

Changes

If we update this policy, we will publish the new date on this page.

Contact

Kora's developer is the person shown as the seller on the App Store and Google Play. For questions and requests: lunaydestek@gmail.com