Privacy Notice

1. Information we collect

1.1 Account information

When you create an account, we collect:

• Email address (required for account identification and communications)
• Username (chosen by you, visible to other users)
• Password (stored as a cryptographic hash, never in plain text)
• Profile picture (required after initial setup)
• Bio and location (optional, if you choose to provide them)

1.2 Age verification

We verify that you are at least 16 years old at registration. Your date of birth is checked during this process but never stored in our database. We only record the timestamp of when age verification was completed.

1.3 Credibility and voting data

As a core part of the platform, we collect and process:

• Your votes on content credibility (credible or not credible) and the timestamps of those votes. Content reports (spam, misinformation, hate speech) are tracked separately for moderation purposes
• Your credibility score, calculated from how your votes align with community consensus over time
• Voting accuracy metrics and participation statistics
• Author credibility scores for content you submit, based on community evaluation

1.4 Content submissions

Articles, posts, and any other content you submit to the platform, including associated metadata such as submission timestamps and content tags.

1.5 Reading and engagement activity

• Which articles you view and how long you spend reading
• Bookmarked articles
• Topics you follow or mute
• Feed preferences and curation settings (e.g. minimum credibility threshold)
• Blocked sources

1.6 Usage and technical information

We automatically collect technical information including:

• IP addresses and approximate geographic location
• Browser type and version, operating system
• Device type and screen resolution
• Pages visited, timestamps, and referral sources
• Error logs and performance metrics

1.7 Communications

When you contact us, we collect the content of your messages, including your name, email, subject, and message body, along with any support correspondence and resolution history.

2. How we use your information

2.1 Platform operation

• Operating the credibility scoring system, including calculating and updating user, author, source, and content credibility scores
• Ranking and personalising your news feed based on credibility and your preferences
• Managing your account, authentication, and profile
• Processing and displaying content you submit
• Delivering notifications about activity relevant to you

2.2 Platform integrity

• Detecting and preventing manipulation of the credibility scoring system
• Identifying coordinated inauthentic behaviour and voting rings
• Enforcing our Terms & Conditions
• Preventing fraud, abuse, and security threats
• Bot detection and rate limiting

2.3 Platform improvement

• Analysing usage patterns to improve features and performance
• Developing and refining credibility scoring algorithms
• Monitoring system health and resolving technical issues

2.4 Advertising

Koru may display advertisements to support the platform. If we do, we may use aggregated, non-personally-identifiable information (such as topic interests and reading patterns) to serve relevant advertisements. We will never sell your personal data to advertisers. If our advertising practices change materially, we will update this notice and notify you.

2.5 Communications

• Responding to your enquiries and support requests
• Sending transactional emails (account verification, password resets, security alerts)
• Notifying you of material changes to the platform, terms, or privacy practices

3. Lawful basis for processing

We process your data on the following legal bases:

• Contract: providing the service you signed up for, including account management, credibility scoring, feed delivery, and content processing.
• Legitimate interests: operating and improving the credibility scoring system, preventing manipulation, ensuring platform integrity, analysing usage patterns, and displaying relevant advertising.
• Legal obligation: complying with applicable laws, regulations, and legal processes.
• Consent: where required, such as for optional marketing communications or non-essential cookies.

4. Data retention

4.1 Account data

Account information is retained for the duration of your account plus 30 days after account deletion for administrative and security purposes.

4.2 Credibility and voting data

Your voting history and credibility scores are retained for as long as your account is active. Upon account deletion, your personal data is removed or anonymised, but aggregate credibility data, such as total vote tallies on articles, may be retained permanently.

4.3 Content submissions

Content you submit is retained for as long as your account is active. You can request removal of individual submissions at any time. Upon account deletion, public contributions such as articles, votes, and comments may remain visible under a deleted account handle where needed to preserve the community record, while personal data linked to you is removed or anonymised.

4.4 Technical and usage data

Technical logs and usage data are typically retained for 90 days for performance monitoring and debugging purposes.

5. Data sharing and disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties except in the following circumstances:

5.1 Public profile information

Your username, credibility score, profile picture, and public profile information are visible to other Koru users by design. This transparency is a core feature of the platform.

5.2 Service providers

We share information with trusted third parties who help operate the platform, including cloud infrastructure providers for hosting and storage, email service providers for transactional communications, and content delivery networks. All service providers operate under strict data processing agreements.

5.3 Legal requirements

We may disclose information when required by law, court order, or government regulation, or to protect our rights, property, or safety, or that of our users or others.

5.4 Business transfers

In the event of a merger, acquisition, or asset sale, user information may be transferred as part of the business assets. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

6. Data security

We implement industry-standard security measures to protect your information, including:

• Encrypted connections (HTTPS) for all data in transit
• Secure authentication using httponly cookies and token rotation
• Passwords hashed using industry-standard algorithms (never stored in plain text)
• Bot detection and rate limiting on authentication and public endpoints
• Avatar uploads validated, re-encoded, and stripped of metadata (EXIF, GPS, etc.)
• UUID-based file naming to prevent path traversal and information leakage
• Regular security reviews and dependency updates

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your rights

You have the following rights regarding your personal information:

7.1 Access and portability

• Access your credibility score. It is always visible on your profile
• Understand the methodology. How your score is calculated is documented and transparent
• Request a copy of your personal data, including voting history and submitted content
• Receive data in a portable, machine-readable format

7.2 Correction and updates

• Update your account information through your profile settings
• Request correction of inaccurate or incomplete data
• Modify your feed preferences and notification settings at any time

7.3 Erasure

• During pre-beta, request account deletion by emailing privacy@korunews.com from the email address linked to your account. Self-service account deletion is planned for full launch.
• Request removal of individual content submissions
• Account deletion removes or anonymises personal data linked to you. Anonymised, aggregated data, such as vote tallies on articles, may be retained after deletion.

7.4 Objection and restriction

• Object to specific data processing activities
• Restrict processing for specific purposes
• Opt out of non-essential communications

7.5 Complaints

If you believe your rights have been violated, you have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).

8. Cookies and tracking

We use cookies and similar technologies to operate the platform:

8.1 Essential cookies

Required for the platform to function, including authentication tokens (httponly cookies for security), session management, and CSRF protection. These cannot be disabled.

8.2 Analytics cookies

Help us understand how users interact with the platform to improve performance and user experience. These are only set with your consent.

8.3 Preference cookies

Remember your settings and preferences (such as theme or layout choices) for future visits.

You can manage cookie preferences through your browser settings. Note that disabling essential cookies will prevent the platform from functioning correctly.

9. International data transfers

Your information may be transferred to and processed in countries other than the United Kingdom. We ensure that such transfers comply with applicable data protection laws through standard contractual clauses, adequacy decisions where applicable, and other appropriate safeguards as required by law.

10. Children's privacy

Koru is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. Age is verified at registration, and dates of birth are never stored. If you become aware that a child has created an account, please contact us immediately and we will take steps to remove the account.

11. Changes to this Privacy Notice

We may update this Privacy Notice from time to time. We will notify you of material changes by:

• Posting the updated notice on the platform
• Updating the "Last updated" date
• Sending email notifications for significant changes
• Displaying prominent notices within the platform

Your continued use of Koru after changes become effective constitutes acceptance of the updated Privacy Notice.

12. Contact us

If you have questions about this Privacy Notice or our data practices, please contact us:

• Privacy enquiries: privacy@korunews.com
• General support: support@korunews.com

For GDPR-related requests, please allow up to 30 days for processing. For urgent privacy concerns, please mark your communication as "Urgent Privacy Request."