Koloia

Privacy Policy

Effective

Who we are

Koloia is run by Bohdan Kostiuk, a private individual in the European Union, who is the controller of your data. Write to privacy@koloia.app about your data and to support@koloia.app about anything else. Koloia is offered to people in the European Economic Area, the United Kingdom, the United States, Canada and Ukraine; the app can be downloaded elsewhere, but we do not offer it there, and we do not serve people in Russia or China.

What we collect and why

Your account
Your name, email address and Google account identifier from Google sign-in, your language, your birth year, when you confirmed your age and when you accepted the Terms of Use — to give you an account (our agreement with you). Without a name and an email address there is no account.
What you do in Koloia
Your kolos, the titles you add, your proposals and notes, statuses, ratings, bookmarks, the people you block and notifications — to run the service (our agreement with you). Members of a kolo see your name and what you do in it; we tell nobody whom you block.
Your devices
A sign-in token for each device and, if you allow notifications on it, a notification token and the identifier Google's notification service gives the app — to keep you signed in and to notify you (our agreement with you; notifications only with your permission on the device).
Technical records
Short server records without your network address; for about a minute, a hashed network address or, once you are signed in, your account identifier, to limit abuse; encrypted backups; daily totals without names — to keep the service safe and working (our legitimate interest).
Failure reports
The app's recent log with your device model, system version, app version and language — only with your consent (the app asks after a crash, and Profile has a switch) or when you send one yourself.
Your emails to us
Including deletion requests and reports; a report from the app names what it is about — the kolo, the person's name and the note. We use them to answer you and keep a record of how your request was handled (our agreement with you and our legitimate interest).

We do not sell your data or use it for advertising, and we make no automated decisions about you. The app talks to our server over encrypted connections, backups are encrypted, and access to the servers and the database is limited to the operator.

Who receives it

  • Oracle Cloud, Frankfurt — servers and database
  • A second server under the operator's control — encrypted backups
  • Google — sign-in, notifications on Android, our mailbox
  • Mailjet (Sinch group) — sends our emails to you, without open or click tracking
  • Cloudflare — this website, the protection of our server, forwarding of your emails to us
  • Expo — relays notifications
  • GitHub — the app's installation and update files
  • Slack — failure reports and alerts for the operator
  • TMDB — film data; it receives only the words you search for and title identifiers, never who you are
  • IGDB (a Twitch service) — game data; it receives only the words you search for in the games catalog and game identifiers, as TMDB does for films; it never receives your name or account

Where the data goes

Your data is stored in Frankfurt, Germany; the encrypted backups are also in the European Union. Google, Cloudflare, Expo, GitHub, Slack and IGDB / Twitch are companies in the United States, and Mailjet's support can reach data from there; these transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. For people in the United Kingdom, transfers to the European Union rely on the UK's adequacy regulations, and transfers to the United States on the UK extension of that Framework or the UK addendum to those clauses. Some of these providers, Oracle included, are US companies or belong to US groups, so US authorities may be able to access data they hold under US law. You can ask for a copy of these safeguards at privacy@koloia.app.

If you are in Ukraine: by signing in, you consent to your data being processed by these providers outside Ukraine. You can withdraw this consent by deleting your account.

How long we keep it

  • Your account and its data — until you delete the account; encrypted backups — about two more days. Restoring a backup would bring back accounts deleted after it was taken.
  • Technical records — rate-limit counters about a minute, notification receipts up to 26 hours, server records in a small rotating log that new records overwrite.
  • Failure reports — until handled, at most a year.
  • If we suspend or close an account for breaking the Terms, a one-way fingerprint of its Google account, to keep it from signing in (our legitimate interest) — until the suspension ends or we lift the closure.
  • Your emails to us and our replies, including a copy of your data you asked for — at most two years.
  • The providers' own records — under their own retention periods.

Your rights

You can ask to see, correct or delete your data, to restrict its use, and to receive it in a machine-readable file, and you can withdraw a consent at any time — failure reports in Profile, notifications in your device settings; withdrawing does not affect what was done before. Write to privacy@koloia.app from your Google account's address; we answer within 30 days, free of charge. You can delete your account yourself — see Delete your account.

You can object at any time to the processing we base on our legitimate interests.

You can complain to us first at privacy@koloia.app: we acknowledge a complaint within 30 days, look into it and tell you the outcome. You can also complain to a data-protection authority: in the European Economic Area, the one in your country; in the United Kingdom, the Information Commissioner's Office; in Canada, the Office of the Privacy Commissioner of Canada (in Quebec, the Commission d'accès à l'information; in Alberta and British Columbia, the provincial Information and Privacy Commissioner); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights. For people in Canada: the person responsible for personal information is the operator named above, and your information is stored outside Canada.

Age

Koloia is for people aged 16 and older. The app does not create an account for anyone younger, and we delete an account if we learn it belongs to someone under 16. Parents can write to privacy@koloia.app.

If you are under 18 and live in California, you can remove what you posted by deleting a kolo you own or your account; deleting the account removes your proposals and notes everywhere. Removal may not be complete: backups keep a copy for about two more days, and others may have copied it.

Cookies and tracking

This website sets no cookies of its own and runs no analytics; it stores only the language you pick, in your browser, to remember it; clearing this site's data removes it. The app stores your session and settings on your device. We do not track you across other websites or apps and let no one else do so through Koloia; Google keeps its own record of your sign-ins. A Do Not Track signal from your browser therefore changes nothing here.

Changes

When this policy changes, the date at the top changes. If a change matters to you — new data, a new purpose, a new provider — we tell you by email or in the app before it applies to you.