Privacy Policy

1. Service Provider

The Kori application ("Service") is provided by Juuso Piikkilä, a private individual established in Finland, who is the data controller for the personal data described in this policy.

Email: [email protected]

Website: https://getkori.fi

2. What Data We Collect

2.1 User Account Information

• Email address
• Username
• Password (encrypted, processed through Auth0)

2.2 Shopping Lists and Products

• Shopping lists you create and their contents
• Product collection history (which products, when)
• Product categories and quantities

2.3 Location Data (optional, Kori Plus users only)

• Your approximate location in the store (200m radius) during shopping history
• Location data is used to optimize location-based category ordering
• Location data collection requires your explicit consent in the app settings
• You can disable consent at any time

2.4 Usage Analytics

• App usage statistics (TelemetryDeck)
• Error log data (Sentry)
• Analytics are anonymized and do not contain personally identifiable information

2.5 Payment Information

• Subscription details (Kori Plus subscription, subscription status)
• Payment transactions are processed through Apple App Store / Google Play Store
• We do not store credit card information

2.6 Recipes and Lists You Import and Products You Scan (Kori Plus)

• When you import a recipe or a list: the web page at a link you share to Kori, a photo you take or pick, a file you pick or share (a PDF, a text file or a recipe file), or text you share from another app, such as a list in Notes. When you share a page from Safari, Kori reads it on your phone as Safari shows it, and sends the recipe it contains or, if it has none, the page's main text, never the whole page or your cookies. If you are signed in to that site, this can include what you see while signed in. A PDF with text in it is read on your phone and only that text is sent; a scanned PDF is sent as images of its pages. Our server reads the text from a photo or a scanned page first, and uses the image itself only when that text can't be read reliably.
• When you scan a product: the barcode number, or the text on the front of the pack. That text is read on your phone, and the photo of the pack never leaves your phone.
• A barcode is looked up in Open Food Facts, a public product database, from our server. What Open Food Facts holds for it (the product's names, brand and size) goes to Anthropic, not the barcode itself, and we keep the result so the next scan of the same barcode needs no new lookup. Neither the lookup nor the stored result is linked to you or your account.
• Content you import and text read from a pack are used only to add items to your list. We don't store them, and they are sent to Anthropic without your name, email address or any account identifier (see section 4.7).

2.7 Visits to This Website

• Visits to this website are counted with Umami, an analytics tool we host ourselves, on our own server in Finland. No third party receives the data.
• A counted visit records the address of the page you viewed, with any invite code removed; the website that linked you here, without the page you came from; your browser, operating system and device type; your screen size; your browser's language; and your country.
• A click on a button that takes you to the App Store is also counted, along with which of the buttons it was.
• No cookies are used, and nothing is stored on your device. Your IP address is used to look up your country and to tell one visit from another, but it is never stored.
• If your browser sends a Do Not Track signal, your visit is not counted.

2.8 AI Assistants You Connect

• You can choose to connect an AI assistant, such as Claude or ChatGPT, to your Kori account. Nothing is connected unless you do it yourself: you sign in with your Kori account, and a consent screen names the assistant before you allow it.
• A connected assistant can read your lists: their names and their items, with each item's quantity, unit, note, category and whether it has been collected. On a list you share, that includes the items other members have added. On your behalf, it can also add items, check them off and back on, change an item's quantity, unit, note or category, including an item another member added, remove items you added that haven't been checked off, and create new lists. When it changes the category of a product you added, the category changes on all your lists, as it does in the app.
• The assistant can also suggest items based on your purchase history, the same way the app does (section 3). For someone new to Kori, it can set up the account: it creates the first list and the starter products in the language you choose.
• What the assistant reads from Kori goes to the company that provides it, such as Anthropic or OpenAI, and that company handles it under its own privacy policy. We don't control what it does with it (see section 4.8).
• Requests from an assistant are handled like the app's own, including by our error monitoring (Sentry, section 4.3).
• You can disconnect the assistant at any time in its own settings. To also cancel its access on our side, write to [email protected]. Deleting your Kori account deletes your lists from Kori as described in section 6, but not what the assistant's provider has already received.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Providing and maintaining the Service
• User account management and authentication
• Syncing shopping lists across multiple devices
• Providing product recommendations based on usage history
• Optimizing location-based category ordering (opt-in users only)
• Improving the Service and fixing bugs
• Adding imported recipes and scanned products to your list (Kori Plus)
• Acting on requests from an AI assistant you connect
• Subscription management (Kori Plus)

3.1 Legal Basis for Processing (GDPR Article 6)

• Performance of a contract (Article 6(1)(b)): providing and maintaining the Service, user account management and authentication, syncing shopping lists between your devices, acting on requests from an AI assistant you connect, importing recipes and scanning products, and subscription management.
• Consent (Article 6(1)(a)): collecting location data for location-based category ordering. You give this consent in the app settings and can withdraw it at any time.
• Legitimate interests (Article 6(1)(f)): anonymous usage analytics (TelemetryDeck) and error diagnostics (Sentry). Our legitimate interest is understanding how the Service is used and fixing faults in it. This data is anonymised, is not linked to your account, and is not used to build profiles or to make decisions about you.
• Legitimate interests (Article 6(1)(f)): counting visits to this website (section 2.7). Our legitimate interest is knowing whether the website reaches people and how they find it. The records contain nothing that identifies you, and you can opt out by turning on Do Not Track in your browser.

Where we rely on legitimate interests, you have the right to object to that processing (Article 21). For usage analytics you can do this yourself: the Settings → Anonymous usage data switch in the app stops signals being sent to TelemetryDeck immediately, with no need to restart the app.

The switch does not cover error diagnostics (Sentry). To object to that, or to any other processing based on legitimate interests, write to [email protected] and we will stop it.

4. Third Parties

The Service uses the following third-party service providers:

5. Data Retention

• User account data and shopping lists: Retained as long as the account is active
• Text you type when adding an item: Stored with that item's history and deleted when you delete your account
• Location data: Retained in aggregated and anonymized form for category ordering optimization
• Analytics data: Retained in accordance with TelemetryDeck's and Sentry's privacy policies
• Subscription history: Retained in accordance with RevenueCat's and App Store/Play Store requirements
• Imported recipes and scans: We don't store the content you import or the text read from a pack. Barcode results are kept without any link to you. Anthropic deletes what it receives within 30 days, unless it must keep it longer to enforce its usage policy
• Content an AI assistant reads from Kori: Kept by the assistant's provider under its own privacy policy. Deleting your Kori account doesn't remove it there
• Website visit records: Kept without a time limit. They contain nothing that identifies you, and visits cannot be linked to each other from one month to the next

6. User Rights (GDPR)

You have the right to:

• Access your data: Request a copy of all data stored about you
• Rectify your data: Correct inaccurate or incomplete data
• Delete your data: Delete your account and all associated data
• Data portability: Receive your data in a machine-readable format
• Object to processing: Refuse the processing of your data in certain situations
• Withdraw consent: Disable location data collection at any time

Account and Data Deletion

You can delete your account and all associated data directly from the app settings by selecting "Delete Account". This will delete:

• Your user account from Auth0
• All your shopping lists and product history
• Your location data (if you have given consent)
• Subscription details from RevenueCat

Note: Payment transaction history is retained in accordance with App Store/Play Store data for legal reasons.

7. Data Security

We protect your data using industry-standard security practices:

• Passwords are encrypted by Auth0
• Data transfer occurs over encrypted HTTPS connections
• Access to data is restricted to necessary purposes only
• Servers are located in Oracle Cloud's secure data centers

8. Minors

The Service is not intended for users under the age of 13. We do not knowingly collect data from minors.

9. Changes to the Privacy Policy

We may update this privacy policy from time to time. We will notify you of significant changes in the app or by email. The most recent update date of the privacy policy is shown at the beginning of the document.

10. Contact Information

If you have questions about the privacy policy or the processing of your data, please contact us:

Email: [email protected]

Website: https://getkori.fi