Privacy Policy

Introduction

Koru is an app for organizing everyday life and household responsibilities: routines, cleaning plans, shopping, calendar, notes and personal finances, with Lumi, an assistant you can talk to. In this policy, "Koru", "we" and "us" mean the team that operates the Koru app.

This policy explains what information Koru collects, how it is used, who else processes it, how long it is kept, and the choices you have. It applies to the Koru mobile app and the services it connects to, including Lumi.

We have tried to describe how Koru works today, in plain language. Where something is outside our control, such as how other companies handle information, we say so.

If you have a question about privacy, contact us at privacy@getkoruapp.com.

Information We Collect

Account information

Your name, email address and password when you create an account. Your password is handled by our authentication provider; the Koru app doesn't keep a copy of it.
Optional profile details you choose to add: first and last name, a username, date of birth, and country or region.
Your answers to the welcome questions Koru asks after you sign up, which Koru uses to arrange your Home screen.
Whether you have a Koru subscription, and its status.

Household and organization information

Routines you create, their times and colors, and which ones you've completed each day.
Cleaning Plans you add to your routine, and the tasks you tick off.
Shopping list items, their quantities and categories, and whether they've been checked off.
Calendar events, including their title, date and time, and any location or notes you add.
Notes you write.

Financial information

Koru helps you keep track of your own finances. Anything here is entered by you or by Lumi at your request:

Your monthly budget and any monthly income you add.
Expenses, with their descriptions, amounts, categories and dates.
Bills, with their names, amounts, due days, categories and the months you marked them paid.
Savings goals, with their targets and the amounts you've added.

This can be highly personal information. Koru isn't a bank or a financial institution. It doesn't connect to your bank accounts, move money, or pay bills for you.

Lumi and voice information

What you say to Lumi. Lumi works by voice: your phone records what you say while Lumi is listening.
A transcript of what you said, made by your device's speech recognition service where it is available.
A few short lines of the current conversation, so that follow-ups like "delete it" make sense.
Lumi's replies.

These are explained in more detail in the sections about Lumi and about voice below.

Payment and subscription information

If you subscribe, payment is handled by Stripe. Your card details are entered on Stripe's payment page, not in the Koru app. Koru receives and keeps records from Stripe about your subscription and payments, such as your Stripe customer identifier, your subscription and its status, invoices and payments, and the billing details and limited card information that Stripe provides, such as the card brand and last digits.

Reminders

If you turn on reminders, Koru schedules them on your device, using its own notification system, from your routines, Cleaning Plans, calendar events and bills. Your reminder settings, such as which reminders you get, when, Quiet Hours and what the lock screen shows, and your answer to the one-time invitation to turn reminders on, are saved on your device and with your account, so they follow you when you sign in on another device. Whether reminders are turned on is kept separately on each device. Your reminders themselves and the list of reminders you've received stay on your device. By default, reminders name what they're about, such as the bill, event or routine and when (your phone may show this only once it is unlocked); you can choose to show only the kind of reminder, or nothing but that you have one. Reminders are not sent through Koru's servers, and Koru doesn't currently send notifications from its servers. Reminders never include amounts of money. Each reminder is linked to your account on the device: when you sign out, Koru removes your scheduled reminders and the reminders it shows in its notification list, and another account signing in on the same device doesn't see them.

Information stored on your device

To work quickly and offline, Koru keeps some information on your device, including your sign-in session, your reminder settings, copies of your profile and finances, your welcome answers, the voice Lumi uses, and a short record of recent activity in the app (such as when you opened it, which routines you completed and when you opened Lumi). That activity record covers about the last two weeks, stays on your device and is used to adjust how Koru and Lumi present things to you.

Technical information

When the app talks to our servers, our systems record basic technical details of each request, such as the time, the type of request and whether it succeeded. Our infrastructure providers may also process technical information such as your IP address as part of running their services.

Information We Don't Intentionally Collect

The current version of Koru doesn't include features that use your location, contacts, camera or photo library.
Koru doesn't include advertising or third-party analytics tools, and doesn't track you across other apps or websites.
Koru doesn't ask for your bank account or card numbers inside the app.

Please don't enter information Koru doesn't need, such as passwords, full card numbers or health details, in notes, events, list items or when talking to Lumi.

Your device's operating system, its speech recognition service and the providers listed in this policy may process information under their own policies, independently of Koru.

How We Use Information

To create and manage your account and sign you in.
To store your routines, Cleaning Plans, shopping list, calendar, notes and finances and show them on your devices.
To arrange your Home screen based on your welcome answers.
To remind you of your routines, Cleaning Plans, calendar events and bills, if you turn reminders on.
To run Lumi: to understand your requests, read or update the parts of Koru you ask about, and reply.
To process subscriptions and payments.
To keep accounts separate and secure, prevent misuse and limit request rates.
To find and fix problems with the service.
To answer your questions and support requests.
To meet legal obligations.

We don't sell your personal information, and we don't use it for advertising.

Lumi and Artificial Intelligence

Lumi is the assistant built into Koru. To understand what you ask and help with your routines, calendar, shopping list and finances, Lumi uses outside artificial intelligence (AI) services, through Koru's own servers.

Google Gemini

Most of what you say to Lumi is understood by Google's Gemini AI service. Depending on how your request is handled, Gemini can receive your voice recording, the transcript your device made, a few short lines of the current conversation, and your date and time zone. Because Gemini receives what you say, it can receive anything you mention, including amounts of money, bill names or shopping items.

Anthropic Claude

When Lumi needs more help with a request, for example a general question Gemini didn't answer, or a request on a device that can't record audio, the text of that request and Koru's instructions may be sent to Anthropic's Claude AI service. Not every Lumi request reaches Anthropic.

How we limit what is sent

Lumi doesn't send your name, email address or account identifier to these AI services.
Your finances, calendar and routines are read and worded by Koru. The AI services receive what you said and the short conversation lines described next, not your stored records, though those lines can name an item you just discussed, such as a shopping item or a bill.
The conversation lines sent with a request are short, cover only the current conversation, and have amounts of money removed.
On devices with speech recognition, some simple money questions, such as "What's my budget?", are answered on the device without being sent to these AI services.
Each voice request is sent for understanding once. If a request fails, it may be retried once.

These measures reduce what is shared. They don't guarantee that sensitive information can never reach an AI service, because anything you say to Lumi may be included in what it sends.

How Lumi acts on what it understands

Lumi's suggestions are checked by Koru before anything happens, and Lumi can only act on your own information. When your request is clear, Lumi makes the change right away, without asking you to confirm. Lumi only says something is done after Koru has checked the change was saved.

AI makes mistakes

Lumi's replies are produced with the help of AI and can be wrong. Please check anything important, especially decisions about money, health, legal matters or safety. Lumi isn't a financial, legal or medical adviser.

The AI providers' own practices

Google and Anthropic process information under their own terms and privacy policies. We haven't made any guarantee about how long they keep information, whether they use it to improve their services, or where they process it. Please read their policies, linked below.

Voice, Audio and Speech

Lumi listens only after you open it. The first time, your device asks for permission to use the microphone and speech recognition. You can change this at any time in your device settings, but Lumi can't hear you without it.
While Lumi is open, it listens for your request, briefly listens again after replying in case you have a follow-up, and then closes. While it is answering a slow request or speaking a long reply, it may also listen for words such as "stop" or "go away".
Speech recognition is done by your device's speech service, such as Apple's or Google's. Depending on your device and settings, that service may process your voice on the device or over the network, under its own policy.
Your recording is usually sent through Koru's servers to Google Gemini to understand your request. Koru's servers handle the recording in memory and don't save it.
The recording is kept on your device only until it has been sent or is no longer needed, and then deleted. Leftover recordings, for example after the app closes unexpectedly, are removed the next time the app starts.
Lumi's spoken replies are produced by your device's own speech engine, so the replies themselves aren't sent to an outside service to be turned into speech.
Koru doesn't keep a history of your recordings.

Financial and Sensitive Information

The financial details you add to Koru can be sensitive. They are used only to provide the features you use, such as showing your budget or answering a question you ask Lumi.

Your finances are stored with your account and protected by the access controls described in the security section, so that other Koru users can't read them. When you ask Lumi about your money, Koru reads only the figures needed for that question.

Anything you say aloud to Lumi, including amounts, may be processed by the AI services described above.

Please don't store information in Koru that you wouldn't want held by an app, such as passwords, full card numbers or account login details.

Private and Shared Information

Today, your information in Koru belongs to your own account. Each account has its own space, and Koru has no way to invite or add other people to it, so other Koru users can't see your routines, calendar, shopping list, notes, finances or Lumi conversations.

Koru's Family plan and shared family features aren't available yet. Before any feature that shares information between people becomes available, we'll update this policy to explain what it shares and with whom.

How We Share Information

We share information only with service providers that help us run Koru, and when the law requires it. These providers process information for us under their own terms:

Supabase, for authentication and for storing your account and app information.
Cloud hosting providers that run Koru's servers.
Google (Gemini), which understands what you say to Lumi.
Anthropic (Claude), which may answer some general questions through Lumi.
Stripe, which processes subscriptions and payments.
Your device's speech recognition service, which turns your voice into text.
The email service that sends account emails, such as password-reset links.

We may also disclose information if required by law, to respond to valid legal requests, to protect the rights and safety of Koru's users or others, or as part of a business transfer such as a merger, in which case this policy would continue to apply to your information.

We don't sell your personal information, and we don't share it for advertising based on your activity across other apps or websites.

Data Retention

We haven't yet set fixed retention periods for each kind of information. Today, information is kept as follows:

Your account, profile and the information you add are kept while your account exists, until you delete them or delete your account.
Conversations with earlier versions of Lumi may have been saved with your account. They're kept until you delete your account. Lumi doesn't save new conversations.
Voice recordings are deleted from your device after use and aren't saved by Koru's servers. Koru's servers keep the understood meaning of a request in memory for a short time, so a repeated request isn't processed twice.
Subscription and payment records are kept by Stripe, and Koru keeps the records it received from Stripe.
Our servers' technical logs and our providers' backups are kept according to their settings, which we haven't yet fixed.
When an account is deleted, we keep a record of the deletion with the account's identifier and dates.
Copies on your device remain there until you remove the app. Reminders your phone has shown stay in its notification list until you clear them.

Cancelling a subscription, a subscription ending, signing out and deleting your account are different things. Only deleting your account removes your information from Koru's database, as described below.

Data Security

You sign in with your email and password. Changing your email or deleting your account requires your current password.
Database access rules limit your information to your own space, and your notes to you. Requests to our servers must carry a valid sign-in token.
Some information, such as Lumi conversations and billing records, can only be reached by Koru's servers, not by the app directly.
Lumi's voice recordings and temporary audio are deleted after use, and the servers keep short-lived information separately for each account.
Our servers' logs are designed to leave out the content of your requests, and sign-in credentials.
API keys for the AI and payment services are kept on Koru's servers, not in the app.

No method of transmission or storage is completely secure, and we can't guarantee that information will never be accessed without permission. Koru doesn't currently offer two-factor authentication. Please use a unique password and keep your device secure.

Deleting Your Account

You can delete your account in the app: open the More tab, tap Profile, then Delete account, and enter your password. If you have an active subscription, you'll be asked to cancel it first in Plan & subscription.

Deleting your account permanently removes from Koru's database your account and profile, your routines, calendar, shopping list, notes and finances, your Lumi conversations and your link to your Stripe customer record. This can't be undone.

Some information isn't removed when you delete your account:

Records held by Stripe, and the copies of Stripe records Koru received.
The record that your account was deleted.
Information in our servers' logs and in our providers' backups, until they are replaced under those providers' settings.
Information already processed by the AI services and your device's speech service, under their own policies.
Information stored on your device, until you remove the app.

You can also delete individual items, such as a note or an expense, at any time. Signing out doesn't delete anything.

If you can't delete your account in the app, contact us at privacy@getkoruapp.com.

Your Privacy Rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you.
Correct information that is inaccurate.
Delete your information.
Receive a copy of your information in a portable format.
Object to or ask us to restrict certain processing.
Withdraw consent where we rely on it.
Not be discriminated against for exercising your rights.
Complain to your local data protection authority.

In the app, you can review and correct your profile in Edit profile, edit or delete the items you've added, and delete your account. Koru doesn't yet have a tool to download a copy of your information. For any other request, contact us and we'll respond as required by the law that applies to you. We may need to confirm your identity first.

Lumi uses automated processing to understand your requests and act on your own information when you ask. Koru doesn't use automated processing to make decisions that have legal or similarly significant effects on you.

International Data Transfers

Several of the service providers named in this policy are companies based in the United States. Where your information is stored and processed depends on how each of those services is set up, which we haven't yet confirmed for every provider. Your information may therefore be processed in a country other than the one you live in, where privacy laws may differ from those of your country.

Children

Koru isn't intended for children under 13, and we don't knowingly collect personal information from children under 13. Koru doesn't currently check your age when you sign up. If you believe a child under 13 has given us personal information, contact us so we can delete it.

Some regions set a higher minimum age for using online services without a parent's permission. If you're under that age where you live, please use Koru only with your parent or guardian's involvement.

Third-Party Services

These services process information for Koru under their own privacy policies:

Links in Koru's Learning section open publishers' websites, which have their own policies.

Regional Information

United States, including California

We don't sell personal information, and we don't share it for cross-context behavioral advertising. Residents of California and other states with privacy laws may have the rights described above, including to know, correct and delete their information, and may use an authorized agent where the law allows.

European Economic Area, United Kingdom and Switzerland

We process your information to provide the service you asked for, to meet legal obligations, and for our legitimate interests in keeping Koru secure and working. Where we rely on your consent, you can withdraw it at any time. You have the rights described above and may complain to your local data protection authority.

Costa Rica

Under Law No. 8968 on the Protection of Persons with Regard to the Processing of their Personal Data, you may access, correct and delete your personal data, and you may contact the Agencia de Protección de Datos de los Habitantes (PRODHAB), Costa Rica's data protection authority.

Japan, South Korea and China

Your information may be provided to the service providers listed in this policy, including providers in other countries. You have the rights given by local law, such as Japan's Act on the Protection of Personal Information, Korea's Personal Information Protection Act and China's Personal Information Protection Law.

To exercise any of these rights, contact us using the details below.

Changes to This Policy

We'll update this policy when Koru changes how it handles information. The version and date at the top show when it last changed. If a change is significant, we may also let you know in other ways, such as in the app.

Contact Us

For questions or requests about your privacy, email us at privacy@getkoruapp.com. Please don't include passwords or payment details in your message.