Privacy Policy
Last updated: 28 October 2026
Korazon is an app for event check-in and meeting people at events. This policy explains what we collect, why, who can see it, and how to delete it. Korazon is run by its founding team and is not yet a registered company. Contact us at [email protected].
What we collect
Your account. Your email address and password (stored hashed, never in plain text), plus when you signed up and last logged in. Our login provider also records IP addresses in its security logs.
Your profile. Your first and last name and username, which you need to sign up. Optional: a bio, profile photos, your Instagram and LinkedIn handles, and professional tags. Some older accounts may also have a Snapchat handle or class year from an earlier version of the app.
Your QR code. A code made from your account ID, used as your pass at the door.
Your event activity. Which events you hold a ticket for, when you were checked in and who checked you in, organisations you join and your role in them, and which event updates you've seen.
Organisation and event details. If you run an organisation or event, its name, description, images, contact details and location.
Device permissions. We only ask when the feature needs it:
- Camera: to scan QR codes at the door (event staff only).
- Photos: to choose profile, organisation and event pictures.
- Approximate location: only when event staff search for an event address, to show nearby results first. It's rounded to about 1 km, passed through our server to Google, and not stored or logged by us.
The Korazon app doesn't use analytics, advertising, crash-reporting or tracking tools, and we don't access your contacts, microphone or background location.
Our website, korazon.dev, uses Cloudflare Web Analytics to count page visits. It doesn't use cookies or track you across other sites.
How we use it
- To create your account, log you in, and send password-reset codes and a welcome email.
- To check you in at events and show event hosts who has arrived.
- To show attendees who else is going, so people can connect.
- To run organisations and events: members lists, roles and event updates.
- To keep Korazon secure and fix problems.
We don't sell your data, use it for advertising, or share it for anyone else's marketing.
Who can see your information
| Information | Who can see it |
|---|---|
| Email address, QR code | Only you (and the Korazon team, for support) |
| Profile: name, username, bio, photos, social handles, tags, organisation and role | Any logged-in Korazon user who opens your profile |
| That you're going to an event | Other ticket holders for that event, and the host organisation |
| Your tickets and check-ins | You and the host organisation |
| Organisation membership and role | Any logged-in Korazon user |
Profile photos are stored at long, hard-to-guess web addresses. Anyone who has a photo's exact address can open it without logging in.
Reports and blocks are stored. When you report someone, the report, including a copy of the reported profile, is emailed to the Korazon team so we can review it. Blocking someone also sends us a report.
Service providers
We use these companies to run Korazon. They process data for us under their own security and privacy terms.
| Provider | What it does | Data it handles |
|---|---|---|
| Supabase | Database, login, file storage | All of the data above |
| Resend | Sends our emails | Your email address and first name; for reports, also the report and a copy of the reported profile |
| Cloudflare | Forwards email sent to [email protected]; hosts korazon.dev and counts website visits (Cloudflare Web Analytics, no cookies) | Emails you send us; website visit data |
| Google Maps Platform | Address search and event maps | Address searches typed by event staff, their approximate location if allowed, event locations |
| Google Fonts | Loads the app's fonts | Your device's IP address |
| Gravatar | Placeholder picture when there's no photo | Your device's IP address |
Ticketing partners. If you buy a ticket through Humanitix, Eventbrite or a similar site, the event organiser may give us your email address so we can give your Korazon account access to that event. Your purchase itself is covered by that site's privacy policy.
Legal requests. We may share information if the law requires it, or to protect someone's safety.
Your data may be stored or processed outside your country, including in Australia and the United States.
How long we keep it
We keep your account, profile and event history until you delete your account. When you do, we delete your profile, photos, tickets and check-ins within 30 days. Records of events and organisations other people created stay, but they no longer show your details. If you were reported, the report keeps a copy of your profile as it was then, for safety (see below). Our providers' security logs are deleted on their own schedules.
Your choices and rights
- See and correct your data: edit your profile in the app at any time, or email us for a copy of what we hold.
- Delete your account: in the app, go to Profile, tap the menu, tap Delete account and type DELETE. Or email [email protected] from your account's email address. Details: below and korazon.dev/support.
- Permissions: you can turn off camera, photos or location access in your phone's settings at any time.
If you're in Australia, you can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) if you're unhappy with how we've handled a privacy concern. Please contact us first so we can try to fix it.
Delete your account
You can delete your account in the app (Profile, menu, Delete account, type DELETE) or by emailing [email protected] from your account's email address. Deleting is permanent. It removes your sign-in, profile, photos, tickets, check-ins and blocks, and takes you out of your organisation. Events and flyers that organisations created stay, without your details.
Reports are kept for safety. If you reported someone, the report stays but is no longer linked to your account. If you were reported, the report keeps a copy of your profile as it was then (name, username, bio, tags and social handles); your photos themselves are deleted. We can't erase emails already in our support inbox or our email provider's delivery logs.
Security
Data is sent over encrypted connections, passwords are hashed, and access rules in our database limit who can see what. No system is perfectly secure, so please use a password you don't use elsewhere.
Age
Korazon is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you think someone under 18 has an account, email us and we'll delete it.
Changes
If we change this policy, we'll update the date at the top. For significant changes, we'll also tell you in the app or by email.