Privacy Policy

Local by default, cloud for some features

Your personal creative records, works, artist notes, and portfolio are stored by default in local storage on your device (SQLite + files). Data is transmitted to and stored in the cloud only when you use the following features:

• Collaboration (shared rooms) — room activity, notices, feedback, schedules, room profile (nickname/avatar), and records you post to a room.
• Cross-device sync — your personal records pass through our server in end-to-end encrypted form so you can view them on multiple devices (the server holds no decryption key).
• AI coaching (Ethos · Logos) — your conversation content and attached images are sent to our server and to the AI processor (see “International transfers”) to generate coaching responses.

Personal data we collect

• Account (required): email, password (stored hashed with our authentication processor), display name, and an automatically generated unique tag.
• Social login (if used): email and profile information from providers such as Google, Kakao, or Apple.
• Collaboration (if used): room nickname/avatar and the room records, notices, feedback, and schedules you enter.
• AI coaching (if used): conversation content, attached images, usage (tokens/request counts), and safety-related signals.
• Payment (if used): information needed to process a subscription. Card and payment-instrument details are handled by the payment provider (including the app stores) and are not, as a rule, stored by us.
• Automatically collected: the minimum access/usage logs and device/app-version information needed to provide the Service and diagnose errors.

Why we process your data

We process your personal data on the following bases:

• Performance of a contract — creating and managing your account, providing collaboration and sync, and processing paid subscriptions.
• Consent — AI coaching (and the associated international transfer and any special-category data), and any non-essential cookies. You can withdraw consent at any time.
• Legitimate interests — service improvement, error diagnosis, security, and prevention of abuse, balanced against your rights.
• Legal obligation — retaining transaction/consumer records where the law requires it.

Who processes your data

We use the following processors under appropriate data-processing agreements. We do not sell your personal data, and we do not share it with third parties except with your consent or where required by law.

• Supabase — database & authentication (account and collaboration data).
• Railway — hosting for the AI-coaching server.
• Anthropic PBC — generating AI-coaching (LLM) responses (conversations/images); this is an international transfer (see §4).
• Vercel — hosting for our websites (homepage & support).

Transfers outside the EEA/UK

We are established in the Republic of Korea, so your data is processed in Korea. The European Commission has recognized Korea as providing an adequate level of data protection (adequacy decision of 17 December 2021), so transfers from the EEA to Korea do not require additional safeguards such as Standard Contractual Clauses.

If you use AI coaching, your conversation content and attached images are transferred to Anthropic PBC in the United States to generate responses. This onward transfer relies on Anthropic’s own transfer safeguards (Standard Contractual Clauses and/or the EU–US Data Privacy Framework). We ask for your consent before your first use of AI coaching, and you can decline — in which case AI coaching is unavailable but all other features work normally.

• Recipient: Anthropic PBC · Country: United States
• Data transferred: coaching conversation content and attached images
• Purpose: generating AI-coaching responses
• Storage region of our processors (Supabase/Railway): [to be confirmed and stated here]

Sensitive information

AI-coaching conversations may include special-category data (e.g. about health or mental health). We process such data only for coaching and safety purposes and only on the basis of your explicit consent, obtained before your first use of AI coaching. If you do not consent, coaching is unavailable but all other features work normally.

How long we keep data

We delete personal data without undue delay once its purpose is fulfilled or its retention period expires. Key retention periods:

• Account & collaboration data: deleted without undue delay when you close your account (subject to legal exceptions).
• Detailed AI-coaching usage records: automatically deleted 180 days after collection.
• Access/error logs: kept only as long as needed for security and incident response.
• Data with a statutory retention duty: kept, stored separately, for the period required by applicable consumer/e-commerce law, then deleted.

You can close your account directly in the app under Settings > Account; doing so deletes your linked personal data (the erasure right).

Cookies & similar technologies

Our websites may use cookies to keep you signed in, provide convenience, and gather basic usage statistics. In the EEA/UK we ask for consent before setting non-essential cookies, and you can refuse or delete cookies in your browser settings (some features such as sign-in may then be limited). Our desktop and mobile apps use secure device storage to keep your session and do not perform advertising tracking.

Your rights & how to exercise them

You (or your legal representative) may request access, rectification, erasure, restriction, portability, and object to processing, and you may withdraw consent at any time. You can correct account information and close your account (erasure) directly under Settings > Account; for other requests, contact us at the address below and we will respond within the period required by applicable law. We may verify your identity, and may limit a request where the law provides a basis to do so.

Depending on where you live, you may also have the right to complain to your local data protection authority.

Privacy contact / rights requests: support@knoriai.com

Children & young people

The Service is intended for users aged 14 and over, and we restrict sign-up below that age. The Service is not directed to children under 13, and we do not knowingly collect their personal data; if we learn that a user is under 13, we will restrict the account and delete the related data.

How we protect your data

We apply technical and organizational measures including encryption in transit (HTTPS), access control (row-level security and least privilege), local-data encryption, and end-to-end encryption for personal sync. Secrets such as AI API keys are never bundled into the app and are held only in server environment variables; access to personal data is limited to the minimum necessary personnel.

Data controller

Data controller: 노리에이아이 유한회사 · Representative: 김주현
Address: 경기도 파주시 조리읍 탑삭골길 128, 비동
Business registration number: 754-86-04029
Mail-order business registration: 제2026-경기파주-3165호
Contact: support@knoriai.com

Changes to this policy

We may update this policy as laws or the Service change. We will post the effective date and the changes on this page, announce material changes before they take effect, and, where necessary, obtain your consent again. The current effective date is 3 July 2026.