Privacy Policy

1. Interpretation and Definitions

Account — a unique account created for You to access our Service.
Application — refers to Korus, the software program provided by the Company.
Company — Korus ("We", "Us", or "Our").
Country — Philippines.
Device — any device that can access the Service.
Group Collection — a shared collection owned by one user that other users may join via an invite code, granting read-only access to its songs.
Personal Data — any information that relates to an identified or identifiable individual.
Service — refers to the Korus Application.
You — the individual accessing or using the Service.

1A. Independent Application Notice

Korus is an independent application developed by a solo developer and is not affiliated with or endorsed by the Seventh-day Adventist Church or any of its affiliated organizations. Resources such as Adventist hymns included in the app are provided solely for reference, worship, and personal use.

2. What Data We Collect

2a. Account & Profile Data

Received from Google OAuth and stored in our cloud database:

User ID — a unique internal identifier assigned to your account
Email address
Full name
Profile picture URL
Authentication provider (Google)
Account created and last updated timestamps

2b. Email Communications Preference

When you create an account, your email updates preference is enabled by default. This allows the developer to occasionally send you app update announcements, new feature notices, or other relevant information to your registered email address.

You can turn this off at any time inside the app under More → Settings → Email Updates. Disabling it means you will no longer receive emails from the developer. This preference is synced to your account in the cloud.

2c. User-Generated Content

Content you create within the app is stored locally on your device and synced to our cloud:

Songs: title, artist name, lyrics content, created/updated timestamps, deletion flag
Collections: name, description, color, group status, invite code (if a Group Collection), created/updated timestamps
Group membership records: your user ID, display name, role (owner or member), and the date you joined a Group Collection
Favorites: list of song IDs you have marked as favorite
Attachments per song: uploaded image files (file URLs, upload timestamps), PDF files (file URL, upload timestamp), links (URL, display name, timestamp)
User configuration: theme preference, navigation setting, hymnal edition, hymnal view mode, email updates opt-in flag

This may include lyrics, notes, attachments, and other materials that may be subject to third-party intellectual property rights. We do not review, verify, or claim ownership of user-generated content.

2d. Group Collection Data & Visibility

When you join a Group Collection, your display name and membership role (member) are visible to the group owner and to other members of that group. When you own a Group Collection, your display name is shown to all members who have joined your collection. The songs, titles, artist names, and lyrics you add to a Group Collection are visible to all current members of that group.

By joining or owning a Group Collection, you acknowledge and consent to this data visibility. Members have read-only access to group content and cannot edit, delete, or add songs to a group they have joined.

2e. Subscription & Purchase Data

If you purchase a paid subscription (Plus plan), the transaction is processed by Google Play and managed by RevenueCat. We receive and store:

Your subscription plan tier (Free, Plus)
Subscription status (active or expired)
Purchase and expiration timestamps
A RevenueCat-assigned user identifier linked to your account

We do not receive or store your payment card details, billing address, or any financial information. All payment processing is handled exclusively by Google Play.

2f. Usage & Analytics Data (via Firebase Analytics)

Firebase Analytics automatically collects the following data when you use the app:

Data	Description
City, Region, Country	Approximate location inferred from IP address
Device model	e.g., Samsung Galaxy S23
Device category	Phone or tablet
OS version	Android version installed
App version	Korus build version number
Screen resolution	Display dimensions of your device
Language	Device language / locale setting
Network type	WiFi or cellular data
Session duration	Time spent in-app per session
First open	Timestamp of your first app launch
Retention	Day 1 / Day 7 / Day 30 return rate (aggregate cohort)
Age range	Inferred via Google Signals — aggregate only, if Google Signals is enabled
Gender	Inferred via Google Signals — aggregate only, if Google Signals is enabled

In addition, we collect usage events such as app opens, screen views, content creation and edits, attachment uploads and removals, hymnal interactions, and feature usage. Event parameters contain only non-sensitive data such as counts, hymnal edition identifiers, and hymn numbers. No email addresses, names, passwords, lyrics content, or file contents are ever included in any analytics event.

On Android 13 and later, Firebase Analytics may access the Android Advertising ID (GAID) for analytics attribution purposes (e.g., distinguishing new vs. returning users). This identifier is not used for advertising or cross-app tracking — it is used solely to improve the accuracy of aggregate usage analytics within Korus.

2g. Crash & Error Reports (via Firebase Crashlytics)

Non-fatal error messages and stack traces
Error context tag — a short label identifying the area of the app where the error occurred
Device model, OS version, and app version at the time of the error
Linked to your internal account identifier — your name or email is never included

2h. What We Do NOT Collect

Advertising identifiers for advertising or cross-app tracking purposes — the Android Advertising ID (GAID) may be accessed by Firebase Analytics solely for analytics attribution within Korus, not for ads or profiling
GPS or precise location data
Payment or financial information — this is handled exclusively by Google Play
Passwords — authentication is handled entirely by Google OAuth
The content of your lyrics, images, or PDFs is never sent to analytics or crash reporting services
Donation transactions — donations made via bank transfer or QR code are processed entirely outside of the app by your own banking application; we receive no data, confirmation, or tracking information from any donation

2i. Content Responsibility & Copyright

Korus allows users to store and access hymn lyrics, sheet music, and other related materials for personal, worship, and reference purposes.

Some content available through the app, including hymns and lyrics, may be protected by copyright and owned by their respective rights holders.

We do not claim ownership of third-party content. Users are responsible for ensuring that any content they upload, store, or share complies with applicable copyright laws.

If you are a copyright owner and believe that content within the app infringes your rights, please contact us at ronsell42@gmail.com and we will review and take appropriate action, including removal if necessary.

3. How We Use Your Data

Authenticate You and manage Your account.
Sync lyrics, collections, and preferences across devices.
Store and retrieve uploaded attachments (images, PDFs).
Display Your name and avatar within the app interface.
Manage user settings such as theme and hymnal preferences.
Enable Group Collections — display your display name and role to other group members as described in Section 2d.
Manage and validate your subscription tier and enforce plan-based usage limits.
Analyze aggregate usage patterns (via Firebase Analytics) to understand how the app is used and improve it over time.
Diagnose and fix non-fatal errors (via Firebase Crashlytics) to improve app stability.
Send you occasional app update announcements or feature notices by email, if you have opted in to email communications (enabled by default, can be disabled in Settings).

We may also use limited account and content metadata to investigate abuse, enforce our policies, and respond to legal or copyright-related requests.

We do not use your data for advertising, profiling, or sale to third parties.

4. Data Storage: Local vs. Cloud

Local storage (on your device): Your content and account profile are cached locally on your device for offline access. Signing out clears all local user data from your device.

Cloud storage: Account data, lyrics, collections, group membership records, subscription status, favorites, change history, and attachments are stored securely in our cloud. File access uses secure, time-limited access links.

On-demand content downloads: Hymnal sheet music is not bundled with the initial app download. It is downloaded separately from our cloud storage when you choose to view it, and cached locally on your device for offline use.

International data transfers: Your data may be processed and stored on servers located outside your country, including by our third-party service providers (Supabase, Google/Firebase, RevenueCat). By using the Service, you consent to this transfer.

5. Data Visibility & Access Policy

All data stored in our cloud — including your songs, collections, attachments, and account information — is stored securely with access controls that ensure only your account can access your own data through the app, except as described below for Group Collections.

Group Collection visibility: When you participate in a Group Collection (as owner or member), certain data — including song content, your display name, and membership role — is visible to other members of that group as described in Section 2d. This is an intentional and necessary part of the Group Collection feature.

We do not actively monitor, read, or review your personal content. Your lyrics, images, and files are stored solely for the purpose of providing and syncing the Service to you.

However, stored data — including user-generated content, account metadata, and usage logs — may be accessed, reviewed, or disclosed if required by law, court order, or other legitimate legal process. We will comply with valid legal requests and, where permitted by law, will notify you of such requests.

This may include reviewing specific content only when necessary to investigate abuse, enforce policies, or respond to valid legal or copyright requests.

6. Donations

Korus offers a voluntary donation option for users who wish to support the developer. Donations are entirely optional, not required, and do not unlock any features, premium access, or benefits of any kind.

Donation payments are made directly by the user through their own banking application or mobile wallet by scanning a QR code displayed within the app. These transactions occur entirely outside of Korus — the app does not process, receive, confirm, or track any payment information. No receipt, tracking, or confirmation is provided through the app.

We collect no data related to donations. Any transfer fees that apply are determined solely by the user's banking provider.

7. Third-Party Services

Korus uses the following third-party services:

Supabase — cloud database and file storage. See Supabase Privacy Policy.
Google OAuth — used for authentication. We receive email, name, and avatar URL. See Google Privacy Policy.
Firebase Analytics (Google LLC) — automatic and event-based usage analytics to help us understand and improve the app. See Google Privacy Policy.
Firebase Crashlytics (Google LLC) — crash and non-fatal error reporting for diagnosing app stability issues. See Google Privacy Policy.
RevenueCat — subscription management and billing middleware for the Plus subscription plan. RevenueCat communicates with Google Play on our behalf to validate and manage subscriptions. See RevenueCat Privacy Policy.
Google Play (Google LLC) — payment processing for paid subscription plans. See Google Privacy Policy.

8. Data Retention

In-app account deletion: When you delete your account via More → Settings → Delete Account, all your data — songs, collections, group membership records, favorites, attachments, storage files, subscription records, profile, and your Supabase authentication account — is permanently deleted immediately. This action is irreversible.
Residual data: Database backups or infrastructure logs managed by Supabase (our cloud provider) may retain traces of your data for a limited time per their own retention policies, independent of our deletion process.
Soft-deleted songs and collections (moved to Trash): retained for 7 days, then permanently removed.
Sync logs: cleaned up within 7 days once synced.
Group membership records: deleted when you leave a group, are removed by the owner, or delete your account.
Subscription data: retained per RevenueCat and Google Play's standard data retention policies.
Analytics and crash data: retained per Firebase / Google's standard data retention policies.

9. Your Rights

Delete individual songs, collections, and attachments within the app at any time.
Sign out of the app to immediately clear all local user data from your device.
Delete your account directly within the app — via More → Settings → Delete Account. This permanently and irreversibly removes:
- All your songs, collections, favorites, group membership records, and attachments from the cloud database
- All uploaded image and PDF files from cloud storage
- Your account profile and configuration
- All local data from your device
This includes your Supabase authentication account (your login credential), all cloud database records, all uploaded files in cloud storage, and all local data on your device. You will be asked to confirm your full name and acknowledge the action before deletion proceeds. This cannot be undone.
Leave any Group Collection you have joined at any time from within the app.
Disable email updates at any time via More → Settings → Email Updates.
Contact us at ronsell42@gmail.com for any additional data requests or questions about your data.

10. Security

All data transmitted over HTTPS.
Access controls ensure users can only access their own data, except for data explicitly shared through the Group Collection feature.
Attachments are served via secure, time-limited access links.
No plain-text passwords — authentication via Google OAuth only.
Group invite codes are alphanumeric and rate-limited to protect against brute-force enumeration.

We cannot guarantee absolute security of data transmission or storage.

11. Children's Privacy

Our Service requires users to sign in with a Google account and is intended for users aged 13 and older. We do not knowingly collect personal data from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will promptly delete that information.

While the app's content rating allows broad age access (3+), full use of the Service requires Google account authentication, which Google limits to users 13 and older per their Terms of Service.

12. Links to Other Websites

We may contain links to other websites not operated by Us. Review the privacy policies of any sites you visit. We assume no responsibility for third-party content or privacy practices.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updates are effective when posted on this page. Continued use of the Service after changes constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this Privacy Policy, please contact us:

By email: ronsell42@gmail.com

For copyright concerns or content removal requests, contact: ronsell42@gmail.com