KoraUpPrivacy Policy
Who we are & who is responsible
KoraUp is a football companion app (scores, fixtures, line-ups, tables, news) for iOS and Android, published from Morocco by the owner of kora-up.com, who is the data controller. This policy explains what we collect, why, who we share it with, and your rights. Contact: contact@kora-up.com.
What we collect
We never ask for your name, email, phone number or location. On first launch an anonymous account (random id + access token) is created so we can keep your notification center. We also store: your device push token (Expo Push Token) if you allow notifications, your favorite teams and leagues, followed matches and alert preferences (to send you the right notifications), your interface language (to notify you in your language) and the platform (iOS/Android). Time zone and theme stay on your device only.
Technical data & server logs
Like any internet service, our server receives with each request your IP address, device and browser or app identification (User-Agent), the requested URL and the time of the request. We use these only to run and protect the service: rate limiting to prevent abuse, troubleshooting, and attack mitigation through Cloudflare. They are not linked to your anonymous account and are not used to profile you; they stay for a short period in our hosting and security providers’ logs and are then deleted automatically under their policies.
Why we use it
Only to run app features: goal and kick-off notifications for your teams, a copy of each notification in the in-app center, and favorites first. We do not use your data for advertising, do not sell it and do not build profiles.
Legal basis for processing
We process your data on the basis of: performance of the service you asked for (keeping your favorites and notification center), your consent (notifications, which you can withdraw at any time in the app or in your device settings), our legitimate interest in protecting the service against abuse and failures (technical logs), and legal obligation where a lawful request exists. This mapping follows Article 6 GDPR and Moroccan law 09-08.
Advertising, analytics & cookies
The app contains no ads and no analytics or tracking SDKs. The kora-up.com website is made of static pages with no cookies and no analytics, which is why you see no consent banner. One exception: the site loads the Cairo font from Google Fonts, which means Google receives the visitor IP address while the font is fetched. If we add crash reporting or anonymous analytics later, we will update this policy first.
Who we share data with
Only with processors working on our behalf: Expo Push Service to deliver notifications (receives the device token and notification text and passes it to Apple APNs or Google FCM depending on your platform), Railway for server and database hosting, and Cloudflare for security and networking. Match data is fetched from a sports data provider by our server; nothing about you is sent to it. News is shown as headlines and summaries with a link to the original source; opening an article uses your device browser under the source site’s policy. We never sell your data and never share it with advertisers.
Where your data is stored
Our server and database are hosted by Railway in data centres outside Morocco, Cloudflare operates a global network, and the push service together with APNs and FCM operate from the United States. Your data may therefore be processed in countries whose data protection laws differ from those of your country. We choose established providers with recognised protection standards and keep the data to a minimum.
Legal disclosure
We may have to disclose information if a competent judicial or administrative authority lawfully requires it, where necessary to defend our rights, to prevent fraud or abuse, or to protect user safety. In every case we disclose the minimum necessary.
Retention
Notifications in the notification center are deleted automatically after 30 days and you can clear them anytime. The anonymous account, device token and favorites are kept while the app is in use, are deleted immediately when you delete your account, and are deleted automatically after 12 months of inactivity. Technical logs are kept for a short period by our hosting and security providers.
Deleting your data (right to erasure)
In the app: More → Delete my account & data. This immediately deletes from our server the anonymous account, device token, favorites, alerts and all notifications, and clears the app data on your device. Full details and alternatives on the account & data deletion page.
Your rights
You have the right to access your data, rectify it, erase it, object to processing, restrict processing, port your data, and withdraw consent at any time. Because the account is anonymous and we hold no name or email for you, most of these rights are exercised directly in the app: edit favorites, turn notifications off, clear the notification center, or delete the account entirely. For anything else, email us. If our answer does not satisfy you, you may complain to the CNDP in Morocco or to the data protection authority of your country if you are in the European Union.
Security
All traffic to our server is encrypted (HTTPS), access tokens are stored hashed in the database and cannot be recovered, and database access is restricted. That said, no method of transmission over the internet or of electronic storage is 100% secure; we take reasonable measures but cannot guarantee absolute security.
Links to other sites
The app and the website link to sites we do not operate (news sources, club and league sites, app stores). We are not responsible for their content or their privacy practices, and we recommend reading the policy of every site you visit.
Children
The app is intended for general football fans and not for children under 13; we do not knowingly collect data from them. If we learn that a child’s data reached us we will delete it immediately; please contact us if you are a parent and notice this.
Changes
We may update this policy; the new version will be published here with its date. For any material change we will notify you in the app. Continued use of the app after an update means you accept it.
Contact
For any question or request about your data, email contact@kora-up.com. We usually reply within 7 days and within 30 days at the latest.