Privacy Policy

Controller and contact details

Mark Isayan, Avan, Kuchak 47 Building, Apartment 14, Yerevan, Armenia, is responsible for the personal information Kurobi processes. Send privacy, support, or rights requests to contact@devcraftsio.com.

Kurobi does not currently designate a separate data-protection officer or European or United Kingdom representative. If applicable law requires one, this Policy will be updated before Kurobi is intentionally offered in that jurisdiction.

Scope

This Policy applies to information processed through the Kurobi mobile application and related services. It does not govern independent processing by Apple or other third parties under their own consumer relationships and privacy policies, including Apple’s operation of the App Store, Apple Account, or Speech Recognition services.

Information we collect

• Account and identity information: an Apple authentication identifier; any name, email address, or private relay address Apple makes available based on your choices; a Kurobi or Supabase user identifier; and authentication and session information.
• Profile and onboarding information: belt level, training frequency, current note-taking method, onboarding status, starting positions, technique-familiarity ratings, favorites, exclusions, and practice preferences.
• Training and app content: drills, rolls, competitions, positions, transitions, perspective, repetitions, duration, quality, outcomes, problem signals, notes, timestamps, chat messages, and conversation titles.
• Audio and speech information: optional local audio notes, attachment metadata, transcription status, and resulting transcripts.
• Derived training information: progress stages, mastery estimates, gap signals, practice queues, and recommendation rankings. These are software estimates, not professional assessments or legally significant decisions.
• Purchase information: the Kurobi user identifier, App Store product and package identifiers, subscription and entitlement status, receipt or transaction information, renewal and expiration events, and localized offering information processed with Apple and RevenueCat.
• Technical information: app version, build, environment, platform, controlled product events, crash information, diagnostics, logs, performance traces, request timestamps, IP addresses, and security information.
• Support communications: your email address, message, attachments, and other information you choose to provide.

Local storage and cloud sync

Kurobi is offline-first. Training records and related app data are stored locally using WatermelonDB, while smaller settings and session information use platform storage. Signed-in user-owned records synchronize to Supabase when connectivity is available.

Recorded audio files stay in Kurobi’s app storage on your device and are not uploaded by Kurobi’s current synchronization service. Attachment metadata and resulting transcripts may synchronize with the training log. Because Kurobi permits server-based iOS speech recognition, audio may be sent to Apple for transcription depending on device capabilities and settings.

Removing an attachment may remove its reference without immediately deleting its underlying local file. Account-data cleanup attempts to delete files still referenced by local logs. You can deny or withdraw microphone and speech-recognition permission in iOS Settings without losing Kurobi’s non-audio features.

Analytics and diagnostics

Usage analytics and crash diagnostics are on by default. You can disable either one using its separate control in Kurobi’s profile settings.

While Share usage analytics is enabled, PostHog receives a Kurobi user identifier after sign-in and controlled events such as app and screen opens, onboarding steps, training-log actions, audio feature status, map interactions, recommendation actions, profile updates, and subscription-funnel events. Events may include app version, build, environment, platform, controlled screen or action names, and limited counts or categories.

Kurobi is designed not to send training-note text, audio, transcripts, technique or graph item identifiers, SensAI prompts or responses, opponent information, email addresses, or raw error messages to PostHog. Kurobi does not use PostHog for cross-app advertising tracking.

While Share crash diagnostics is enabled, Sentry may receive crash reports, performance traces, logs, breadcrumbs, app environment and version, device-related technical information, error categories, synchronization counts, and other diagnostic details. Default personally identifying information is disabled, but technical reports can sometimes contain incidental identifiers or information included in errors.

Sources and uses

We obtain information directly from you, from Apple through Sign in with Apple and App Store transactions, automatically from your use of Kurobi when the relevant optional control is enabled, from RevenueCat about subscription lifecycle and entitlement status, and by deriving training insights from your saved activity.

We use information to create and authenticate accounts; provide local storage and synchronization; save and display training records; calculate progress, gaps, and recommendations; provide SensAI and requested transcription; validate purchases; operate, troubleshoot, and secure Kurobi; respond to support; prevent misuse; enforce the Terms; and comply with law.

Where European Economic Area, United Kingdom, or similar law applies, the legal bases may be performance of the service you request, your consent, legitimate interests in proportionate product operation and security, or compliance with legal obligations. Account authentication is necessary to create an account. Other profile content, notes, audio, reviews, telemetry choices, and SensAI use are optional.

SensAI processing

When you submit a SensAI request, Kurobi sends Anthropic your prompt; approximately 12 recent user and assistant messages used as conversation context; relevant recent training logs, gap signals, notes, and ratings; graph positions and transitions with related names and derived stages or scores; and a system instruction defining SensAI’s limited role. The request travels through a Supabase Edge Function to Anthropic’s commercial API.

Kurobi tells you before the message input that your message and relevant training context will be sent to Anthropic. Sending after seeing that disclosure is your request for this processing. SensAI is optional, and choosing not to use it does not remove non-AI features.

Anthropic states that commercial API inputs and outputs are not used to train its generative models by default unless the customer opts in or submits relevant feedback, and that standard API inputs and outputs are generally deleted from its backend within 30 days, subject to contractual, safety, or legal exceptions. See Anthropic’s Privacy Center.

Kurobi separately stores chat history locally and synchronizes it to Supabase. The current app does not provide individual-chat deletion; you can remove saved history by deleting your account or requesting deletion at contact@devcraftsio.com.

How information is disclosed

We do not sell personal information, share it for cross-context behavioral advertising, or display third-party advertising. We disclose information to the following recipients only for the described purposes or where legally required:

• Supabase: authentication, database hosting, synchronization, and Edge Functions involving account identifiers, profiles, synchronized content, chat content, transcripts, preferences, and security data.
• Anthropic: SensAI prompts, limited chat and training context, notes, graph context, derived information, and generated responses.
• Apple: Sign in with Apple, App Store distribution and payment, subscriptions, permissions, and requested speech recognition under Apple’s own terms.
• RevenueCat: purchase validation and subscription entitlements involving user identifiers, receipts, transactions, products, offerings, and status. RevenueCat may send subscription lifecycle events associated with the same identifier to PostHog.
• PostHog: optional product analytics and subscription-funnel measurement.
• Sentry: optional crash reporting, performance monitoring, logging, and diagnostics.
• Professional advisers, authorities, or business transferees: where reasonably necessary, legally permitted, and subject to appropriate safeguards.

International transfers

Kurobi is operated from Armenia and uses providers that may process information in the United States, European Economic Area, United Kingdom, or other countries where they or their subprocessors operate. Where required, we rely on lawful transfer mechanisms such as adequacy decisions, contractual safeguards, standard contractual clauses or equivalent terms, and supplementary measures.

Retention

We retain information only as long as reasonably necessary to provide Kurobi, maintain security, resolve disputes, and meet legal obligations. Principal criteria include:

• Account, profile, synchronized training data, preferences, and chat: while the account remains active, then removed from Kurobi’s active Supabase user tables when account deletion succeeds.
• Local app data: while needed for offline use; account deletion resets the local user database and attempts to remove audio still referenced by local logs.
• SensAI API inputs and outputs: generally up to 30 days under Anthropic’s stated standard commercial API practice, subject to its exceptions; Kurobi’s saved copy remains until deleted as described here.
• PostHog analytics and Sentry diagnostics: according to Kurobi’s project configuration and operational needs, then deleted or aggregated. Resetting an analytics identity does not itself erase historical provider events.
• Subscription, support, legal, backup, and security records: for the applicable provider rotation, transaction integrity, request handling, fraud prevention, accounting, legal compliance, or dispute period.

Because fixed production PostHog and Sentry periods have not been adopted, Kurobi currently uses necessity and configured provider retention limits as the criteria. This Policy will be updated when specific production periods are adopted.

Security

We use reasonable administrative, technical, and organizational measures, including authenticated access, encrypted network transmission, row-level database controls intended to separate users’ records, secrets kept outside the mobile client, and restricted synchronization fields. No system is completely secure, so we cannot guarantee information will never be lost, corrupted, intercepted, or accessed without authorization.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent, receive portable information, appeal a denied request, or complain to a data-protection or consumer authority. Legal exceptions may apply, and we may need to verify your identity.

• Update supported profile information or delete individual training logs in Kurobi.
• Withdraw microphone or speech-recognition permission in iOS Settings.
• Enable or disable Share usage analytics under Profile → Privacy Choices.
• Enable or disable Share crash diagnostics under Profile → Privacy Choices.
• Manage or cancel subscriptions in Apple Account settings.
• Initiate account deletion under Profile → Delete profile.

Successful account deletion removes your Kurobi authentication account and the active Kurobi user data described above. It does not cancel an Apple subscription or automatically erase records independently controlled or lawfully retained by Apple and other providers. For broader access, correction, portability, restriction, objection, or deletion requests, email contact@devcraftsio.com.

United States state disclosures

For residents of California and other states with applicable comprehensive privacy laws, categories collected may include identifiers, customer records, commercial information, product interactions, audio you choose to record, training-related information, voluntarily submitted sensitive information, and inferences about progress and recommendations. We use and disclose these categories for the purposes described above, do not sell them or share them for cross-context behavioral advertising, and do not knowingly use sensitive information to infer characteristics for unrelated purposes.

Children and teenagers

Kurobi is not directed to children under 16, and we do not knowingly permit them to create accounts. If we learn that a user is under 16, we will take reasonable steps to delete the account and associated information. Users aged 16 or 17 need parental or guardian authorization where applicable law requires it.

Automated processing

Kurobi uses rules, scoring formulas, and AI systems to calculate mastery estimates, identify possible gaps, order practice suggestions, and generate SensAI text. These tools support your own training decisions and do not make solely automated decisions producing legal or similarly significant effects.

This website

This website has no contact form and does not intentionally set advertising cookies. Vercel may process ordinary infrastructure information such as IP address, request headers, and access logs to deliver and secure the site. If website analytics, forms, or additional cookies are added, this Policy will be updated.

Changes and contact

We may update this Policy when Kurobi, its providers, law, or data practices change. We will update the effective date and provide additional notice of material changes where required. We will not materially expand use of previously collected personal information without any notice or choice required by law.