Privacy Policy

1. Who we are

KORA is a real-time knowledge dueling platform where players compete in timed duels, track their performance, and appear on public leaderboards and profiles.

KORA is operated by Gabriel NDUWAYEZU, Bujumbura, Burundi, who is responsible for the personal data described in this policy. When this policy says "KORA", "we", or "us", it refers to that operator.

You can reach us at any time at contact@koraduel.com.

2. What we collect

When you create an account: your username, your email address, and your password — which we store only as a bcrypt hash, never in readable form. If you sign up with Google, we do not receive or store a password at all; we store the account identifier Google gives us, and the email address associated with your Google account at the moment you link it.

When you play: the duels you take part in, the answers you give to each question, how long you took to answer each one, your scores, wins and losses, your Elo rating and its history, your current and best win streaks, and which questions you have already been shown — so that we do not serve you the same question twice too soon.

When you use the social features: your friend requests and friendships, the players you have blocked — including whether you were friends before, so that unblocking can restore what was there — and the notifications sent to you, which keep a copy of the username a player had at the time.

While operating and securing the service: technical information such as browser type, timestamps, server logs and IP addresses. Verification and password-reset codes are held briefly in temporary storage and expire automatically.

If you play as a guest, without an account, nothing is recorded. Guest duels create no account, no rating, and no history.

3. Public profiles and leaderboards

KORA is a competitive product, and part of it is public by design. Your leaderboard entry and your player profile can be viewed by anyone on the internet, without an account, and can be indexed by search engines.

Publicly visible information includes:

• Your username
• Your Elo rating and peak Elo
• Your win rate and duel statistics
• Your Elo progression over time
• Your recent duels
• Your favourite category
• Your leaderboard position

Your email address, your password and your Google identity are never displayed publicly, and are never returned by any search or profile feature. Player search works on usernames only.

There is currently no way to hide a profile while keeping an account. If this matters to you, choose a username that does not identify you personally. You can change your username from your account, once every 30 days.

4. How we use your data

• To create and manage your account, and to verify that your email address is yours
• To run real-time duels and record their results
• To calculate and display Elo ratings, statistics and leaderboards
• To operate friendships, friend duels, blocking and notifications
• To send you service emails: verification codes, password resets, and account-related messages
• To keep the game fair and to prevent abuse
• To keep the platform running and secure, and to fix problems

We do not sell your personal information. We do not share it for advertising. We run no analytics service and no advertising network of any kind.

Where the law requires a legal basis for processing, ours is: performing the agreement between us, for everything necessary to give you an account and let you play; our legitimate interest in a secure, fair and functioning platform, for security, abuse prevention and technical operation; and your consent where you have given it.

5. Third-party services

We rely on the following providers to operate KORA:

KORA does not use Supabase Auth: sign-in and sessions are handled by our own application.

Our operator is based in Burundi and accesses this data from there, while the database is hosted in the European Union.

6. How long we keep your data, and how deletion works

We keep your account information for as long as your account exists.

You can ask us to delete your account at any time by writing to contact@koraduel.com from the address on the account.

What we do when you ask: we remove your username, your email address, and any linked Google identity, and we remove your name from the notifications other players received from you. Your account stops being identifiable, and your name disappears from the leaderboard and from profiles.

What remains, and why: the duels you played remain recorded, under a neutral name, without any link to you. A duel is not only your record — it is also the opponent's result, their rating history, and their replay. Erasing it would delete part of someone else's history. This is what deleting your account means on KORA, and we prefer to state it plainly rather than promise an erasure we cannot perform.

Some information may be kept longer where necessary for security, fraud prevention, or a legal obligation.

7. Cookies and browser storage

KORA uses no analytics service, no advertising network, and no tracking technology. We place no cookie of our own — for measurement, profiling, advertising, or anything else.

To keep you signed in, we store an authentication token in your browser's local storage. During sign-up and password reset, we temporarily store your email address and which step you have reached, in session storage, which is cleared when you close the tab. Neither ever contains your password or a verification code.

Our sign-in page loads a sign-in component provided by Google. Loading it lets Google receive your IP address and basic browser information, and place a cookie named g_stateon koraduel.com, which Google uses to manage the state of its sign-in prompt. If you are already signed in to a Google account, Google will also recognise you and may display your name and email address on that button — this happens inside Google's own component, before you click anything, and we receive none of it unless you choose to continue with Google. Where your browser allows third-party cookies, Google also reads and sets its own cookies on its own domains during this exchange.

Our sign-in page is the only page on KORA that loads anything from a third party. Our public pages — the leaderboard and player profiles — load nothing from anyone. The g_state cookie, once set, stays on koraduel.com as you browse.

Google's use of this data is governed by Google's own Privacy Policy: policies.google.com/privacy.

8. Security

Passwords are stored as bcrypt hashes and are never readable by us. All traffic is encrypted in transit. Our database is not reachable directly from the internet: it is protected by row-level security and reached only through our application.

Signing in issues a session token that is valid for 24 hours. We cannot currently revoke a token before it expires — so if you sign in on a device that is not yours, sign out, and be aware that changing your password does not immediately invalidate an existing session elsewhere.

No service can promise perfect security, and we do not.

9. Your rights

You may ask us to access, correct, or delete your personal data, to object to certain processing, or to receive a copy of your data. Write to contact@koraduel.com from the address on your account.

You can change your username yourself, once every 30 days, from your account. Changing your email address is not available in the app — write to us and we will do it.

Deletion works as described in section 6. Depending on where you live, you may also have the right to complain to your local data protection authority.

10. Minimum age and children

You must be at least 13 years old to use KORA. Where the law of your country sets a higher minimum age for using an online service, or for consenting to the processing of your personal data without a parent's involvement, that higher age applies to you instead.

When you create an account, you are asked to confirm that you meet the minimum age that applies to you. We do not ask for your date of birth, and we cannot verify your age.

If you are under 18, we recommend that a parent or guardian knows you play on KORA and is aware that your username, rating and duel history are visible to anyone.

KORA has no chat, no private messages, and no way for players to send each other text. The only interactions between players are duels, friend requests and blocks.

We do not knowingly collect personal data from children under 13. If you believe a child under 13 has an account, write to contact@koraduel.com and we will remove it, as described in section 6.

11. Changes to this policy

We will update this policy as KORA changes. The date at the top always reflects the current version, and significant changes will be communicated through the platform. Continuing to use KORA after an update means you accept the revised policy.