KOR / Privacy

KOR Privacy Policy

What data we process and why, how long we keep it, and how to delete your KOR identity.

Effective date 21 October 2026

This policy was written in Turkish; the English and Estonian versions are translations. If they differ, the Turkish text applies.

Summary

In short

  • KOR needs no account, email, name or SIM. Adding your phone number is optional, and your contacts are read only if you choose to match them; the names in your contacts never leave your phone.
  • We cannot read your messages; they are end-to-end encrypted between devices.
  • A chat is deleted from the devices and from our server when its chosen time runs out. We keep no chat history, backup or export, and we cannot bring back a chat that has ended.
  • We use no advertising, analytics or tracking tools. We do not sell data.

Company

Who we are

KOR is developed by AetherVortex OÜ. For questions, write to the email address below.

Company
AetherVortex OÜ
Registry code
17342466
Address
Juhkentali 8, Tallinn 10132, Estonia
Contact
info@aethervortexrecords.com

Data

Data we process

Installation identity. When the app first opens, a random KOR-ID and key pairs are created on your device. Our server stores the KOR-ID, a random installation reference, a random routing handle and the public keys. Private keys never leave your device. Your KOR-ID is never shown or shared in the app. Purpose: when a friend finds you by your nickname or your number and sends a request, and you accept it, messages can reach you. Kept: until you destroy your identity.

Nickname (optional). If you choose a nickname, the server stores it together with your KOR-ID and routing handle, so that a friend can find you by your exact nickname. There is no list and there are no suggestions. If you change or remove your nickname, the old one is not given to anyone else for 30 days (so that nobody can take your place). When you destroy your identity, your nickname is deleted and goes into the same 30-day hold.

Phone number (optional). If you add your number, the server does not store the number itself: it stores only a keyed hash of it (HMAC) together with your KOR-ID and routing handle, so that friends who have your number saved can find you. There is no SMS code or verification. If you change or remove your number, or destroy your identity, the record is deleted and the old hash is held for 30 days so that nobody else can take your number in that time.

Contacts matching (optional). When you tap “Match my contacts”, the app asks for permission to read your contacts and sends the phone numbers in it to our server once, to find which of them use KOR. The server compares their hashes with registered numbers and returns only the matches; the numbers you send are not stored or logged. The names in your contacts never leave your phone. Names of matched people are kept only on your phone, and only for your contacts and the requests you send.

Contact requests. Requests and acceptances wait on the server for at most 72 hours, encrypted to the recipient's key. The server cannot see their content (who sent them, or the nickname); it only sees which routing handle they go from and to. Accepted contacts are kept only on your device; there is no contact list on the server.

Abuse limits. For daily limits on requests, nickname lookups and contacts matching, a counter made of the routing handle and the date is kept for at most 2 days.

Chat record. When a chat is opened, the server stores the two routing handles, the chosen lifetime and the start time. Purpose: to deliver messages to the right recipient and to enforce the lifetime. Kept: until the chat's lifetime runs out.

Encrypted messages. Messages wait on the server in encrypted form until they are delivered or the chat's lifetime runs out. The key that could decrypt them is not on the server.

Encrypted attachments. Photos, PDFs and voice messages you send are encrypted on your phone before they leave it. So the other person can download them, the server keeps only the encrypted file, its size and when it must be deleted. The key that could open it is not on the server. Kept: until the chat's lifetime runs out; the file is then deleted within minutes.

Device check. To prevent abuse, Google Play Integrity checks that the app came from Google Play and that the device is intact. The verdict is processed only during the request and is not stored. This check is subject to Google's own terms.

IP address. To apply request limits, a salted hash of the IP address is held in memory for a short time; it is not written to disk. We have turned off server observability logs.

Notification ID. So we can tell you when a new message or request arrives while the app is closed, we store the ID that your phone's notification service gives KOR, encrypted. The notification carries no content, sender or chat details. Notification permission is optional, and the ID is deleted when you destroy your identity.

Not collected

Data we do not process

Email, name, location, advertising ID, usage analytics. We cannot see the photos, files or voice messages you send; they reach the server only encrypted. The names in your contacts and the numbers you send for matching are not stored on our server.

Deletion

Deleting your identity and data

KOR, the app developed by AetherVortex OÜ, has no account. What you can delete is the KOR identity the app created for you and the records linked to it. Deletion cannot be undone.

To delete it in the app

  1. On the Chats screen, tap the Identity button at the top right (in Turkish: Kimlik).
  2. Choose “Destroy KOR identity” (KOR kimliğini imha et).
  3. Confirm with “Destroy identity” (Kimliği imha et).

Deleted on the server

  • Your installation record: KOR-ID, installation reference, routing handle and public keys.
  • Your nickname. So that nobody can take your place, it is not given to anyone else for 30 days; during that time a hold record keeps only the nickname and your old KOR-ID, and that record is deleted when the hold ends.
  • Contact requests and acceptances to or from you that have not been delivered yet.
  • Your notification ID.
  • Your phone number record, if you added one. So that nobody can take your number, its hash is held for 30 days and then deleted.

Deleted on your device

Your identity, contacts (with the names from your contacts), your number, all chat keys and local chat records are deleted permanently. The next time you open the app, a new, empty identity is created.

Good to know

Chats end by themselves. When the chosen time runs out, the chat records and the content key on the device are destroyed, and the chat and queue records and encrypted attachments on the server are deleted. If you destroy your identity, the server records of your open chats are deleted when their time runs out at the latest.

Uninstalling the app deletes everything on the device. Your installation record and nickname on the server are deleted when you destroy your identity, so we recommend destroying your identity before you uninstall.

If there is no internet connection during deletion, the app tells you: the identity on the device is still destroyed, but the deletion request may not have reached the server. In that case, or if you can no longer use the app, write to us with your nickname or the number you added, and ask us to delete your record on the server.

There is no recovery: a deleted identity or chat cannot be brought back, and a new installation gets a new identity.

Request deletion by emailinfo@aethervortexrecords.com

Partial deletion

Deleting data without deleting your identity

In KOR, the app developed by AetherVortex OÜ, you can delete some of your data without destroying your identity. These steps are done in the app.

1. Delete or change your nickname

  1. On the Chats screen, tap the Contacts icon at the top right.
  2. In the “Your nickname” section, tap “Change”.
  3. Type a new nickname and tap “Save”, or choose “Remove nickname” to delete it.

Your nickname record on the server is deleted at once. So that nobody can take your place, the old nickname is not given to anyone else for 30 days; during that time a hold record keeps only the nickname and your KOR-ID, and only you can take the nickname back. When the 30 days end, that record is deleted too.

2. Remove or change your number

  1. On the Chats screen, tap the Contacts icon at the top right.
  2. In the “My number” section, tap “Change number”.
  3. Type a new number and tap “Save”, or choose “Remove number” to delete it.

Your number record on the server is deleted at once. So that nobody can take your number, its hash is held for 30 days, during which only you can add it back; then that record is deleted too.

3. Chats delete themselves

You do not need to do anything for a chat. When its chosen time runs out, the chat records and the content key on the phone are destroyed, and the chat record, any waiting encrypted messages and encrypted attachments on the server are deleted. A chat lasts at most 24 hours and cannot be extended.

4. Withdraw or decline a pending contact request

  1. On the Chats screen, tap the Contacts icon at the top right.
  2. To delete a request you received, tap “Decline” in the “Requests” section; to stop requests from that person, choose “Block”.
  3. To withdraw a request you sent, tap “Withdraw” in the “Requests you sent” section.

The other person is not notified when you decline. The server copy of a request you receive is deleted when it reaches your phone; declining deletes it from your phone too. A withdrawn request that has not been sent yet is never sent; if it has already reached the server it may still be delivered, and the server deletes it on delivery or after 72 hours at the latest. Your block list is kept only on your phone.

What is kept, and for how long

  • A released nickname: a 30-day hold record (nickname and KOR-ID), then deleted.
  • A removed number: a 30-day hold record (hash of the number and KOR-ID), then deleted.
  • Contact requests sent but not yet delivered: until delivery, at most 72 hours.
  • Abuse-limit counters (routing handle and date): at most 2 days.
  • Your notification ID (encrypted): until you destroy your identity or the app replaces it.
  • Your installation record (KOR-ID, installation reference, routing handle, public keys): until you destroy your identity; see “Deleting your identity and data” above.

Providers

Service providers

  • We use an infrastructure provider for the server and database; the data is kept in the European Union. The provider processes it only to run the service.
  • The app is distributed through Google Play, and the Play Integrity check is done by Google.

Limits

Honest limits

KOR aims to keep no data. However, we cannot delete the security records kept by your phone's operating system, Google Play, your network operator or our providers. The other person can photograph their screen with another device. We do not promise 100 percent anonymity.

Age

Age limit

KOR is designed for people aged 18 and over; it is not intended for anyone under 18.

GDPR

Your rights

Under the EU General Data Protection Regulation (GDPR) you have the right of access, rectification, erasure and objection. Because the data we keep on the server is not linked to your name, give your nickname or the number you added with any request.

Write to the address below, or contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Contact: info@aethervortexrecords.com

Updates

Changes

If we change this policy, we update its date; for important changes we also let you know in the app.

About KOR