Cora reads and repaints colour on your phone. This page says what that means for your photos and your account. It describes what the app does today. If we change what it does, we will change this page first.
The short version
- You sign in to use Cora, with Google or with an email address and a password. That gives us a way to reach you about your account and tells us how many people use Cora.
- Your photos and colour versions sync to your own cloud storage so they follow you across devices. That storage is keyed to your account and reachable only through your sign-in.
- All colour work happens on your device. No photo is analysed on a server, no data is sold, and no photo is used to train any model.
What Cora uses on your device
- Camera. With your permission, so you can photograph a garment. Camera frames are processed on your device.
- Photos you choose. If you pick an existing photo, Cora reads it on your device to find and change its colour.
- On-device storage. Photos, versions, saved colours and your settings are stored in the browser's storage for this site. Cora works offline.
Cora asks for the camera only when you first use it. You can decline and still use the colour finder.
What we store when you sign in
You need an account to use Cora. When you create one, we store:
- Your email address, your name if you gave one, and, if you use Google sign-in, the identifier Google provides. Held in a database hosted by Hetzner in the European Union.
- Copies of your photos and their recoloured versions, uploaded in the background over an encrypted connection to object storage on Cloudflare R2 in the European Union, under a path that belongs to your account alone.
- Your saved colours, your settings, and a record of sign-ins (the sessions on your devices).
- Which link brought you to Cora, as a single word such as the name of a social network, if the link you followed carried one. It is held in a cookie for up to an hour while you sign in, stored once with your account, and the cookie is then removed. It identifies the link, not you.
We use your email to run your account, for example a password reset. Signing in does not put you on a mailing list. We send tips and updates about Cora by email only if you ticked the box that asks for them, which is off unless you turn it on. We store when you ticked it and the wording you agreed to. You can turn it off at any time in Settings, and we store when you did.
Anonymous usage counts
To know whether Cora is being used, the app records that a photo was processed, a colour was locked, or a recoloured photo was kept. Each is a count against a date and nothing more: no account, no device identifier, no IP address and no cookie is stored with it.
Steps in the app
While Cora is in beta, when you are signed in we record the main steps you take in the app with your account: taking a photo, picking a spot on it, locking a colour, keeping a recoloured photo, saving, sharing, which screens you open, the screen you were on when you left the app, and any error the app hits. With each step we keep a few short details, such as the colour name or where an error happened, and the time. We never record your photos this way or anything you type. We use it only to find where Cora is hard to use or broken, and we do not share it. We keep these steps for 90 days, then delete them.
What Cora does not do
- Analyse your photos on a server.
- Sell or share your data with anyone.
- Use your photos to train any model.
- Show advertising or include third-party tracking.
Deleting your data
- Any photo and its versions can be deleted inside Cora. That removes it from your device and from your account storage.
- To delete your account and everything held with it, email [contact address, CEO to set] from the address on the account. We will confirm when it is done. Self-serve account deletion is planned.
Your rights
If you are in the UK or the European Union you can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, by writing to the address above. You can also complain to your data protection authority.
Children
Cora is for general audiences. Accounts are intended for adults, and we do not knowingly collect personal data from children.
Who is responsible
The data controller is [legal entity name, Legal to confirm], [registered address]. Contact: [contact address, CEO to set].
Changes
If this page changes, the date at the top moves and any material change is described here. Effective date: [set on publish].