Privacy Policy

Who we are

Koro (korotrade.com) is run by TK Labs (“we”, “us”). We are the controller of the personal data described here. Questions or requests: support@korotrade.com.

What we collect

• •Account: your email address and sign-in records. Sign-in uses one-time codes and links; we don’t store passwords.
• •Exchange connections: Hyperliquid wallet addresses you add, and read-only API keys for Binance, Bybit and Bitget. API keys are encrypted (AES-256-GCM), are never shown again after you save them, and are never sent back to your browser.
• •Trading data from your exchanges: fills, fees, funding payments and related account data, plus the positions and stats we compute from them.
• •What you write: journal entries, trade plans, strategies, rules, tags, daily notes, screenshots, chart layouts, watches and alerts.
• •Ask Koro: the questions you ask, the answers and reviews Koro writes, and how often you use it.
• •Sharing: the share links you create and what each one shows.
• •Billing: your plan, trial and subscription status. Paddle handles payment details; we never see or store your card.
• •Technical data: IP address, browser and device details, and request logs, used to run, secure and rate-limit the service.

Exchange access is read-only

Koro only reads from your exchanges. We reject API keys that can trade, withdraw or transfer, and we check the key’s permissions again on every sync. Koro cannot place orders or move your funds.

Why we use it

• •To run Koro (performing our contract with you): sync your trades, build your journal and stats, answer Ask Koro, send sign-in codes and alerts you turned on.
• •To bill you (contract and legal obligations): through Paddle, our reseller.
• •To keep Koro safe and working (legitimate interests): prevent abuse, fix bugs, and understand load and errors.
• •To email you about your account (contract or legitimate interests): sign-in, billing and important service changes. Any marketing email is opt-in and has an unsubscribe link.

We don’t sell your data, and we don’t use it for advertising.

Ask Koro and AI

Ask Koro sends your question and the trade data Koro computed from your account to Anthropic (the Claude model) to write the answer. Your journal entries and notes are only included if you allow it. Anthropic processes this data on our behalf and, under its commercial terms, does not use it to train its models. Neither do we.

Who processes your data

We use these service providers. Each one only gets what it needs to do its job.

• •Vercel: hosts the website and app (functions run in Singapore).
• •Supabase: database, sign-in and file storage.
• •Anthropic: the AI model behind Ask Koro.
• •Resend: sends sign-in codes, alerts and account emails.
• •Paddle: checkout, payments, invoices and sales tax. Paddle is the merchant of record and processes your payment data under its own privacy policy.

We also read public market data from exchanges (prices, funding, open interest). That data isn’t about you.

We may disclose data if the law requires it, or to a successor if Koro is sold or merged, under the same protections.

International transfers

Our providers may process data outside your country, including in Singapore, the United States and other countries where they operate. Where the law requires, we rely on safeguards such as the EU Standard Contractual Clauses.

Sharing links

A share link shows only what you chose to share, to anyone who has the link. You can turn a link off at any time.

Cookies

We use cookies to keep you signed in and to remember settings such as your theme. We don’t use advertising or cross-site tracking cookies.

How long we keep it

• •Account, exchange and journal data: while your account is open.
• •When you delete your account: removed right away from our live database; backups roll off within 30 days.
• •Request and error logs: up to 30 days.
• •Billing records: as long as tax and accounting law requires (kept by Paddle and, where needed, by us).

Delete your account

Go to Settings → Delete account. This deletes your account, connections, encrypted keys, imported trades, journal, strategies, tags, notes and screenshots. It can’t be undone. You can also remove a single exchange connection at any time.

Your rights

Depending on where you live (including the EU, UK and similar laws elsewhere), you can:

• •Access the personal data we hold about you and get a copy.
• •Correct data that is wrong.
• •Delete your data.
• •Object to or restrict some uses of it.
• •Take your data elsewhere (portability).
• •Withdraw consent where we rely on it, such as sending journal notes to Ask Koro.
• •Complain to your local data protection authority.

Email support@korotrade.com to use any of these rights. We reply within 30 days.

Security

Data is encrypted in transit. Exchange API keys are encrypted at rest and kept in a store only our sync service can read. Every user’s data is isolated by row-level security. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.

Children

Koro is not for anyone under 18. We don’t knowingly collect data from children.

Changes

If we change this policy, we’ll update the date above. For important changes, we’ll email you before they take effect.