Privacy Policy

1. Scope and operator

This policy covers the Koala website at usekoala.app and www.usekoala.app, the interactive browser demo, the Koala macOS app, purchase and licence delivery, and support.

Koala is operated by MadeofIA, based in Brazil. For privacy, rights and support requests, contact hello@usekoala.app.

2. Data kept by the Mac app

Koala does not require a Koala account. In the current release, notes, rich text and attached images are stored on your Mac in the app's Application Support folder. The app does not send note content to Koala servers as part of normal note-taking.

When you export a backup, Koala writes a ZIP archive to the location you choose. The archive contains your notes, formatting, images and note metadata. It excludes the licence and secrets. Copies of that archive are under your control and remain wherever you save them.

After you activate a licence, the signed licence file is verified offline and stored in the macOS Keychain. The app does not send your notes as part of that verification.

3. iCloud status

iCloud and CloudKit sync are unavailable in this release. Koala does not upload your notes to iCloud through the current release. If sync becomes available later, we will update this policy and the product information before relying on it.

4. Website and browser demo

The site is hosted through Cloudflare. Cloudflare may process technical request information, such as an IP address, browser and device details, requested URL, and request time, to deliver and protect the site and its Worker services. Cloudflare's own terms and privacy policy apply to that processing.

The browser demo stores its notes in the browser's local storage for this site. Demo note content stays in that browser and is not sent to Koala. If browser storage is unavailable, changes last only for the current session.

The current Koala site has no account system, advertising, product analytics or third-party tracking script. The demo is a browser preview and does not run the native macOS app, native file handling or iCloud sync.

5. Purchases and licence delivery

When sales are enabled, checkout is hosted by Stripe. Stripe collects payment and billing information under its own privacy policy. MadeofIA receives the email and limited purchase information needed to confirm payment and deliver a licence.

After an eligible payment, our fulfilment service creates a signed Koala licence and sends it through Cloudflare Email Service to the email address used at checkout. Cloudflare receives that address and the licence attachment so it can deliver the message. Koala does not receive full card numbers, and customer note content is not included in checkout or licence delivery.

A purchase is complete only after Stripe confirms payment. The site may keep sales unavailable while payment and delivery are being prepared.

6. Support messages

If you email support or ask for a privacy request, we process the address, message and information you choose to include so we can respond, investigate the request and meet legal or security obligations. Please do not send note backups or other sensitive material unless it is needed for the request.

7. Controller, purposes and legal bases

MadeofIA is the controller for website, purchase, licence-delivery and support information that it handles for Koala. Depending on the context and applicable law, we use information to perform a contract or take steps requested before a contract, to meet legal obligations, and for legitimate interests such as site security, fraud prevention, service reliability and responding to requests. We ask for consent only where the law requires it.

• To host and secure the website, purchase service and browser demo.
• To confirm a purchase and deliver a signed licence when sales are available.
• To answer support, privacy and rights requests.
• To prevent abuse, investigate failures and comply with applicable law.

We do not use Koala note content for advertising or model training. The native app has no product analytics in this release.

8. Service providers

Koala uses service providers for specific functions. MadeofIA remains responsible for its own handling of personal information; a provider's separate policy does not replace this policy or our obligations to you.

• Cloudflare hosts the static site and Worker services and may process technical traffic data.
• Stripe hosts checkout and processes payment information.
• Cloudflare delivers licence email when the fulfilment service is configured.

We may disclose information where required by law or a valid request from a competent authority. Koala does not sell personal information.

9. Storage, retention and international processing

Local notes and user-created backups remain on the Mac, browser or storage location chosen by you until you delete or overwrite them. Clearing the Koala demo's site data removes the copy held by that browser, subject to the browser's own recovery and backup behaviour.

MadeofIA keeps website, purchase and support records only for as long as needed for the purpose collected, to resolve a request or dispute, to protect the service, or to meet legal and accounting obligations. The period depends on the type of record and the circumstances; when it is no longer needed, we delete or anonymise it, except for records we must retain to meet a legal obligation. Cloudflare and Stripe may process information outside Brazil as service providers, subject to the arrangements and laws that apply to that processing.

10. Your rights

Where applicable law gives you rights over personal information, you may ask for confirmation and access, correction, deletion, information about sharing and portability. You may also object to processing based on a legitimate interest and withdraw consent where processing relies on consent. Email hello@usekoala.app with enough information for us to understand the request. We may verify identity before acting and will handle the request under the applicable law.

If the LGPD applies, you may complain to Brazil's data protection authority (ANPD); see also the LGPD text. If the GDPR or UK GDPR applies, you may contact your local data protection supervisory authority.

11. Security

Koala uses local files for notes, the macOS Keychain for an activated licence, and provider security controls for hosted services. No system is completely secure. Keep independent backups of notes you cannot replace and contact us promptly if you believe a licence or support message has been misused.

12. Changes and contact

We may update this policy when Koala's data practices change or when clarification is needed. The date at the top identifies the current version. If a change is material, we will provide notice where a reasonable method is available.

MadeofIA, operator of Koala, based in Brazil.
Privacy, rights and support: hello@usekoala.app