Privacy Policy

1. Account and profile information

Koinovera intentionally minimises the account information it collects. Depending on how you sign in and use the service, account and profile information may include:

• an email address and an authentication-provider identifier;
• a username, display name, avatar URL, bio, and preferred language;
• profile and settings preferences, including appearance, accessibility, notification, contribution-visibility, and search-visibility choices; and
• an account role and contribution-related trust or reputation information.

Account information is different from personal information that may appear inside claims, evidence, cited sources, reports, appeals, or other user-generated material. Personal information handled through Koinovera is therefore not limited to the account fields listed above.

2. Authentication data

Koinovera uses an external identity provider to authenticate accounts. Auth0 is the current provider, with supported sign-in connections including Google, Apple, and passwordless email. The identity provider and the connection you choose process information needed to authenticate you under their own privacy practices. Koinovera may change identity providers in the future while continuing to use this provider-based approach.

Koinovera receives a provider identifier and, where supplied, account information such as an email address, display name, or avatar URL. It uses the provider identifier to associate the authenticated identity with a local Koinovera account. Koinovera’s current sign-in flow does not ask you to create, and Koinovera does not store, a Koinovera password.

3. Automatically processed technical data

When you use the service, Koinovera and its infrastructure necessarily process network and technical information needed to deliver requests. The API uses an IP address as a rate-limit identifier for public AI-assisted search requests. For signed-in contribution actions, rate-limit and safety records are generally associated with the local account.

Koinovera also creates timestamps for accounts, contributions, moderation events, and other actions. Operational logs may record error or security diagnostics and AI-operation metadata such as the operation, model, duration, usage, and whether it succeeded. The current application does not implement invasive device fingerprinting or off-platform surveillance.

4. User-generated and public content

Koinovera is a public, community-powered evidence platform. Public contributions may include claims, claim revisions, references and evidence, evidence explanations, source links and excerpts, reference ratings or aggregated rating counts, review notes, contribution attribution, and public trust or reputation indicators.

Public material can be seen, copied, quoted, or linked to by others. Do not submit sensitive personal information about yourself or another person unless it is necessary, lawful, and appropriate for a public evidence record.

5. Information about people who are not users

Claims, references, extracted source material, and other research contributions may contain information about identifiable people who do not have a Koinovera account. This may include public figures, company officers, authors, researchers, or people mentioned by cited publications.

This information arises from user contributions and source material used for evidence and research purposes. Koinovera does not intentionally build account-style profiles about people who are not users. A person concerned about personal information in a contribution or source record may contact Koinovera using the method at the end of this policy.

6. Claim revision history

Koinovera preserves claim revisions for transparency and research integrity. Changing current claim wording does not necessarily remove a historical version. Evidence remains linked to the exact revision it addressed, so earlier wording and its relationship to a source may continue to be publicly available.

7. Moderation, trust, and safety data

Koinovera processes reports, appeals and their outcomes, moderation actions, warnings and bans, reputation events, trust-level changes, rate-limit and user-action events, and abuse-detection signals. These records help enforce platform rules, protect users, maintain audit history, and resolve disputes.

Most internal moderation information is not public. Some outcomes or explanations may be shown to an affected user or on relevant public content. Automated or deterministic abuse signals are indicators for safety review and are not proof of wrongdoing. Koinovera does not publish internal detection thresholds or other security-sensitive details.

8. AI processing

OpenRouter is currently Koinovera’s AI integration layer. Where an AI-assisted feature is used, only content relevant to providing that feature may be processed by OpenRouter and the configured model provider.

Depending on the feature, this content may include search text, claim text and descriptions, source text, source excerpts or chunks, source metadata, and evidence context. Koinovera uses this processing for claim clarity and specificity assessment, semantic search, duplicate detection and suggestions, source processing, source and chunk embeddings, stance suggestions, evidence retrieval and passage assistance, and claim summaries.

AI does not determine truth, and its output may be incomplete or inaccurate. Not every piece of account or user data is sent to an AI provider. This policy does not claim that personal data is used to train external models; the current provider’s terms and privacy practices govern any provider-side processing.

9. Why information is processed

Koinovera processes information to:

• operate the service, authenticate users, and maintain local accounts and preferences;
• publish contributions and preserve claim and evidence revision context;
• provide search, evidence organisation, source extraction, ratings, review notes, summaries, and other research functionality;
• calculate and display contribution-based reputation and trust indicators;
• prevent abuse, apply rate limits, moderate content, review reports, and handle eligible appeals;
• provide AI-assisted features requested through the product; and
• secure, debug, maintain, and improve the reliability of Koinovera.

10. Sharing and service providers

Information is shared only as reasonably necessary with categories of recipients such as:

• the authentication provider—currently Auth0—and the sign-in connection selected by the user, such as Google or Apple;
• production hosting, network, and database infrastructure providers that run the service;
• Cloudflare, whose R2 storage service currently stores private, encrypted production database backups for disaster recovery;
• OpenRouter and configured model providers used for AI-assisted features;
• authorised moderators, administrators, and service operators who need information to review safety issues or operate Koinovera; and
• courts, regulators, law enforcement, or other parties where disclosure is legally required or reasonably necessary to protect rights, safety, and the service.

Public contributions are also shared with anyone who accesses Koinovera. A linked third-party source receives ordinary web-request information when you choose to follow its link.

Source websites

When you ask Koinovera to preview, prepare, or reprocess a source URL, the service contacts that third-party website. The website receives ordinary request information from Koinovera’s infrastructure. Koinovera may store fetched source metadata, extracted text passages, document identifiers, and processing results so it can present the evidence, detect duplicates, retrieve relevant passages, and support summaries or stance suggestions.

11. Selling personal information

Koinovera does not sell personal information to data brokers.

12. Cookies and browser storage

Koinovera’s current web application stores authentication session material and display preferences in local storage. It stores an in-progress claim draft in session storage so the draft can survive navigation within the browser session. These stores remain on the device until they expire or are removed by the application, the authentication provider, the browser, or you.

Auth0 and a chosen sign-in connection may use cookies or similar storage on their own domains to complete authentication and protect sessions. The current Koinovera frontend does not include advertising cookies or analytics trackers.

13. Data retention

Koinovera generally aims to use the following retention periods. These are operational targets rather than a promise that every category is deleted automatically at an exact age; some cleanup processes may not yet be automated. Retention may vary where information is required for an active moderation, security, legal, or dispute-resolution matter.

• active account and profile information: while the account exists;
• deleted-account personal identity information: removed or anonymised as part of the account-deletion process;
• public research contributions: potentially long term where needed for evidence and research integrity;
• claim revisions: potentially long term while the claim and its history are retained;
• evidence and references: potentially long term while relevant to the platform;
• ordinary operational and security logs: approximately 30 days;
• IP addresses and security request data: approximately 30 days, unless needed for an active security investigation;
• rate-limit and user-action events: approximately 90 days;
• abuse-detection signals: approximately 12 months, unless needed longer for an active safety matter;
• reports and appeals: approximately 24 months;
• moderation audit information: approximately 24 months, or longer where reasonably necessary;
• local database backups: approximately 7 days; and
• Cloudflare R2 database backups: up to approximately 90 days.

14. Account deletion and anonymisation

When Koinovera completes a valid account-deletion request, its policy is to remove authentication-provider identifiers and identity associations, the email address, and directly identifying profile information such as the username, display name, avatar URL, and bio. User-specific settings are removed or reset where they are no longer needed, other directly identifying account information is removed, and the deleted account can no longer be used to sign in.

Public research contributions may be retained where necessary to preserve claim history, evidence integrity, revision history, and community context. Retained contributions are anonymised or de-identified in the application and attributed to a generic identity such as “Deleted user” rather than the former profile. Historical claim revisions may likewise remain without publicly identifying the deleted user.

How the categories are treated

• Account and personal identity data: deleted or anonymised as part of account deletion.
• Public research contributions: may be retained, but their account attribution is anonymised.
• Historical claim revisions: may remain for transparency and research integrity without identifying the deleted profile.
• Backups: older copies may remain until the relevant disaster-recovery backup expires.

Account deletion is distinct from handling personal information written inside a claim, evidence explanation, excerpt, or other research record. A request concerning information within research content may need to be assessed separately against research-integrity, safety, legal, and other users’ rights.

Some moderation or security information may need to be retained to prevent abuse, enforce platform rules, resolve disputes, protect the service, or meet legal obligations. Koinovera’s direction is to remove or anonymise identifying information when it is no longer necessary, rather than retaining account PII indefinitely.

15. Backups

Production database backups are stored privately and encrypted using Cloudflare R2, the current cloud backup and storage provider. Backups may temporarily contain personal information that existed in the production database when the backup was created. They are retained for disaster recovery and are not intended for normal application access.

Local database backups are generally retained for approximately 7 days. Cloudflare R2 database backups may be retained for up to approximately 90 days. Information deleted or changed in the live service, including information removed during account deletion, may therefore remain in an older backup until that backup expires. Koinovera does not promise immediate removal from historical disaster-recovery backups.

16. Security

Koinovera uses technical and organisational measures designed to protect information, including authenticated access controls, limited public data responses, and private encrypted backup storage. No system or transmission method is completely secure, and Koinovera cannot guarantee absolute security or that every attempted intrusion will be prevented.

17. Your choices and rights

Available account tools allow signed-in users to update certain profile details and account preferences. You may contact Koinovera to ask for access to account information, correction of inaccurate personal information, account deletion, help with a privacy concern, or another data right available under applicable law.

Some requests may be limited by public research-integrity records, other people’s rights, safety needs, or legal obligations. Depending on where you live, applicable law may provide additional privacy rights.

18. International processing

Koinovera and its authentication, infrastructure, backup-storage, and AI service providers may process information in countries other than the one where you live. Privacy protections and government-access rules may differ between countries.

19. Children’s privacy

Koinovera is not designed specifically for children. A person should not create an account or provide personal information if they cannot lawfully consent to the relevant processing or agree to the service terms where they live. If you believe a child has provided personal information inappropriately, raise the concern through the privacy contact described below.

20. Changes to this Privacy Policy

This policy may be updated to reflect changes to Koinovera, its service providers, or legal requirements. Material changes may be accompanied by an updated effective date and, where appropriate, notice through the service.

21. Contact

For legal or privacy questions, email [email protected].