Privacy policy

7. Your information and privacy

• The short version: KoachOr has no ads, no analytics and no tracking code, and we don’t sell or rent anyone’s information. Information leaves your device only when you log in, save to your account, start or join a live session, reply to an announcement, send feedback or a part request, join the Pro waitlist, or open a link to another website, plus the small “KoachOr is open” signal described under “Running KoachOr” below.
• Without an account, your projects and settings stay in your browser, on your device (see Cookies and local storage below). We can’t see them.
• With an account, your email address and password are handled by Supabase, the service KoachOr uses for accounts and cloud saves. Supabase stores your password in a hashed form; we never see it. We store your email address, when you signed up and last logged in, the projects you save to your account (their names, contents and when they were saved), and whether your account has KoachOr Pro. We use this only to log you in, to open your projects on any device and to turn on what your account includes.
• Running KoachOr: the KoachOr team has a small admin screen (Dev mode) it uses to post announcements, read feedback and part requests, manage the Pro waitlist and see that the service is working. It shows:
  • how many accounts there are and how many were made this week, with each account’s email address, its nickname if you chose one, when it was made and when it last logged in, and which logged-in accounts used KoachOr in the last hour. The team can use this to send a private message to one account (for example, to answer your reply, your feedback or your part request); only that account sees it, and it never shows as an announcement;
  • how many people have KoachOr open right now, and, for people who are logged in, which accounts those are. An open page sends only that it is open, since when, and whether someone is logged in. It is counted under a random code that your browser replaces every day, so one day’s visit can’t be linked to the next; a logged-in page adds a second code that also changes every day, never your email. There is no record of where you go in the app;
  • replies people choose to send to an announcement, with the account email if they were logged in;
  • a copy of the feedback people send: the account’s email and nickname, the category, the message and when it was sent. The team can delete it;
  • the part requests people send: the account’s email and nickname, the part and the details given about it, when it was sent and what the team decided (waiting, planned, added or not planned). The team can delete them;
  • the accounts that can’t send feedback any more, each with the reason, which only the team sees;
  • the Pro waitlist: each account’s email, its nickname and when it joined. The team can copy the emails to write to the people on it, and take an entry off the list.
  It doesn’t show your projects, your code, what you click or what you build, and KoachOr doesn’t record any of that. Only the KoachOr team account can open this screen, it needs a separate password as well, and the database itself checks that every list in it is read by that account only. We use it to post updates, read your replies, answer questions and keep KoachOr running well, never for advertising, and we don’t share it with anyone.
• Logging in with Google, GitHub, Microsoft, Apple or Discord: if you choose one of these, that service tells KoachOr (through Supabase) your email address, your name and, if you have one, your profile picture. KoachOr uses them only to create your account, log you in and greet you by name. We don’t get your password for that service, we don’t ask for access to your files, contacts, calendar or anything else in it, and we don’t share what we receive with anyone. Information we receive from Google is used according to the Google API Services User Data Policy, including its Limited Use requirements. You can remove KoachOr’s access at any time in that service’s account settings, and ask us to delete your KoachOr account at support@koachor.com.
• Live sessions (Build together) send the changes you make to the bench, with the name you show in the session, through Supabase to the other people in that session as you make them. KoachOr doesn’t keep them after the session. Anyone with the session’s link or code can join, so share it only with people you trust.
• Share links hold the whole project inside the link itself. We don’t store a copy, but anyone you give the link to can open the project.
• Feedback needs you to be logged in with a Google account, so we reply to a real address and can keep spam out. When you send it, KoachOr’s database first checks that the account isn’t blocked from feedback and hasn’t sent 10 messages in the last hour, then keeps a copy (your email, nickname, the category, your message and the time) for the admin screen described above. It also goes to us by email through FormSubmit (formsubmit.co), with your email and nickname. If you tick the box for it, your KoachOr version, layout, theme, window size and browser go in the email too, so we can reproduce a problem; they aren’t kept in the database. If FormSubmit can’t be reached, Gmail or your own email app opens with the message ready to send instead.
• Private messages: when the team answers you privately (for example your reply, your feedback or your part request), the message is stored so that only your account can read it, and you can write back. Replies you send to an announcement without logging in carry no name; please don’t put personal details in them.
• Part requests (Request a part) work like feedback: you need to be logged in with Google, an account blocked from feedback can’t send them, and there’s a limit of 10 an hour. The request (your email, nickname, the part’s name, and the kind, maker, part number, link and note if you fill them in) is kept in the database so the team can see it in the admin screen and you can see what happened to your own requests. Nobody else can see them.
• Other services: Netlify hosts koachor.com and, like any web host, receives your IP address and browser details and keeps short-term server logs for security. KoachOr’s fonts and its 3D engine come from koachor.com itself. The code library that connects to Supabase comes from jsDelivr when the page opens, and a few other libraries come from jsDelivr only when you use the feature that needs them (such as opening a 3D or CAD file, the AR view or a 3D export), so jsDelivr receives your IP address and browser details. When you open the Log in window or a form that asks you to sign in with Google, Google’s sign-in button loads from Google, which receives your IP address and can recognise your Google account. Account emails (confirming your email address, resetting your password) are sent by Resend. Translations: announcements and messages from the KoachOr team come with translations the team makes with the translator built into its own browser, and when one has no translation for your language, your browser can translate it on your device if it has a built-in translator (such as Chrome’s). Either way, the text isn’t sent to any translation service; the browser may download a language pack from its maker the first time. These services may process information in the United States and other countries; where the law requires it, this relies on safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.
• Why we can use your information: to give you what you ask for when you use a feature that needs it, such as your account, cloud saves, live sessions, feedback and part requests (to provide the service); to keep KoachOr secure, stop spam and abuse, and know how many people use it (our legitimate interest in running KoachOr); and, only if you tick the box, to put your app details in a feedback email (your consent, which you can withdraw by not ticking it).
• Keeping it safe: everything travels encrypted (HTTPS). The database only lets each account read its own data, only the team account can read the lists described above, and koachor.com only runs its own code and the library versions it names. No system is perfectly secure: if you find a security problem, please tell us at support@koachor.com (without accessing other people’s data or disrupting KoachOr), and if a breach ever affects your information we will tell you as the law requires.
• Your rights: you can export your projects at any time, delete projects from your account in the app, and delete your whole account yourself (Your account → Account settings → Delete my account). Deleting your account also deletes what it sent: your feedback copies, part requests, replies to announcements, your place on the Pro waitlist and private messages to you. Email support@koachor.com from the address on your account to get a copy of, correct or delete your account and everything stored with it. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California) you may have further rights, including to complain to your data protection authority. We answer within 30 days.
• How long we keep things: your account and its projects until you delete them or ask us to delete your account; feedback, and its copy in the database, as long as we need it to answer you and fix what it reports; part requests until the part is added or we decide not to add it, or until you ask us to delete them; replies to announcements and private messages until the team deletes them or you delete your account; the list of accounts blocked from feedback until we lift the block; your place on the Pro waitlist until you leave it, Pro opens, or your account is deleted.
• Children: if you believe a child has given us personal information without the consent the law requires, email support@koachor.com and we will delete it.

8. Cookies and local storage

KoachOr doesn’t use advertising cookies, analytics or tracking of any kind, and doesn’t let other companies put them on koachor.com, so there is no cookie banner to click. Instead it uses your browser’s local storage, which works much like a cookie but is never sent to a server by itself, for what the app needs to work the way you set it:

• your projects and their autosave;
• your settings: language, theme, skill level, sound and music, units, snapping, the screen layout and options such as safety mode;
• your progress: lessons and tasks you have finished, and which update notes you have seen;
• your sign-in: when you log in, Supabase keeps your session here so you stay logged in, and logging out removes it;
• which announcements and messages you’ve seen or replied to, and when this browser first opened KoachOr (so new announcements reach you once);
• the random code, replaced every day, that counts this browser once in “how many people have KoachOr open”;
• a feedback message or part request you’re still writing, kept only in that tab while you log in with Google to send it.

To remove it all, clear your browser’s site data for koachor.com. That also removes the projects saved only in this browser, so export the ones you want to keep first (File → Export). If KoachOr ever starts using other cookies, we will update these terms first and ask you where the law requires it.

4. Your account

Accounts are optional: you can use KoachOr without one. Accounts are for people aged 13 or older; in some countries the minimum age is higher (16 in parts of the EU) unless a parent or guardian agrees. Younger students can use KoachOr without an account, or through an account a parent or teacher manages. Use a real email address, keep your password to yourself and tell us at support@koachor.com if you think someone else is using your account. You are responsible for what happens in your account.