Privacy Policy

1. Koiniva and This Policy

This is the privacy policy for Koiniva, available at koiniva.org. Koiniva is operated by Nikolas Rowland and Ian Zhao in New York, United States. Koiniva is an independently operated project and is not a nonprofit organization.

For privacy questions or requests, email contact@koiniva.org.

2. Information We Collect

We collect information you provide, information created through your use of Koiniva, and limited technical information needed to operate the service.

• Account information: email address, username, password hash or login method, account type, profile image, biography, and organization details you choose to provide.
• Event and participation information: events, registrations, check-ins, reviews, notifications, and calendar entries.
• Messages to the assistant: text you choose to submit to Koiniva’s AI assistant.
• Technical information: session cookies, request logs, device/browser information made available through standard web requests, and limited usage events for security and troubleshooting.

3. Google User Data

If you choose “Sign in with Google,” Koiniva requests only the standard openid, email, and profile permissions. Google may provide Koiniva with your Google account identifier, email address and email-verification status, display name, and profile picture.

How Koiniva accesses and uses Google user data

• We access this information during the Google OAuth sign-in process after you choose Google Sign-In and authorize the request.
• We use the Google OAuth response to authenticate you and your email address to find or create the correct Koiniva account, prevent duplicate accounts, and maintain your signed-in session. Koiniva does not use the Google account identifier for unrelated purposes.
• For a new account, we use your name and profile picture to prefill the signup form. You can review or change the information requested by that form before completing signup.
• We do not use Google user data for advertising, credit, employment, housing, insurance, or unrelated profiling.

How Google user data is stored

Koiniva stores the account information needed to provide your account, including your email address, login method, chosen username, and any name or profile picture saved during signup. Account data is stored in Koiniva’s hosted PostgreSQL database. Koiniva uses the Google access token temporarily to request your profile during sign-in and does not intentionally store Google access tokens or refresh tokens in its application database.

How Google user data is shared

Koiniva does not sell Google user data. We do not share it with advertisers. We disclose it only as needed to operate Koiniva through infrastructure providers such as Replit for application hosting and Neon for database hosting; when required by law; to protect users, Koiniva, or others; or as part of a transfer of Koiniva after providing legally required notice. Service providers process data on Koiniva’s behalf and are not authorized by Koiniva to use it for their own unrelated purposes.

Your username and profile picture may be visible to other Koiniva users where profile identity is part of the service, such as event participation or reviews. Your Google email address is not made public merely because you used Google Sign-In.

Koiniva’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

4. How We Use Other Information

• To create, authenticate, and maintain accounts.
• To connect volunteers with marine-conservation centers and events.
• To process registrations, check-ins, reminders, reviews, and account requests.
• To provide support and service-related communications.
• To secure, maintain, troubleshoot, and improve Koiniva.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell or rent personal information.

5. Other Sharing and Service Providers

Information may be visible to users when visibility is part of the service. Public event and organization pages may be available to anyone, organizers may see participants, and reviews may display a username and profile image.

Koiniva currently uses service providers including Replit for hosting, Neon for PostgreSQL database hosting, Google for optional sign-in and independently provided advertising services, OpenAI services provided through Replit for assistant messages, Private Email for service email, and Umami or Replit analytics for limited usage events. These providers may process information for Koiniva under their own terms and privacy practices.

6. Cookies

Koiniva uses a session cookie to keep users signed in and support account security. Hosting, analytics, Google Sign-In, and advertising providers may also use cookies or similar technologies. Limiting cookies in your browser may prevent parts of Koiniva from working.

7. Retention, Deletion, and Security

We retain account and Google-derived profile information while your Koiniva account is active and for only as long afterward as reasonably necessary for security, dispute resolution, legal compliance, and backup integrity. We do not retain Google access or refresh tokens in Koiniva’s application database.

You can delete your account from Settings. Google-account users confirm deletion by entering “DELETE”; a Google password is not required. Account deletion removes the account and associated Koiniva data from active application records. Residual copies may remain temporarily in restricted backups or logs until they rotate, unless longer retention is legally required. You can also request deletion by emailing contact@koiniva.org.

Deleting Koiniva data does not delete your Google account or information controlled independently by Google. You may also revoke Koiniva’s Google access through your Google Account permissions.

We use reasonable safeguards, including password hashing, access controls, and encrypted network connections. No internet service can guarantee complete security.

8. Your Choices and Rights

You may use Koiniva without Google Sign-In by creating a password-based account. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information. Update available account information in Settings or email contact@koiniva.org. We may need to verify your identity.

9. Children’s Privacy

Koiniva is not intended for children under 13, and we do not knowingly collect personal information from children under 13. Contact us if you believe a child under 13 provided information. Users under the age of legal majority should use the service with permission from a parent or guardian.

10. Policy Changes and User Notice

We will keep this policy current and update the “Last updated” date when it changes. If we materially change how Koiniva accesses, uses, stores, or shares Google user data or other personal information, we will provide a prominent in-product notice before or when the change takes effect. When appropriate, we may also notify account holders by email. If new consent is legally required, we will request it before applying the new use.

11. Contact

For privacy questions, access requests, or deletion requests, email contact@koiniva.org.