Privacy Policy

We collect the following categories of information:

• Account information — your name, email address, password (or your Google account identifier if you sign in with Google), and profile photo.
• Organization & workspace content — anything you or your team create inside Kokar: tasks, projects, documents, chat messages, comments, forms, files and attachments you upload, and similar content.
• Payment information — when you subscribe to a paid plan, our payment processor (Nass) collects your payment details directly. We only receive confirmation of payment and basic transaction metadata, not your full card or account number.
• Usage & device data — IP address, browser type, device type, operating system, pages/features used, and similar diagnostic and log data, collected automatically when you use the Service.
• Cookies and similar technologies — see §3 below.
• Communications — if you contact support@kokar.krd, we keep a record of that conversation so we can help you and follow up.

We use the information we collect to:

• Provide, operate, and maintain the Service (e.g. keeping your tasks, docs, and chats in sync in real time).
• Create and secure your account, and authenticate you (including via Google sign-in).
• Process payments and manage your subscription.
• Send you service-related communications — account notifications, security alerts, and replies to support requests.
• Understand how the Service is used so we can fix problems and improve it (see §3, Analytics).
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with our legal obligations.

We use essential cookies to keep you signed in and to remember basic preferences (like your theme or language). These can't be switched off without breaking core functionality of the Service.

We use, or intend to use, PostHog as our product analytics tool, to understand how people use Kokar (for example, which features are used and how often) so we can improve it. PostHog may set analytics cookies or use similar identifiers for this purpose. We do not use analytics to sell your data or show you third-party ads — Kokar has no advertising.

You can control cookies through your browser settings. Blocking essential cookies will likely prevent you from signing in or using parts of the Service.

We do not sell your personal data. We share information only with the service providers we rely on to run Kokar, and only to the extent needed for them to perform their function for us:

• Convex — our database and real-time backend infrastructure (stores your workspace data).
• Cloudflare — file and attachment storage (R2), and content delivery.
• Vercel — application hosting.
• Google — authentication, if you choose to sign in with Google.
• Stream (GetStream.io) — powers audio/video calls; call metadata and media pass through their infrastructure while a call is active.
• Nass — payment processing for paid subscriptions.
• PostHog — product analytics (see §3).
• Our email delivery provider — for transactional emails (verification, notifications).

Some of the service providers listed above operate infrastructure outside Iraq. This means your information may be processed on servers located in other countries, which may have different data protection standards than the Kurdistan Region/Iraq. Where that happens, we choose providers that maintain appropriate security and confidentiality commitments, and we only share what's needed for them to provide their service to us.

We keep your account and workspace data for as long as your account or organization is active, so the Service keeps working the way you expect.

Kokar does not use automatic subscription renewal. If a subscription period ends without renewal, we immediately freeze the organization's access — every member is locked out of taking actions in that workspace until the subscription is renewed. Freezing is not deletion: your data is preserved as-is while frozen, and access is fully restored as soon as the organization renews.

If you delete your account, or ask us to (support@kokar.krd), we delete or anonymize your personal data within a reasonable period, except where we're required to keep it for legal, security, or accounting reasons.

Wherever you're located, you can ask us to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your personal data (subject to the retention exceptions in §6).
• Export a copy of your data.
• Withdraw consent, where we rely on consent (e.g. optional analytics), without affecting the lawfulness of processing before withdrawal.

We use reasonable technical and organizational measures — such as encryption in transit, access controls, and relying on reputable infrastructure providers — to protect your information. No method of transmission or storage is 100% secure, so we can't guarantee absolute security, but we work to keep your data safe and will notify affected users if we become aware of a breach that puts their data at risk.

The Service is not directed at, and may not be used by, anyone under 16 years old. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact support@kokar.krd and we will delete it.

The Service may link to, or integrate with, third-party websites and services that we don't control (for example, a link shared in a task or a chat message). This Privacy Policy doesn't cover those third parties — please review their own privacy policies.

We may update this Privacy Policy from time to time, for example as we add features like analytics. If we make material changes, we'll update the effective date above and, where appropriate, notify you (by email or a notice inside the Service) before the change takes effect. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or how we handle your data, contact us at support@kokar.krd.