Privacy Policy

1. Information We Collect

2. How We Use Information

• Create and authenticate user accounts.
• Provide video and podcast playback, bookmarking, note, folder, and learning history features.
• Process AI summary requests, enforce quota limits, and restore subscription entitlements.
• Send in-app or push notifications when enabled.
• Improve reliability, prevent abuse, handle account deletion, and respond to support requests.

3. Third-Party Services

Corvica uses Apple Sign in, Google Sign-In, StoreKit, Firebase Cloud Messaging, YouTube, Apple Podcasts, and backend hosting providers to deliver app features. These third parties may process information according to their own privacy policies. Corvica does not sell personal information and does not use information for cross-app advertising tracking.

4. Data Sharing

We share information only when needed to operate the service, process authentication, deliver notifications, verify subscriptions, provide support, comply with law, or protect users and the service from misuse.

5. Data Security and Protection

We protect all personal and sensitive data with the following mechanisms:

• Encryption in transit: All communication between the app, our backend, and third-party services is encrypted with TLS (HTTPS). We do not transmit personal data over unencrypted connections.
• Encryption at rest: Personal data stored in our databases and backups is encrypted at rest by our hosting and database providers.
• Access control: Production data access is restricted to authenticated service processes and authorized personnel on a least-privilege, need-to-know basis. API requests are authenticated and scoped to the requesting user's own data.
• Credential handling: Sign-in is delegated to Apple and Google; Corvica never receives or stores user passwords. OAuth tokens are stored securely on the user's device. When a user initiates a YouTube subscription import, the YouTube access token is transmitted over TLS to Corvica's backend, used only to request the subscription list from the YouTube Data API, and is not stored in Corvica's database or intentionally written to application logs.
• Incident response: If we become aware of a data breach affecting personal data, we will notify affected users and applicable authorities as required by law.

6. Google User Data and YouTube API Services

When you choose to import your YouTube subscriptions, Corvica requests the read-only YouTube scope (youtube.readonly). The app sends the YouTube access token over an encrypted connection to Corvica's backend, which uses it to call the YouTube Data API and retrieve only the list of channels you subscribe to. The access token is processed only for this request and is not stored in Corvica's database. The channel list is returned to the app for your review, and only the channels you explicitly select are saved to your Corvica account so new videos from those channels can be provided to you. We do not access your watch history, comments, likes, or playlists, we never modify anything on your YouTube account, and we do not retain the full subscription list on our servers.

• Google user data is never sold, never used for advertising, and never shared with third parties.
• Google user data is not used to develop, improve, or train generalized AI or machine-learning models.
• You can revoke Corvica's access at any time at myaccount.google.com/permissions, and imported channels can be removed in the app.

Corvica's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Retention and Deletion

We retain account, subscription, usage, and learning data while an account is active or as needed to provide the service. Users may delete their account in the app. When an account is deleted, associated account data is removed or retained only in limited hashed form where necessary to prevent abuse, preserve legal records, or enforce service limits.

8. Children and Age-Restricted Content

Corvica may ask for date of birth to determine whether a user can access age-restricted content. Corvica is not intended to collect personal information from children where parental consent is required by applicable law.

9. Contact

If you have questions about this Privacy Policy or your personal information, contact us at support@corvica.app.