Privacy Policy

Kortaga LLC — Privacy Policy

When you use a Kortaga Account, you trust us with your information. We understand this is a responsibility, and we work to protect it and to keep you in control.

This Privacy Policy applies to the Kortaga Account and the services we offer through it. Properties you sign in to may publish their own privacy policies for what they collect directly.

Information we collect

We collect information to provide the Kortaga Account to everyone who uses it, and the information we collect depends on how you use our services and which settings you choose.

Things you create or give us. When you create an Account we ask for information such as your email address and a password, and you may add a display name, enrol a passkey, or choose a world. We keep a verifier for your password rather than the password itself.

Your apps, browsers and devices. We collect information such as your IP address, browser type and settings, operating system, and identifiers assigned to your device when you interact with our services.

Your activity. We collect information about your activity in the Account, which may include sign-in events, which Properties you have signed in to and when, security events such as failed sign-in attempts, and settings you change. Where you have enabled a Signal, we may also collect the small derived value that Signal carries.

Why we collect data

Provide our services. We use your information to deliver the Kortaga Account, such as authenticating you and keeping you signed in.

Maintain and improve our services. For example, we use information about failures and sign-in patterns to fix problems and make the service more reliable.

Develop new services. We use the information we collect in existing services to help us develop new ones.

Provide personalised services. Depending on your settings, we may use your information to tailor your experience across Properties — for example, carrying your chosen world, or passing a Signal you have enabled.

Measure performance. We use data for analytics and measurement to understand how our services are used.

Communicate with you. We use information such as your email address to communicate with you about your Account, including security notices and confirmations.

Protect Kortaga, our users and the public. We use information to help improve the safety and reliability of our services, including detecting, preventing and responding to fraud, abuse, security risks and technical issues.

We ask for your consent where the law requires it, and you can withdraw that consent. Our aim is to use what we hold to make these services more useful to you and to keep them safe.

Your privacy controls

You have choices about the information we collect and how it is used. You can review and update your Account information, choose a world or clear it, enable or disable each Signal individually, delete Signals, sign out of sessions, and delete your Account. Some information is necessary for the Account to function, and turning it off is not possible without closing the Account.

Sharing your information

With Properties you sign in to. When you sign in to a Property, we share the attributes you authorise at that moment, such as your account identifier and, where you allow it, your email address or chosen world.

With your consent. We may share personal information outside Kortaga when we have your consent.

For external processing. We provide personal information to our affiliates and to other trusted businesses or persons to process it for us, based on our instructions and in compliance with this policy and appropriate confidentiality and security measures — for example, hosting and email delivery.

For legal reasons. We may share personal information outside Kortaga if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to meet an applicable law, regulation, legal process or enforceable governmental request; to enforce our terms, including investigation of potential violations; to detect, prevent or otherwise address fraud, security or technical issues; or to protect against harm to the rights, property or safety of Kortaga, our users or the public as required or permitted by law.

We may share information that is aggregated or de-identified such that it cannot reasonably be used to identify you. If Kortaga is involved in a merger, acquisition or sale of assets, we will continue to ensure the confidentiality of personal information and give affected users notice before personal information is transferred or becomes subject to a different privacy policy.

We do not sell personal information for money, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.

Keeping your information secure

We work hard to protect you and Kortaga from unauthorised access to, or unauthorised alteration, disclosure or destruction of, information we hold. In particular, we encrypt information in transit, store password verifiers that are salted, stretched and additionally keyed, rate limit sign-in attempts, and restrict access to personal information to those who need it. When you choose a password it is compared in your browser against a public corpus of exposed passwords using k-anonymity, so that only the first five characters of a hash are sent to that service.

Exporting and deleting your information

You can request a copy of the information in your Account, and you can delete your Account. When you delete information we follow a deletion process to make sure it is safely and completely removed from our servers or retained only in an aggregated or de-identified form. There may be delays between when you delete something and when copies are deleted from active and backup systems. Write to privacy@kortaga.com to make a request.

Retaining your information

We retain the information we collect for different periods of time depending on what it is and how we use it. Some information you can delete at any time, such as your chosen world and your Signals. Some is deleted automatically after a set period, such as sign-in codes, confirmation links, Signals and inactive sessions. Other information is retained until you delete your Account, such as your email address and password verifier. And we retain some information for longer where necessary for legitimate business or legal purposes, such as security, fraud prevention, or compliance with legal obligations.

Compliance and cooperation with regulators

We review this policy regularly and work to comply with applicable data protection laws. If you are in the EEA or the UK, the GDPR gives you rights including access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with your supervisory authority; we rely on performance of our contract with you, our legitimate interests, your consent, and compliance with legal obligations as our bases. California residents have rights to know, delete and correct personal information, to opt out of sale or sharing, and not to be discriminated against for exercising those rights. We operate from the United States on globally distributed infrastructure; where information is transferred out of the EEA or the UK we rely on appropriate safeguards, including standard contractual clauses. The Kortaga Account is not directed to children under 13, and we do not knowingly collect their personal information. Contact privacy@kortaga.com to exercise a right or raise a concern.

Cookies and similar technologies

We use cookies for a single purpose: to run the Account. We do not use advertising cookies, we do not embed third-party trackers, analytics pixels or social plugins in the Account, and there is nothing here to opt out of because there is nothing here that follows you.

The cookies we set are strictly necessary. __Host-clk_s holds your signed session so you stay signed in; __Host-clk_pkce and __Host-clk_state exist only for the seconds of a sign-in handshake and protect it from being forged. All of them are marked HttpOnly, Secure and SameSite, which means page scripts cannot read them and another site cannot make your browser send them. Signing out clears them. Blocking them will prevent you from signing in.

Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we process your personal data on these bases. Performance of a contract: creating and running your Account, authenticating you to a Property, and carrying a Signal you have switched on. Legitimate interests: keeping the Account secure, detecting and preventing abuse and fraud, and understanding faults so we can fix them, balanced against your rights. Consent: each Signal is off until you turn it on, and you may withdraw consent at any time without affecting processing already carried out. Legal obligation: responding to lawful demands and keeping records we are required to keep.

Where your information is processed

We operate on a global edge network, so your information may be processed in the United States and in other countries, including countries whose data protection laws differ from those where you live. Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses together with the technical measures described above, including encryption in transit. You may ask us for details of the safeguards that apply to a transfer.

Children

The Kortaga Account is not directed to children, and you must be at least 13 years old to create one (or the higher minimum age in your country where local law sets one, including 16 in parts of the European Economic Area). We do not knowingly collect personal data from children below that age. If we learn that we hold such data, we delete the Account and its data. A parent or guardian who believes a child has created an Account may write to legal@kortaga.com and we will act on it.

United States state privacy rights

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit. We do not use your information to profile you in a way that produces legal or similarly significant effects.

Depending on your state you may have the right to know what we collect and why, to access a copy, to correct it, to delete it, to opt out of sale, sharing or targeted advertising (which we do not do), and not to be discriminated against for exercising any of these rights. The Account's export and delete controls exercise the access and deletion rights directly; for anything else, write to legal@kortaga.com. If we decline a request we will tell you why, and you may appeal by replying to our response; if we deny the appeal you may complain to your state Attorney General. You may use an authorised agent, and we may ask you to verify the request.

How to contact us

Write to us at legal@kortaga.com, or to Kortaga LLC, 2108 N ST #11725, Sacramento, CA 95816, United States. We are the controller of the personal data described in this policy. If you are in the European Economic Area or the United Kingdom and you believe we have not resolved your concern, you may lodge a complaint with your local supervisory authority.

About this policy

This policy applies to the Kortaga Account and does not apply to services that have separate privacy policies. We change this policy from time to time. We will not reduce your rights under this policy without your explicit consent. We always indicate the date the last changes were published, and we provide access to archived versions on request. If changes are significant, we will provide a more prominent notice, including notice through the Service.

Kortaga LLC, 2108 N ST #11725, Sacramento, CA 95816, United States. Contact privacy@kortaga.com.

Effective August 1, 2026 · Kortaga LLC, 2108 N ST #11725, Sacramento, CA 95816, United States