Privacy Policy

Korel ("we," "us," "our"), operated by Saqib Iqbal, is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights in relation to that data. By using Korel at usekorel.com, you agree to the practices described here.

If you have questions, contact us at siqbalbaloch@gmail.com.

Account information:

• Name and email address (from registration or Google OAuth)
• Encrypted password hash (if using email/password login)
• Account creation date and last activity timestamp

Connected account credentials:

• LinkedIn OAuth access tokens (for publishing on your behalf)
• X (Twitter) OAuth tokens (for publishing on your behalf)
• Beehiiv API key (stored AES-256-GCM encrypted at rest)
• Beehiiv Publication ID

Content you submit:

• Input text (transcripts, memos, documents) submitted for pack generation
• RSS feed URLs and YouTube channel URLs you add to monitoring
• Authority Profile settings (positioning, audience, tone preferences)

Generated content:

• Authority Packs (LinkedIn posts, X threads, newsletters, insights) — stored in your account
• Repurposed content variants
• Publish records (platform, scheduled time, status)

Usage data:

• Monthly pack generation counts (for plan limit enforcement)
• Subscription plan and billing status (via Paddle webhooks)

We do not collect: IP addresses for tracking, advertising data, behavioral analytics, or device fingerprints.

We use your data solely to provide and improve the Korel service:

• Service delivery: Generating Authority Packs from your inputs, monitoring RSS feeds, publishing content to connected accounts on your instruction
• Plan enforcement: Tracking usage against your monthly pack limit
• Billing: Processing subscription payments through Paddle
• Communication: Sending transactional emails (pack ready notifications, new episode alerts, support responses). We do not send unsolicited marketing emails
• Service improvement: Aggregate, anonymized usage patterns to improve features (no individual data is used for this)

We do not sell your data. We do not use your content to train AI models. We do not share your personal data with third parties for advertising purposes.

Korel uses the following third-party services to provide functionality. Each handles data under their own privacy policies:

We retain your data for as long as your account is active. Specifically:

• Account data and generated packs: Retained until you delete your account
• OAuth tokens: Retained until you disconnect the integration in Settings → Connections, or delete your account
• Usage counters: Retained for 24 months for billing and plan enforcement purposes
• Support tickets: Retained for 24 months
• Billing records: Retained for 7 years as required by applicable law

After account deletion, personal data is removed from our systems within 30 days. Billing records may be retained longer to comply with legal obligations.

You have the following rights regarding your data:

• Access: Request a copy of the data we hold about you
• Correction: Update your name, email, or other account information in Settings
• Deletion: Delete your account and all associated data from Settings → Account, or by emailing us
• Disconnection: Revoke any third-party integration (LinkedIn, X, Beehiiv) at any time from Settings → Connections
• Portability: Request an export of your generated content (Authority Packs) in JSON format

To exercise any of these rights, email siqbalbaloch@gmail.com. We will respond within 30 days.

Korel uses minimal cookies — only what is strictly necessary to operate the service:

• Authentication session cookie: A JWT session token stored as an HTTP-only cookie to keep you logged in. This is required for the service to function and cannot be disabled.
• CSRF token: A security cookie used to protect form submissions.

We do not use advertising cookies, analytics cookies, or tracking pixels. We do not use Google Analytics or similar third-party analytics services.

We take reasonable technical and organizational measures to protect your data:

• All data in transit is encrypted via HTTPS/TLS
• Passwords are hashed using bcrypt and never stored in plain text
• Third-party API keys (e.g., Beehiiv) are encrypted at rest using AES-256-GCM
• OAuth tokens are stored encrypted and scoped to minimum required permissions
• Database access is restricted to application servers only

No system is completely secure. If you believe your account has been compromised, contact us immediately at siqbalbaloch@gmail.com.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a notice within the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

For any privacy-related questions, data requests, or concerns:

Also see our Terms of Service.