Privacy Policy

Coryo ("we", "us") operates the Coryo iOS application and coryo.dance. Contact legal@coryo.dance for access, correction, deletion, listing correction, or takedown requests.

The table below describes data stored on Coryo servers. Public professional catalog data is listed because an instructor, studio, or organizer may still want to know what evidence we keep and how to correct it.

The v2 account backup synchronizes exactly three record kinds: class records, instructor follows, and studio follows. A class record includes its Going or Took state, the saved class snapshot, your note, your song, and the time you said you booked it. The saved snapshot can include the studio's public coordinates. It does not include a coordinate measured from your phone.

Growth Plans, plan archives, capture choices, baseline and final clips, profile media, and diary photos stay in the active personal scope on this device. Local profile name, bio, and Instagram handle also stay there. Coryo account sync does not include any of these fields or files. Plan recommendation impressions and tuning choices also stay in that personal scope and are not included in account sync.

Plan clips are limited to 60 seconds and 100 MB, are excluded from device backup, and are not uploaded by Coryo. The app makes a poster frame locally. It does not score or analyze movement.

Diary notes and songs are different from diary photos. A signed-in class record backs up its note and song; the attached photo remains local.

Calendar conflict checking is optional. When enabled, the app reads busy time ranges in memory to avoid overlaps. It does not retain event names, notes, attendees, or calendar identifiers. Busy ranges are held only in memory while calendar checking is on; they are not persisted or uploaded.

We do not collect: precise or background location, address-book contacts, plan clips, local profile photos or diary media, payment-card details, or studio credentials on Coryo servers. Files you deliberately upload are separate: an organizer event cover, an agency application headshot or resume, and instructor listing photos submitted for review. Section 2 and the retention section explain their purpose and storage.

Home receives coarse distance bands and whether a studio meets your selected radius; these inputs are not retained in recommendation history. Class feedback is limited to 500 answers and 365 days. Turning it off deletes synced feedback and derived exposure records; your local Journal copy remains. Displayed recommendations and associated actions are retained for at most 30 days and 100 batches per account. Opens, saves, user-confirmed bookings and attendance are recorded separately. Account export includes this structured data, and account deletion removes it.

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we do not disclose it for cross-context behavioral advertising. The services below receive information for the named purpose.

Providers that process personal information for Coryo may use it only to deliver the named service and must protect it consistently with this policy, their agreements with us, and applicable law. Studio and booking providers are independent: you send information directly to their page, and their own privacy terms apply.

Email and Google are available in the current build. Sign in with Apple appears only when the signed app and the live service confirm the same Apple identity and a complete release configuration. Coryo and note polishing use Apple’s on-device model on supported phones. Catalog searches go to our server; the model processes the retrieved results and your local context on your phone, and Coryo is not offered on a phone that cannot run it.

Your Coryo prompts and your notes are not sent to any model provider. The older cloud assistant was removed on 10 September 2026, along with its provider code, so there is no longer a route that could send them, enabled or otherwise.

The agency application draft is a separate feature, and it is the one place Coryo uses a cloud model. When you ask for a draft, or queue an application that does not have one, your kit and your answers go to Anthropic as the table above describes. Your kit includes your citizenship or visa status, which California treats as sensitive personal information, so it is sent only for that draft and only to that provider. Nothing else in the app sends what you write to a cloud model.

Friend requests and accepted connections are visible to the two accounts involved. A block ends the friendship, removes the conversation from both inboxes and closes its history to both accounts, so a blocked account will notice. We never say who blocked them or that a block is the reason. We do not publish friend counts.

We may also disclose information if required by law, to respond to lawful requests from public authorities, or to protect the rights, property or safety of any person. If Coryo is involved in a merger or acquisition, information may transfer as part of that transaction, and this policy will continue to apply until you are notified otherwise.

Automatic logging is optional. When it is On and location permission allows it, Coryo arms regions only for eligible future classes marked Going. A region entry can start visit monitoring only during the class window, from 15 minutes before the start through 45 minutes after the scheduled end. Up to 15 of the soonest eligible regions may be armed.

iOS visit detection is global while it is armed and may observe visits beyond the studio during that bounded period. Coryo compares an iOS visit or one-time location fix with the public studio location. The raw coordinate is held only long enough to calculate distance from the studio; it is not persisted or uploaded.

The device may temporarily store the class id, time, distance, and accuracy needed to decide one class. Those samples are removed after a decision, denial, unmark, cancellation, expiry, permission downgrade, departure, or Off. Attendance provenance and any measured minutes remain local. If attendance changes the class from Going to Took, that class record can be included in signed-in account backup.

Turning automatic logging Off asks iOS to stop every Coryo region and visit monitor, cancels scheduled work, and removes active samples. Sign-out, account switching, guest import, and account deletion await that same teardown and clear the app-local booking website store before another personal scope is activated.

Google sign-in uses Google's sign-in software and Firebase authentication, then exchanges the verified Firebase token for a Coryo session. Email sign-in sends a one-time code through Gmail.

Booking pages use Coryo’s persistent, app-local WebKit website-data store. The optional recording preview instead opens booking pages in a separate, nonpersistent store and leaves your ordinary booking-site sign-ins unchanged. The studio or booking provider receives the page request and anything you type there, including its own account or payment information. Coryo does not receive those credentials or card details. Coryo does not treat a URL, page close, or payment-provider return as proof that you booked. After the page closes, only your explicit answer can save a booking time in your class record.

You can remove every booking-site cookie, sign-in, and other WebKit item saved by this app under Me, Settings, Storage, Clear booking website data. This does not clear Safari, the class catalog, marks, or the Coryo account.

Class information comes from public studio schedules, official studio pages, public booking widgets, structured data, documented partner interfaces, and deliberate manual review. Public retrieval never authorizes automating a dancer's login, account, payment, or authenticated booking flow.

Event information can come from organizer sites, public event directories, public professional posts, and organizer submissions. Only approved, future, placed events reach the public event feed. Public professional data is not a dancer's private account data, but it remains correctable.

The current release publishes stored studio and event catalog fields, and instructor portraits, that Coryo's owner authorized for publication. An instructor biography read from a studio's own public schedule page is published with a link to that page and the date we read it, and it stops being shown once that reading is no longer refreshed. Instructor social links and direct media publish only when they are tied to a current instructor-profile grant and pass the applicable verification, freshness, integrity, and revocation checks. An instructor who wants a biography changed or removed can write to us and we will correct it.

Where a studio has published no biography for an instructor, we may show the biography from the instructor's own public Instagram account instead. It is shown whole and exactly as the account had it, never edited and never combined with anything else, with a link to that account and the date we read it. The page says which of the two you are reading. A studio biography always takes precedence, so if one is published later it replaces the Instagram one. We show an Instagram biography only for an account we have already confirmed belongs to that instructor, and the same correction and removal request applies to it.

We retain source URLs, source quotes, fetch receipts, and short-lived raw schedule payloads so a listing can be audited and corrected. A mirrored event flyer is served only with credit and a link to its source, and a takedown stops the artwork from being served while leaving factual event information intact.

Catalog tooling has used Meta Business Discovery for public professional accounts. It can retain post identifiers, captions, delivery URLs, thumbnails, and other candidate metadata needed for review. Catalog tools can also make downloaded and stored copies of public profile pictures or event flyer images, together with source and credit records and a correction and removal process. This catalog processing is separate from Facebook sign-in, which is not available in the current release.

An instructor who chooses Connect with Instagram authorizes a separate Instagram login. We use the one-time result to compare the Instagram username with the exact Coryo instructor listing and to read public professional profile details such as display name, biography, follower and media counts, website, and whether a profile picture is available. We retain the stable Instagram-scoped identifier, verification time, and the profile receipt needed to audit or refresh the connection. We do not receive the Instagram password or retain the Instagram access token. A provider profile-picture URL is not published directly; an image must pass the moderated Coryo storage path first.

Instructors, studios, organizers, and dancers can request a correction or takedown atlegal@coryo.dance. We do not access private accounts, direct messages, follower lists, or authenticated member schedules to build the catalog.

• Account, provider-link, friend, and synchronized-record data remains while the account exists. Account-sync tombstones also remain for the account lifetime so an old device cannot recreate a deletion.
• A sign-in code works for 10 minutes. Expired and used code rows become eligible for removal within 24 hours after expiry or use.
• Rate-limit receipts become eligible for removal after 48 hours.
• Account-sync retry receipts become eligible for removal after 180 days.
• An event submission contact becomes eligible for removal 30 days after a final review decision or 90 days after submission, whichever comes first. Every current final review path records that decision time.
• An organizer cover upload policy and completion token expire after 15 minutes. An unfinished private upload is abandoned after a 24-hour grace period. A verified cover can remain in the private review queue for up to 90 days. Rejected private cover bytes are deleted when possible and otherwise remain quarantined for deletion retry. Approval copies the verified cover to public event storage and removes the private copy.
• Studio, instructor, and event requests remain as private catalog operations records. Deleting an associated account removes the account link from the request. A request sent while signed out has no account link. No automatic request expiry is implemented.
• Milestone progress (opened gems, unlocked stones and the featured stone) is one row per account, kept while the account exists and deleted with it.
• Keyed hashes of your sign-in identities and verified email address are kept after account deletion to prevent repeat trials. Apple DeviceCheck stores whether this device has used a trial. An unverified device can sign in but does not receive a new trial.
• Feature requests are tied to the signed-in account that sent them. Deleting that account deletes its feature requests and their review state.
• Problem reports and catalog corrections sent from Help & feedback are tied to the signed-in account that sent them, with the app and iOS version. Deleting that account deletes them and their review state.
• An instructor listing photo (the public copy and the private original) is deleted when the claim is revoked or the account is deleted. A copy that a storage error left behind is deleted by the private-retention job on its next run.
• A crash or hang diagnostic the app reports while signed in (the call stack, the app and OS versions, and the device model, never message text or location) is kept for 90 days and then removed by the private-retention job. Deleting the account deletes its diagnostics at once.
• An application kit (the details, headshot and resume a dancer types once to apply to agencies) and the record of each application we carried remain while the account exists. The kit is sent to an agency only after the dancer turns on permission and taps Apply for that agency; a form or email door delivers the kit to that agency, and a packet door sends it back to the dancer only. Deleting the account deletes the kit row, every application record, and the headshot, resume and receipt screenshots in private storage in the same operation.
• Messages and their class previews remain while their direct conversation exists. Deleting either participant account deletes the conversation, its messages, and the realtime replay copies of those messages in the same transaction, so the other participant cannot replay a deleted account’s messages afterwards.
• When enabled, class Going is shared only after explicit opt-in, with existing friends who have Plus. Class discussion requires a separate Plus opt-in and is visible to other joined participants, including nonfriends. Leaving hides Going and removes discussion access; authors can still delete their own comments. Ordinary class discussion expires 30 days after the class and is removed by the private-retention job.
• An authored studio memory remains until its author deletes it or deletes the account. Unfriending or either-direction blocking removes it from that friend’s surfaces immediately.
• Private community details remain while the community exists. Deleting a community removes its name, description, membership list and invitations; a minimal creation receipt remains until the owner deletes the account so a delayed retry cannot recreate the group. Deleting an account removes its owned communities and memberships. Recently viewed lists stay scoped on the device and are erased with that account’s local data.
• A safety report keeps its minimum moderation snapshot for 24 months from submission even if the reporter, subject, message, memory, or class comment is deleted. It is then removed by the private-retention job. No legal hold is implemented in this release.
• Moderation decisions are kept for 24 months from the decision, including after account deletion, then removed by the private-retention job. Report review history expires with its report. A moderation appeal goes to the private Support queue and is deleted with the submitting account. Notices do not expose reporters or private report contents.
• Instructor choices used for favorite-based alerts are removed when you turn that alert category off, disconnect the device, or delete your account. Class-alert delivery receipts become eligible for removal 30 days after the listing and are removed by the private-retention job, or immediately when the account is deleted.
• Realtime replay events normally expire after 7 days and one-use realtime tickets after no more than 60 seconds; expired rows are removed by the private-retention job. Account deletion removes every replay event that account could read or was the other party to immediately, without waiting for expiry.
• Unchanged raw class-schedule payloads are deduplicated. Raw schedule-fetch rows become eligible after 14 days and are removed by the next full schedule cleanup.
• Waitlist addresses remain until they are removed in response to a request. No automatic waitlist expiry is implemented.
• Local data remains until its feature-specific delete control, scope cleanup, or app removal deletes it. Plan clips are excluded from device backup.
• Coryo conversation text remains until the direct history delete control or account deletion removes it. A deletion tombstone retains only the conversation id, account boundary, and deletion time needed to clear another device.
• The application does not enforce or verify a duration for cloud runtime logs or database backups. Provider and operator settings must be reviewed before release, so this policy does not invent a duration.
• The guarded cleanup code supports an hourly schedule, but this policy does not claim that cadence until the production job and scheduler are independently verified.

Depending on where you live, you may have the rights below. We honor these requests from everyone, regardless of location, and we will not discriminate against you for exercising them.

• Know and access: ask what personal information we hold about you.
• Delete: under Me, Account, delete the server account and choose whether this phone keeps the record as a private guest profile or erases its account-scoped local data too. You can also ask for help by email.
• Correct: fix information that is inaccurate. Profile fields are editable in the app.
• Portability: receive a copy of your information in a portable format.
• Opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of.
• Local controls: remove selected profile or diary media, delete plan clips, clear recommendation tuning, turn automatic logging Off, or clear booking website data.
• AI controls, when enabled: delete a Coryo conversation directly.

A successful account request removes managed Firebase identity data used by this app first, then deletes the Coryo account and its linked server rows. Independent Google, Apple, studio, and booking-provider accounts are not deleted.

Before the server request, the app journals your local choice. It waits for location and booking teardown, then either rekeys the closed account store and local media to a fresh guest scope or erases the closed scope. A lost response or interrupted local operation stays pending and can be retried without activating another profile early. The dedicated data deletion page explains that boundary. Signing in remains optional, and the public catalog works without an account.

To make a request, email legal@coryo.dance. We may need to verify control of the account email or another relevant identifier. You may use an authorized agent. We respond within the period required by applicable law.

Server data is encrypted in transit. Sign-in codes are stored as hashes, not as the six digits that were emailed. Application secrets are configuration values rather than source code. Coryo does not store a Coryo password.

No transmission or storage method is completely secure. Do not enter a studio password or payment detail anywhere except the booking provider's own page, whose current host is shown in the booking browser.

Coryo is intended for people aged 13 and over. We do not knowingly create an account for a child under 13. Contact legal@coryo.dance if you believe a child provided account information.

Social features are separately opt-in and limited to accounts that explicitly confirm they are at least 18. The general 13-and-over app audience does not grant social access.

Coryo operates in the United States, and server information is processed there. If you use the service elsewhere, information sent to our servers is transferred to the United States.

If the implementation changes what leaves the device, this page must change with it. Material changes will be communicated before they take effect.

Questions, privacy requests, corrections, and takedowns: legal@coryo.dance.