Privacy Policy

Last updated 21 October 2026

Who we are

Koana Works (“Koana”, “we”) provides app.koanaworks.com, an online records platform for member organizations. Contact us at contact@koanaworks.com; for help using Koana, support@koanaworks.com.

Our role

When an organization uses Koana, that organization decides what information to keep about its members and why. For that information the organization is the controller and Koana is its processor, acting on its instructions. For your own sign-in account, Koana is the controller.

What we collect

• Your account: your email address, and your name and profile picture if you choose to sign in with Google. We do not receive your Google password.
• What organizations enter: organization details; members' names and, where provided, email, phone, WhatsApp number, address and membership details; offices held; meetings, minutes, decisions and actions; plans, projects and tasks; dues and money records; and files that officers upload.
• Usage insights: which pages and buttons are used, with the type of role (officer or member), device type and time of day. These are stored without your name or user ID, never include what you type, and you can switch them off under Club account & sign-in.
• Technical data: standard server logs (such as IP address, browser type and time of request) kept for security and troubleshooting.
• Error reports: when something in Koana fails, the app sends Koana a short report: the error message, where in the app it happened, the app version, the device type, and the last few pages opened. Email addresses, long numbers and sign-in tokens are removed from it before it is sent. Reports are linked to your account so we can help, and are seen only by Koana's administrators. They are never sent to an outside error-tracking service.
• Speed readings: on about one visit in four, how quickly pages loaded and responded, with the device type, connection type and app version. These are stored with no name, account, organization or anything you typed.
• On your device: Koana stores your sign-in session and a few preferences (such as theme and last organization) in your browser's local storage. We don't use advertising or tracking cookies.

How we use it

• To provide the service: sign you in, show your organization's records, and let officers manage them.
• To keep it secure: permissions, audit history of changes, and preventing misuse.
• To improve Koana, using the anonymous usage insights described above.
• To contact you about your account or important changes.

We do not sell personal information, and we do not use it for advertising.

Who can see it

Only members of your organization, according to their role. Members see other members' contact details only if that member agreed to share them; officers can see them to run the organization. Koana staff access data only to operate or support the service, or where the law requires.

Service providers

• Supabase — database, file storage and sign-in (hosted in the United States, us-east-2).
• Cloudflare — hosting and delivery of the website.
• Google — if you choose “Continue with Google” to sign in, and if an officer connects the organization's Google Drive or Google Calendar (see below).
• Meta (Facebook, Instagram and Threads) and LinkedIn — only if an organization's officer connects its Page or company page to post from Koana Commons (see below).

Because these providers operate outside Guyana, information may be processed in other countries, with safeguards required by our agreements with them.

Google user data

This section explains exactly what Koana does with information it receives from Google. It applies only when you choose to sign in with Google or an officer chooses to connect a Google account.

What Koana accesses

• Sign in with Google (openid, email, profile): your name, email address and profile picture.
• Google Calendar (calendar.app.created): only the one calendar Koana creates (“<organization> meetings”) and the events Koana puts in it, including their Google Meet links and the guest emails of people the organization invites. Koana cannot see or change any other calendar or event.
• Google Drive (drive.file): only files Koana creates, or that you choose to open with Koana.

How Koana uses it

• Your name, email and picture create and show your Koana account.
• Calendar access is used only to add, update and cancel the organization's meetings, make Meet links, and invite the people the organization chose.
• Drive access is used only to store and open the organization's documents.
• Koana does not use Google user data for advertising, does not sell it, does not use it to train AI or machine-learning models, and does not use it for anything other than these features.

Storage, sharing and protection

• Koana stores the connected Google account's email address, an access token encrypted with AES-256 in private storage, and the IDs of the calendar, events and files it created. Tokens are never shown to anyone, including officers.
• Meeting details (title, time, Meet link) are shown to the organization's members in Koana. Google user data is not shared with anyone else, except service providers that host Koana (listed above) under confidentiality, or where the law requires.
• People at Koana Works do not read this data except with your permission to give support, for security, or where the law requires.

Keeping and deleting it

• An officer (or the person who connected their own account) can disconnect Google in Koana at any time. Koana then revokes its access with Google and deletes the stored token immediately.
• You can also remove Koana at myaccount.google.com/permissions.
• To delete your account or anything else, see Data deletion or email admin@koanaworks.com; we confirm within 30 days.

Koana's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Zoom

An officer can connect the organization's Zoom account, and officers and group leads can connect their own Zoom account to host meetings. Koana then creates, updates or cancels Zoom meetings for the organization's meetings when someone asks it to, saves each meeting's link and passcode in Koana, and can give the host a one-time link to start the meeting as host. Koana asks Zoom for the connected account's email address and user ID, and stores those with an encrypted refresh token (AES-256) in private storage; tokens are never shown to anyone. Koana does not read recordings, chats, participants' details or any other meetings.

Anyone who connected an account can disconnect it in Koana at any time: Koana then revokes its access with Zoom and deletes the stored token at once. If you remove Koana in your Zoom account instead, Zoom tells Koana and the stored token is deleted automatically. Meeting links already saved stay with the organization's meeting records. If a Zoom account is added from Zoom's side rather than from inside Koana, Koana asks you to confirm the account before connecting it.

Koana Commons and social media

Organizations can publish posts (stories, projects, events) on Koana Commons, our public site at commons.koanaworks.com. Officers decide what is published; photos are published only after the officer confirms the people in them agreed, and location data is removed from photos before upload.

An officer can also connect the organization's Facebook Page, its linked Instagram professional account, or its LinkedIn company page, so that Koana can publish the organization's Commons posts there when the officer asks it to. When they connect, we receive:

• the names, IDs and profile pictures of the Pages and accounts they choose;
• access keys that let Koana publish to those Pages and accounts on the organization's behalf.

We use these only to publish the posts an officer chooses and to show whether each post went out. Access keys are stored encrypted, are never shown to anyone, and are never used to read private messages, followers' personal data or anything else. We keep a record of each publish (which post, which channel, the link to it, and when). We never post without an officer pressing “Post now” or scheduling a post.

Officers can disconnect at any time in Commons → Public page; this deletes the access keys immediately. You can also remove Koana from your Facebook settings (Settings & privacy → Business integrations) or LinkedIn settings. See how to delete this data.

How long we keep it

Organization records are kept while the organization uses Koana, because keeping a lasting record across officer changes is the purpose of the service. If an organization leaves, it can export its records, and we then delete them after a limited period. Server logs are kept for a short period.

Your rights

Under Guyana's Data Protection Act 2023 and similar laws, you can ask to access, correct or delete your personal information, or object to its use. For records an organization keeps about you, contact that organization's officers first; we will help them respond. For your own account, email admin@koanaworks.com.

Security

Information is encrypted in transit. Access is limited by role through database security rules, money records can't be edited or deleted, and changes are logged. Two-step sign-in is available for every account. To report a security concern, email security@koanaworks.com.

Children

Koana is intended for adults managing organizations. Organizations that record details of anyone under 18 must have permission from a parent or guardian.

Changes

We will post updates here and tell organizations about important changes before they take effect.