Privacy Policy

1.Who we are

Koko Studio (“we”, “us”) is an AI video creation and learning platform for the Australian Chinese community, with a focus on older learners. The website is koko.hjstudio.au; the iOS app uses the same accounts and data.

The platform is operated by Hero's Journey Advisory Pty Ltd (ABN 96 683 301 180), registered in New South Wales (NSW 2065, Australia).

This policy explains how we handle your personal information. We follow the Australian Privacy Act 1988 and the Australian Privacy Principles.

2.What we collect

• Account details: email, the name you choose, your password (stored only as a salted hash — we never see the plain text), avatar and bio. If you sign in with Google we receive your email address and Google account identifier only.
• Media you upload: photos, videos and reference images you provide for your creations.
• What you create: AI-generated images and videos, plus the prompts, titles and captions you write.
• Community activity: posts, likes, comments, follows, reports and blocks.
• Usage data: view counts, generation task records, credit transactions, sign-in times and basic device/browser information (for troubleshooting and abuse prevention).
• Push identifier: if you allow notifications, your device gives us a push token so we can tell you when a video is ready or someone replied. Turning notifications off in system settings stops this.
• Transactions: voucher orders, subscription and credit purchase records. Full card numbers are handled and stored by Stripe — we never receive or store them.

We do not collect government ID, biometrics or precise location. Please do not upload ID documents or bank cards as creation material.

3.How we use it

• Running the service: generating your work, storing your media, publishing and community interaction.
• Billing: granting and deducting credits, keeping transaction records, issuing and reconciling orders.
• Safety and compliance: detecting abuse, handling reports, enforcing our Community Guidelines, suspending accounts.
• Notifying you: task finished, someone commented, liked or followed you, important system messages.
• Improving the product, using aggregate statistics.

We do not sell your personal information, we do not track you across other apps for advertising, and we do not resell your work as training data.

4.Who we share it with

These providers process data on our instructions only:

• Stripe — payments and subscriptions. Card details go directly to Stripe.
• Vercel — website hosting and file storage (Vercel Blob) for your uploads and generated files.
• Neon — database hosting for accounts, posts and credit records.
• AI generation providers — to produce what you asked for, we send the prompt and the reference material you selected to upstream model providers. We do not send your account identity or email with it.
• Apple Push Notification service — to deliver notifications to your iPhone.
• Google — only if you choose to sign in with Google.

We may also disclose information where required by law, court order, or to prevent an imminent threat to someone’s safety.

Some providers store data outside Australia (including the United States and Europe). By using the platform you acknowledge this cross-border handling.

5.How long we keep it

• While your account is active we keep your profile, media and posts until you delete them or close the account.
• After account deletion your posts, media, comments and social connections are deleted and cannot be recovered.
• Financial records are the exception: credit transactions, orders and receipts are accounting and tax records that Australian law (ATO) requires us to keep, generally for five years. They survive account deletion, with identifying details minimised.
• Database backups roll over and are usually cleared within 30 days; operational logs are kept for up to 90 days.

6.Your rights

• View and edit: change your name, avatar, bio and password under Me → Edit profile.
• Request a copy of your data: email info@hjstudio.au and we will provide it within 30 days.
• Delete your account: open the Me page in the app or on the web, scroll to the very bottom and tap “Delete account”. After you confirm the prompts, deletion is immediate and permanent (except financial transaction records we must keep by law). You can also email info@hjstudio.au and we will handle it for you. Save anything you want to keep first.
• Stop notifications: turn them off for this app in your device settings.
• Correct inaccurate information: email us and we will fix it.

If you are unhappy with how we handle your information, email us first — we respond within 30 days. If you are still not satisfied you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

7.Children’s privacy

The platform is for adults and is not directed at children under 13. We do not knowingly collect their information; if we find such an account we delete it and its data.

Users under 18 should use the platform with a guardian’s consent. If a child’s information has been uploaded here, email us and we will remove it.

8.Security

Passwords are salted and hashed, all traffic is served over HTTPS, internal access is least-privilege, and payment details never touch our own database.

No system is perfectly secure. Please use a password you don’t reuse elsewhere, and never upload ID documents or bank cards as creation material.

9.Changes to this policy

We update this page and the “last updated” date at the top whenever the policy changes, significant changes included. It is worth checking that date now and then.

10.Contact

For any privacy question, request or complaint, email info@hjstudio.au.