KoratThe feed is where a Korat post is most visible, and most of what Korat does — groups, business pages, stories, sharing — is built on a single post row rather than four parallel systems. A group post is an ordinary post carrying a group id. A business page post is an ordinary post carrying a business id. That decision is why reactions, comments, @mentions and notifications behave identically everywhere, and why a fix to one applies to all of them at once. So this page is really a description of the thing the rest of the app is made of.
Four ways to write a post
A post can be plain text; text on a colour background, for the short line that would look lost as a grey paragraph; or up to four images laid out in an X-style grid that adapts to how many you attached. You can publish it as yourself or as a business page you manage, and you can publish it into a group instead of onto the main feed.
Every post carries its own visibility — public or friends — and that setting is changeable after publishing, not frozen at the moment you pressed send. People misjudge an audience constantly: something written for friends turns out to be worth showing everyone, or the opposite becomes obvious an hour later. The one exception is a post published as a business page, which is always public, because a shop post that only some customers can see is a support ticket waiting to happen.
Every post, comment and story can be reported, choosing from a fixed list of reasons. The report runs through a function executing with *your* permissions rather than the server's, so a post you cannot see and a post that does not exist answer identically — the report button never becomes a way to probe whether content you are not allowed to see exists. The rate limit is enforced in the database, not in the app. You can edit your own post after publishing and delete it. Comments support @mentions that resolve to real handles, so a mention is a link to a person rather than a string that happens to start with an at sign, and the mentioned person gets a notification.
Six reactions, one per person
There are six reactions — 👍 ❤️ 😄 😮 😢 😡 — and each person gets exactly one on a given post. Tapping the same one again removes it; tapping a different one moves your reaction across. There is no reaction count you can inflate by tapping repeatedly, and no separate like-plus-reaction bookkeeping to reconcile.
The reason to have six rather than one is that a single like is ambiguous on bad news, and the reason not to have thirty is that a long tail of rarely-used reactions makes the counts unreadable. Six is enough to distinguish agreement from sympathy from anger, which is the distinction people actually need.
The feed is ranked, and the ranking is written down
The main feed is not strictly newest-first. It is ordered by a ranking function that lives in one file in the app's source, data/Ranking.kt, and every weight in it is documented in the project's core algorithm document alongside the weights used for friend suggestions, Dating and search. When a weight changes, that document changes with it.
We mention this because "the algorithm" is normally the part of a social product nobody will describe. Ranking is a set of numbers someone chose; writing them down in one place is the difference between a ranking you can argue with and a black box. Group posts are excluded from the main feed at exactly one point in that pipeline — they belong to their group, and they stay there.
Albums, and where your photos end up
Photos are organised into albums that carry their own visibility — public, friends or private — independent of the posts that used them. Each album has a cover photo and can be renamed or deleted, and three default albums exist from the start: profile pictures, cover photos and post images. Uploading a photo to a post therefore does not silently create a second copy of your photo library somewhere you cannot see.
A private album is private in the sense that Korat's interface will not show it to anyone else. It is not private in the cryptographic sense, which brings us to the honest part.
Uploaded media is publicly readable by URL. Korat does not use signed URLs or private storage buckets. Anyone holding the direct file URL of an image can open it, regardless of the visibility set on the post or album it belongs to — visibility controls who sees it *in the app*, not who can fetch the file.
Nothing in Korat is end-to-end encrypted, and there is no application-level encryption at rest — the security page lists that alongside everything else that is not done. Treat an uploaded photo as something that could be reached by anyone who obtains its address, and do not upload anything where that outcome would be serious.
Sharing, and the link that says nothing
Anything shareable can go into a chat as a card, onto your own feed, into a story, or out to any other app on the device through the normal Android share sheet. It can also become a share link on koratland.com — a URL of the form koratland.com/s/<token> where the token is 14 random characters. Posts, profiles, businesses and stories can each be shared this way.
The token is opaque on purpose. When someone opens it, the server resolves it through a function that returns only two things: what kind of object it is, and which object. It never returns who created the share or how many times it has been clicked. Click counting works the other way round — a separate function records a click, and there is deliberately no insert permission on the underlying table for anyone at all, so a visitor can increment a counter without being able to write anything else to it. A link you paste into a group chat therefore tells the recipients nothing about your sharing history.
Stories that expire, with a viewer list that does not
A story is a photo or text on a colour, with a choice of embedded font, free placement of the text anywhere on the canvas, and a text colour you pick. Visibility is public or friends, the same two options as a post, and it expires on its own. You can delete your own story before it does.
The owner of a story gets a viewer list — the actual people who opened it, not a number. A count tells you a story was watched; a list tells you by whom, which is the thing you wanted to know and the thing that also makes it obvious to everyone that watching is not anonymous. Activities from the health module can be shared into a story too, with a caption over a background you choose, which is the same story object with different content poured into it. A sports club keeps an activity feed of its own on top of that — built only from what its members recorded, and separate from both this feed and the club's chat room.