Privacy Policy

1. Who we are and how to reach us

Cofelt is a social network with an AI reflection feature called Ask. This Privacy Policy explains what personal data we collect, why, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have. Cofelt is offered in English to adults in multiple countries. Applicable regional rights are explained below.

The controller responsible for your personal data is Cofelt. You can reach us by email:

• Privacy and data requests: Cofelt privacy team
• General support: Cofelt support
• Billing: Cofelt billing team

Contacting us about your data

You can contact us about your data at any time at Cofelt privacy team.

Users in the EU, EEA, and UK

Users in the EU, EEA, or UK can reach us about their personal data at Cofelt privacy team.

India contact

For users in India, questions about how we process your personal data and any grievance can be raised with our contact at Cofelt privacy team. See section 13 for complaints and the phased introduction of rights under India's Digital Personal Data Protection framework.

2. What we collect

We collect the minimum we need to run the service. The list below is itemised so you can see exactly what we hold and why.

Account data

• Email address (login, billing notices, transactional mail)
• Password (received over TLS for authentication, then retained only as a bcrypt hash; we do not store the plaintext)
• Display name
• Phone number, if provided (reserved for planned verification; SMS recovery and user 2FA are not currently available)
• Language and country or locale

Birth data, the input to your cosmic pattern

• Date of birth (locks after onboarding; required to compute your chart)
• Time of birth (editable up to 3 times then locks)
• Place of birth as a city, which we geocode to a latitude and longitude

Your birth date, time, and place are used to compute your chart and the supporting calculation views. We treat your birth data, and the personality, emotional, relationship, and well-being patterns we infer from it, as sensitive data. See section 5.

Computed cosmic-pattern data

• Your chart and the underlying calculation outputs
• Supporting calculation views
• Compatibility or connection results

Profile and social data

• Display photo, if you upload one
• Optional bio, school, college, job title, workplace, hometown, current city, relationship status, spoken languages and interests
• Each About detail starts as Only me. You can choose Connections or Public for each field; your profile-access and blocking choices still apply.
• Optional discovery reach, selected countries, shared-language preference and current time zone. We use a city you select, not GPS or your birthplace, for geographic suggestions. Your current time zone does not change your birth calculation.
• Publicly shared languages may improve relevance. Shared education, workplace and interests receive a small ranking boost only when both members opt in and make those fields public. Relationship status, inferred ethnicity, nationality, caste and religion do not determine recommendations.
• Optional cultural community or religion. This is always private, is not shown to other members, and is never used as a public filter. We process it only if you choose to enter it, and you can edit or clear your value.
• Optional intent (the kind of connections you are looking for)
• Connections you make and the relationship type you label them
• Text-only direct messages between you and your connections

Ask and feedback content

• Your Ask conversation messages, stored so you can review your history and so the AI can follow the thread of your conversation.
• Memory facts the system extracts from your conversations so the AI can remember context you have shared.
• Reactions and resonance signals (for example a thumb-up or thumb-down on an AI response).

Verification data

• Your phone number, if you provide one. SMS delivery is not yet configured, so phone verification is not presently available and the number is not a working recovery or user-2FA method.
• A birth-date confirmation method and timestamp. If you self-attest, we store that method and when you confirmed it. If you choose document verification, an identity-verification provider checks a government-issued ID on our behalf. That provider processes the ID document. We temporarily receive the birth date extracted from it to compare with your account. We retain the verification result, method, and date, not the document image or extracted birth date. This verification does not request a selfie or biometric match.

Billing and payment data

• Your subscription tier, status, and renewal date, and your Spark Pack purchase history and balance.
• Payment records from our payment provider. Your full card number and security code are handled by the payment provider, not by us; we do not store full card details.

Device, usage, and technical data

• IP address and browser user-agent (kept for security auditing)
• Device push tokens for notifications, delivered through our app-platform and push-notification providers
• First-party usage events and daily activity summaries, including session counts, last activity, platform, and app version
• Error and crash reports through our error-monitoring provider

Safety data

• Crisis-detection event records created when our safety system detects a possible crisis signal in a conversation, so we can surface the right help and meet our safety and legal duties (see sections 4 and 9).

Data about other people that you enter

If you enter another person's birth details to run a compatibility or connection reading, we process the birth date, time, and place you provide about that person, and the chart we compute from it, on your instruction. The source of that data is you. By entering it you confirm you are allowed to do so (see section 16). If you are the person whose details were entered and you want them removed, contact Cofelt privacy team.

AI call metadata

Every AI call writes one row to our internal AI call log. The prompt and response content are not stored in that log. We record only metadata: a timestamp, your user ID, the model name, latency, token count, cost, a quality score, and any error type. This log is kept for approximately 60 days, then removed by scheduled cleanup.

3. How we use your data and our legal bases

We use your data only for the specific purposes below. For each one we name the GDPR legal basis we rely on. Where we rely on legitimate interests, we have assessed that our interest does not override your rights, and you can object (see section 7). Where a law requires opt-in consent for a specific optional use of sensitive data, that use must not begin until the required consent has been obtained.

How we use Ask and direct-message content specifically

Authorized staff may review retained Ask content to investigate support, safety, privacy or answer-quality issues. Support review is limited to the relevant case. Wider member-history review is restricted to Super admins, requires a passkey check, expires after five minutes and is audit-logged. Encryption protects stored content; it does not prevent these authorized server-side reviews. This access does not authorize using your conversations to train a model.

• Ask replies use Cofelt's trained model through approved model-serving infrastructure. A request can include your conversation, calculated birth-pattern data, remembered context, and the selected person's permitted data for With. This context is processed to generate your response.
• A thumb-up or thumb-down signal supports product evaluation and quality monitoring. It is not used to train the AI model.
• Direct messages between you and another user are never used to train AI.
• We do not sell your data or use Ask and direct-message content to build advertising profiles. See section 4.

We will not send you marketing email without your opt-in, and you can unsubscribe from non-essential email using the link in that message.

4. Who we share data with

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. The service providers below process data needed to operate Cofelt. We may also make the limited legal and safety disclosures described below.

We can share the current list of these service providers on request at Cofelt privacy team.

We limit service-provider access to the data needed for their role. We do not authorise them to use your Ask or direct-message content for advertising or unrelated model training.

We do not share your data with:

• Cross-site behavioural advertising networks
• Data brokers
• Marketing or behavioural analytics platforms that profile you across sites
• Social-graph enrichment services
• Insurance companies or credit bureaus

We may disclose data when legally required, specifically for:

• A valid court order or other legal process from an authority with jurisdiction over us
• A lawful government request that meets the legal threshold of the governing jurisdiction
• A safety emergency where there is a risk of serious harm to a person

We do not respond to informal requests without proper legal process, and we will tell you about a compelled disclosure where the law lets us.

5. Sensitive data and your choices

We treat the following information as sensitive. Some of it may also qualify as special-category data under the GDPR or sensitive personal information under California law, depending on its content and use:

• The personality, emotional, relationship, and well-being patterns the AI infers from your birth data and conversations. Even though a birth date, time, and place are not health data on their own, the inferences we draw can reveal information about your state of mind, so we treat them as sensitive.
• Any optional religion or cultural community you choose to add.
• Your birth location and its calculated coordinates.
• Your payment-account details, held by our payment provider.

The current product does not provide one separate, all-purpose consent switch for birth-derived calculations and Ask inferences. We process those core records to provide the feature you request. Any consent control shown in the app applies only to the purpose it names, such as family comparison or anonymised research.

Religion and cultural community are optional and are processed only if you choose to enter them. They remain private and can be edited or cleared. Where a specific optional use requires separate consent by law, we will ask before activating that use; if the required consent is not available, we will not perform that optional use. You can contact Cofelt privacy team about a consent or sensitive-data request. A change does not affect processing already carried out lawfully. California residents can also use the "Limit the use of my sensitive personal information" right in section 8.

Note for India: the Digital Personal Data Protection framework does not create a separate sensitive-data category. Its requirements apply as the relevant provisions take effect, alongside other applicable Indian law. The GDPR legal bases above do not replace Indian-law requirements. See section 10 for our adults-only policy.

6. AI, automated processing, and what the readings are

The Ask speaker is an AI system, not a human. It is not a therapist, doctor, or any other licensed professional. We tell you this clearly inside the chat at the start of your first conversation, and you can ask at any time. AI-generated text in the app is produced by software.

Model-generated Ask replies use your conversation and calculated birth-pattern data as context. A With reply can also use the selected person’s permitted data. Replies are experimental interpretations and may be inaccurate, biased, incomplete, or invented. Precise birth data does not make an interpretation a reliable assessment of a person or relationship. It is not a prediction or professional advice.

Our readings, matching, and safety prompts are designed to inform and support your own choices, not to make decisions for you. We do not use them to make a legal or similarly significant decision about you by purely automated means. Our crisis-detection feature flags a possible risk so we can surface help; it does not make a binding decision about you. If you believe an automated output has affected you and you want a person to look into it, contact Cofelt privacy team and we will arrange human review and let you share your point of view.

See section 9 for the important non-advice and safety disclaimers, and our Terms of Service for the full statement.

7. Your rights

If you are in the EEA, the UK, or Switzerland (GDPR)

• Access (Art. 15). Get a copy of the personal data we hold about you.
• Rectification (Art. 16). Correct inaccurate data. Birth-date and birth-time fields have edit limits to protect calculation integrity; if you need a correction beyond the in-app limits, contact us.
• Erasure (Art. 17). Ask us to delete your account and associated data.
• Restriction (Art. 18). Ask us to pause certain processing.
• Portability (Art. 20). Get your data in a machine-readable format.
• Object (Art. 21). Object to processing based on legitimate interests.
• Withdraw consent. Where we rely on consent, withdraw it at any time without affecting prior lawful processing.
• Complain. Lodge a complaint with a supervisory authority. UK users can contact the Information Commissioner's Office. EU users can contact their local data-protection authority.

If you are a California resident (CCPA and CPRA)

• Know the categories and specific pieces of personal information we collect, use, and disclose, looking back 12 months.
• Delete the personal information we hold, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information. At the effective date of this policy, we do not sell personal information or share it for cross-context behavioural advertising, so there is currently nothing to opt out of. We honour the Global Privacy Control signal as an opt-out preference.
• Limit the use of your sensitive personal information (see section 8).
• Non-discrimination. We will not deny you service, change your price, or lower quality because you exercised a right.

Other US states

If you live in another US state with a comprehensive privacy law, you have broadly similar rights, including opting out of targeted advertising and certain profiling. We do not use personal data for targeted advertising or profiling that produces legal or similarly significant effects. In many states, you also have the right to appeal a decision on your request. To appeal, reply to our decision or email Cofelt privacy team. Where a state requires us to honour a universal opt-out signal such as the Global Privacy Control, we do.

Consumer health data (Washington, Nevada, and similar)

Because Ask conversations can touch well-being topics, some data we hold may be treated as consumer health data in some US states. Cofelt is not a health service and does not sell this data. Where a specific use or disclosure requires opt-in consent, that use or disclosure must not begin until the required consent is obtained. Contact Cofelt privacy team to exercise the rights that apply where you live.

If you are in India (DPDP Act)

India's Digital Personal Data Protection framework is taking effect in stages. The statutory rights below apply when the relevant provisions are in force. You can contact us now about access, correction, deletion, or a privacy concern.

• Access and summary. Get a summary of the personal data we process and the processing activities, and the identities of any other parties we have shared it with.
• Correction and erasure. Correct, complete, update, or erase your personal data.
• Grievance redressal. Raise a grievance with us (see section 13).
• Nominate. Nominate another person to exercise your rights if you die or become incapacitated. Contact us to set this up.

Other regimes such as Brazil's LGPD, Canada's PIPEDA, and Australia's Privacy Act give broadly equivalent rights, and we honour them.

8. How to exercise your rights and privacy choices

You have more than one way to reach us, and self-serve tools in the app:

• Export your data: In the web app, open Settings, then Privacy, then Export. The mobile app directs you to the web app for this download. It produces a machine-readable copy of the main account, profile, birth, chart, reading, Ask, memory, connection, Echo, DM, Spark, subscription, refund, support, and bounded activity records associated with you. Large collections, including Ask history, memory, direct messages, and activity, can be limited in a single download; the file indicates these limits. Contact us if you need more data or want to make an access request. Passwords, authentication secrets, embeddings, internal safety or crisis records, and internal moderation or report records are excluded. You must confirm your current password for each export. The app calls POST /api/users/me/export.
• Delete your account: Settings, then Delete account. The app calls POST /api/users/me/request-deletion. This records a request and starts a 30-day grace period; it does not immediately hide the profile, stop account activity, or cancel a subscription. Cancel renewal separately through your billing provider. After the grace period, scheduled processing removes data covered by the normal account process. Completion can take longer if subscription cancellation needs to be verified or deletion must be retried. The retained records are described in sections 9 and 14. This account process does not replace your statutory erasure rights.
• Correct your data: Most fields are editable in Settings, then Profile. For birth-data corrections beyond the in-app limits, email Cofelt privacy team.
• Withdraw a named consent, object, restrict, limit sensitive data, or anything else: use a Settings control where it is shown for that specific purpose, or email Cofelt privacy team.

We respond within the time the law allows, which is generally one month in the EU and UK and 45 days in California, and we will tell you if we need a permitted extension. We verify your identity before we act on a request, to protect your account. Searches for your data are reasonable and proportionate. If an authorised agent makes a request for you, we may ask for proof of their authority.

If you are unhappy with how we handle a request, you can complain to a supervisory authority: your EU data-protection authority, the UK Information Commissioner's Office, the California Privacy Protection Agency, depending on where you live. In India, escalation to the Data Protection Board is available when the relevant complaint provisions and procedures apply.

9. Safety, crisis support, and non-advice

Cofelt is for self-understanding and reflection. It is not medical, psychological, psychiatric, financial, legal, or other professional advice, and it is not a diagnosis or treatment. The Ask speaker is an AI system, not a human, therapist, or doctor. Always seek a qualified professional for advice, and do not delay or disregard professional advice because of something in the app.

Our safety system looks for signals of crisis, such as self-harm or suicidal thoughts, in conversations. Automated checks may surface crisis resources, but they can miss signals or respond incorrectly. Cofelt is not an emergency service and cannot provide emergency help. If you or someone else is in danger, contact your local emergency number or a crisis hotline right away.

When the safety system flags a possible crisis, we create a crisis-detection event record. It can include an encrypted message excerpt, the detected signal, and authorised review notes. Redaction is best effort; these records are not guaranteed to be anonymous. Our current retention period is about 7 years, and these records are excluded from the normal account-deletion process. We restrict access and use them for safety review, integrity, and legal purposes.

10. Children and age

Cofelt is only for people aged 18 and over. This is because the service involves payments and reflective AI content. The service is not offered to anyone under 18; if we learn that an account belongs to a younger person, we close it and handle the data as described below.

We require a birth date and use it to enforce the age requirement before an account can continue into the adults-only service. We do not run behavioural tracking, profiling, or targeted advertising aimed at children.

We design with the needs of younger users in mind, in line with the UK children's code and similar standards, in case a younger person reaches the service despite our age limit. If you believe someone under 18 has created an account, please email Cofelt privacy team and we will remove it. India's Digital Personal Data Protection framework includes duties concerning children that apply as the relevant provisions take effect. Our age limit remains 18, and our policy is to block under-18 accounts.

11. Cookies, mobile identifiers, and tracking

The signed-in web app uses a Secure HttpOnly SameSite=Strict cookie to hold the session refresh token; the short-lived access token is held in memory only and is not persisted to browser storage. Both are cleared when you sign out. On supported mobile devices, the authentication token is stored using the platform's secure credential storage (iOS Keychain / Android EncryptedSharedPreferences).

• We may also use strictly necessary first-party storage for security, account preferences, and consent choices.

At the effective date of this policy, we do not use:

• Advertising cookies or ad trackers
• Third-party cross-site analytics cookies
• Cross-site tracking or device fingerprinting

At the effective date of this policy, the mobile app does not include cross-site tracking SDKs. It uses our app-platform's first-party update channel and standard push-notification services.

We collect first-party product usage events and daily activity summaries, including session counts, last activity, platform, app version, and limited action outcomes. These metrics do not include conversation content. Section 14 explains their retention. Where the law requires consent for a particular non-essential use, that use must not begin until the required consent is obtained. We will update this section and provide any required controls before changing these practices.

12. International data transfers

Cofelt is a global service, and some of our providers are based in other countries, including the United States. This means your personal data may be transferred to and processed in countries outside your own.

• Transfers of EU and UK personal data to countries without an adequacy decision require an applicable legal safeguard. These can include the European Commission's Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum.
• Where a provider is certified under the EU-US or UK-US Data Privacy Framework, we may rely on that adequacy framework.
• For users in India, your personal data may be processed outside India by the providers listed in section 4. Applicable Indian transfer restrictions and requirements must be followed, including DPDP requirements as the relevant provisions take effect.

You can ask for a copy of the relevant safeguards by emailing Cofelt privacy team. We transfer data only to operate the service, never to sell it.

13. Complaints and grievance redressal

If you have a concern or complaint about how we handle your personal data, please contact us first so we can put it right. Email Cofelt privacy team, or use the privacy contact in your settings. You can reach us electronically.

We will acknowledge your complaint within 30 days and respond without undue delay, or sooner where applicable law requires. For users in India, this is our contact channel for privacy grievances. Where applicable DPDP procedures require you to contact us before escalating to the Data Protection Board, please follow that process.

If we cannot resolve your complaint, you can escalate:

• EU users: to your local data-protection authority.
• UK users: to the Information Commissioner's Office.
• California users: to the California Privacy Protection Agency or the Attorney General.
• India users: to the Data Protection Board of India when the relevant complaint provisions and procedures apply.

14. Data retention

We keep your data only as long as we need it for the purpose we collected it, or as the law requires. The table below sets out the main periods.

When you request account deletion:

1. The request is recorded and a 30-day grace period begins.
2. During that window the account may remain usable; the request does not itself hide the profile, stop AI calls, or cancel billing. Cancel renewal separately through your billing provider.
3. After the grace period, scheduled deletion removes data covered by the normal account process from primary systems. Processing can take longer while subscription cancellation is verified or failed steps are retried.
4. Encrypted disaster-recovery copies, if present, may retain deleted data until that copy is manually retired or reaches a configured expiry; they are not returned to normal service except for recovery.

Limited legal and safety records can survive account deletion. These include billing records required for accounting and crisis, security, or moderation records retained for the periods described above.

15. Security and data breaches

We use technical and organisational measures appropriate to the risk, including:

• Connections served over TLS in production
• Passwords stored as bcrypt hashes
• Any database backup sent to offsite storage is encrypted before transfer
• Access controls and a separated admin authentication realm, with admin two-factor authentication
• Rate limiting on login, signup, password reset, and Ask
• Audit logging for admin actions
• Restricted infrastructure access through protected channels

If you discover a vulnerability, please email Cofelt support so we can investigate.

If a personal-data breach is likely to affect you, we will notify you and the relevant authorities as the law requires. In the EU and UK we notify the supervisory authority within 72 hours where required, and in India we follow the notification duties and deadlines that are in force and applicable to the incident.

16. Data you enter about other people

Cofelt lets you enter another person's birth details to run a compatibility or connection reading. If you do this, you confirm that you are allowed to enter that information and that you have any consent needed from that person. We process the data on your instruction to produce the reading you asked for.

We act as the controller of that information. If you are a person whose birth details were entered by someone else and you want them corrected or deleted, or you want to know what we hold, email Cofelt privacy team and we will help, subject to verifying who you are.

17. Changes to this policy

We may update this Privacy Policy as the product evolves or as the law changes. We review it at least once a year.

For material changes, meaning anything that affects your rights, what data we collect, who we share it with, or how we use it:

• We will tell you in advance, by email or an in-app notice.
• Where a change adds a new purpose for your data, we will ask for fresh consent if the law requires it.

For non-material changes, such as typos, clarifications, or formatting, we update the "Last updated" date below.

If you do not accept a change, you can delete your account at any time without penalty.

18. Contact

For privacy questions and to exercise your rights:

Cofelt privacy team

• General support: Cofelt support
• Billing: Cofelt billing team

The controller responsible for your personal data, and how to contact us about it, are set out in section 1.