Privacy Policy

Operator and scope

CocoCircles is an adult-facing household and invite-only community organizer operated by CocoCircles LLC.

Privacy questions or requests: admin@joincococircles.com. There are no child accounts or child-facing services. Parents and authorized staff may manage child-profile records; that does not make child data non-personal or remove privacy obligations.

Accounts and profiles

The service processes your email, authentication-provider identifier, session records, display name, time zone, notification preferences and device push token. Apple/Google sign-in may supply a name to seed a missing display name; you can edit your profile. Email sign-in uses short-lived codes.

Optional profile fields include photo, birthday (month and day), profession, bio, allergies and interests. We do not ask adults for a birth year. Profile visibility controls determine which fields parents in a shared Home/Circle can see. Email starts hidden; your Home can see your photo. A visible field is not a public directory entry.

SMS verification and consent

SMS verification update effective October 1, 2026.

When you choose available phone sign-in, CocoCircles processes the US or Canada mobile number you enter, your selected country, the consent wording/version and affirmative action time, verification and request-status records, abuse-limit information and account linkage. We use these to authenticate you, record your request and prevent misuse. Checking the SMS consent control alone does not send a message; you separately choose Send code.

We send your number and one-time code to our SMS delivery provider for delivery. This verification program does not send marketing messages. No mobile numbers will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent will not be shared with any third parties. Our SMS delivery provider states that it does not share end-user phone numbers with third parties for marketing or promotional purposes. SMS consent is separate from consent to any future promotional messages.

We retain protected consent evidence and request receipts for 24 months after each code request. These records include the consent wording version and fingerprint, time, country, request status and a protected identifier derived from the number; a request receipt does not store the plain phone number or code. Consent evidence can remain after account deletion. Separate keyed abuse and spending records are kept through the first day of the next calendar month, measured in UTC, then become eligible for cleanup.

The temporary verification record's phone number and stored code-verification proof are removed when the request is completed or invalidated, or by scheduled cleanup after its ten-minute expiry. The longer-lived consent/request evidence remains for the period described above. Cleanup runs in bounded batches; expired records can remain temporarily while a request finishes, a backlog is processed or a failed cleanup is retried. These are retention rules for our application records, not a promise of simultaneous deletion from backups, our SMS delivery provider or a recipient's device.

If phone verification creates or signs into your account, we keep its enrolled phone number to support future sign-in until account deletion is processed. After the server accepts an account-deletion request, phone sign-in is disabled and usable verification proof tied to that account is removed; the enrolled number is removed with the account during background deletion. Retained consent and abuse records follow their separate periods. Replying STOP does not erase the enrolled number or these records. See Account deletion for the account-deletion process and its limits.

See the Terms of Use for HELP and STOP behavior, message frequency, rates and phone-only recovery limits. Account-free support is available at admin@joincococircles.com.

Messages are delivered through AWS Notify. AWS does not share end user phone numbers with third parties for marketing or promotional purposes.

Homes, Circles and child records

The service stores Home/Circle names, memberships, roles, invitations and child profiles. Child records can include name, date of birth, allergies, interests, parent notes, photo/avatar and guardian relationships. Roster-mode Circles may hold provisional child records and claim links supplied by authorized staff, including CSV roster input.

Home photos are Home-visible. Child-photo sharing starts off and guardian controls apply. Circle membership requires an invitation and organizer approval. Permission checks and per-field controls govern visibility; not every record is visible to every Circle member. Religious Circle membership or free text can reveal sensitive information, so share only what is needed.

Plans, messages and media

Events, addresses, saved places, errands, lunch plans, RSVP choices/notes, announcements, reactions, messages, images and voice notes are stored to provide the features you use. RSVP child details and notes are restricted to the event host. Images are processed to remove embedded metadata. Voice notes are not automatically transcribed by the app.

Some content is deliberately public: Circle pictures/banners and approved event cover images can be served without an account. Anyone with a public event link may see the event details, time/place, attendance count and host-selected cover—not a Circle directory or private RSVP notes. A shared link or public image may be copied by its recipient.

Private conversations are not end-to-end encrypted. Ordinary Circle organizers cannot browse private one-to-one threads. Reporting can preserve the reported content for an authorized reviewer; that may include a reported image, audio or location snapshot. Blocking/muting and reporting controls remain in the app.

A Home calendar subscription URL is a secret access link, not an unrestricted public feed. Anyone holding that URL can read the exported Home-visible plans and eligible Circle events without signing in. Subscribing in an external calendar shares those exported details with that calendar service. Protect the URL; external calendar copies have their own retention and deletion rules.

When you submit a Circle announcement for publication, its text and any attached image are sent to an AI provider for a safety check before it can be published. The app asks for the relevant AI-sharing permission in this flow. This check is separate from a person's review of reported content.

If you connect selected device calendars, the app sends event titles, locations, start/end times, all-day status and source identifiers to our servers to preview and import them into your Home. Refreshes update those copies under your saved choices. Automatic refresh is optional and runs when the app opens or returns to the foreground, not continuously in the background.

When you choose a ride or shopping hand-off, the app can put destination coordinates in a link, or copy an address or your unchecked grocery items to the device clipboard before opening the other service. The copied list is for you to use there; it is not an automatic cart transfer. Chat links open through your device's link handler. External apps and sites receive the information you choose to send and ordinary request data under their own policies.

Location and maps

Weather may use a typed Home city or optional foreground device coordinates rounded on the device to roughly a kilometre. Weather requests do not create a stored device trail. There is no background tracking or geofencing.

Event/errand addresses and saved-place coordinates may be retained with their records. A one-time chat location can contain a precise point, capture time and accuracy, or a selected place ID; it follows message/report retention. Static map previews send the relevant point/place information to a maps provider. Viewing a preview does not start tracking the viewer.

Turning on Start routes from where I am sends foreground device coordinates, rounded on the device to roughly a kilometre, to our API and a maps provider for routes, the day map and leave alerts. The day-map origin is held in temporary server storage for ten minutes. A temporary leave-alert route cache can retain rounded origin and destination coordinates for up to fifteen minutes with a successful route result, or five minutes when no route result is available; the resulting duration and alert time can remain with the notification job. These limits describe our handling, not a promise about the maps provider's retention.

CocoAssist, capture and voice

AI features are optional and metered. Flyer capture and food-photo lunch suggestions send the images you select to an AI provider. Typed Assist sends your question and authorized schedule context, which may include child names, events, errands, saved places and permitted Circle context. When you ask from a selected child profile, the app can automatically include that authorized child's age, allergies and interests in context sent to the configured AI provider, separately from what you type. Avoiding sensitive words in your question does not prevent that context transfer. Avoid unnecessary sensitive information in photos, prompts and free text. Stored child-profile photos are not used as image-generation inputs; illustrated avatars use the description you submit.

Live Voice streams your speech and authorized context to the configured provider; dictation sends audio for transcription. Live audio is not retained as an app recording, but transcript/chat/history and provider processing can have separate retention. Voice-note messaging is a different feature and stores its audio. AI answers can be wrong; proposed plans stay drafts until you review and confirm them.

Saved chat history and explicit Memory preferences are separate. Memory is private to the adult, does not automatically learn from chats and has separate use permissions for typed Assist and Voice. Saved history expires one year from creation, calculated in UTC, unless you delete it or account erasure removes it sooner. Memory preferences have no automatic expiry; they remain until edited, forgotten or removed through account erasure. Forgetting a preference does not remove its words from saved conversations; delete the relevant history too.

Studio can send a selected Home photo or event cover, together with your editing instruction, to an AI provider after you confirm sending that image. A Home photo can include children; the rule about stored child-profile photos does not exclude children appearing in a Home photo. Selecting an image alone does not send it to the AI provider.

For local-event questions, Assist sends your question, including the place and dates you give, to an AI provider that can search the web. Choosing an event result opens the external page in an in-app browser, with the system browser as a fallback. The external site's own privacy practices apply.

Plus subscriptions

Plus is bought through the Apple App Store or Google Play, which process the payment under their own terms and privacy policies; we never receive card or bank details. Our subscription-management provider receives your account's random app identifier and the store's record of the subscription (product, store, dates, trial, renewal and billing status) and confirms it to our server. The purchase library in the app talks to that provider directly. It is not given your name, email or other profile information and sets no advertising or attribution identifiers; that provider still receives ordinary technical request data such as IP address, device type and app version.

We store, for the purchasing adult, which subscription they hold, its period and grace dates, renewal and billing status, store and the Home it covers. Other adults in that Home see that it is on Plus and may see the payer's first name; only the payer sees a billing problem. Store notices of subscription changes are kept up to 90 days. If the purchaser deletes their account, the subscription record is kept until the subscription has ended in the store (when it is cancelled there, or the store stops renewing it, for example after a failed payment) and any store grace period has passed; it is then deleted. Until then the Home keeps the period that was paid for.

Service providers and support

Our cloud hosting provider hosts the API/database, object storage and queues, and delivers sign-in/support emails. Apple/Google provide sign-in and device push delivery through our push delivery service, and the App Store and Google Play process Plus purchases. Our subscription-management provider manages Plus subscription records. An AI provider processes AI chat, web search, capture, transcription, voice, image generation/editing and announcement safety checks. A maps provider supplies places, routes and map pictures. Apple WeatherKit and another weather data provider supply weather and geocoding.

Our error-monitoring provider receives configured crash/error diagnostics, including an installation identifier. Our push delivery service receives a push token and an installation identifier when registering the app. Our app-update delivery service receives a per-installation identifier and technical request details when the app checks for updates on launch. These identifiers are pseudonymous, not anonymous. These services can communicate directly from the device, not solely through our API. The production app does not send product-analytics events. The app applies source-level filtering to tokens, cookies and sensitive diagnostics; provider processing and retention can differ from our own.

Contact Us sends the note you choose, account identifiers and reply-address context to our support workflow. It does not attach your chats, calendar, photos or microphone recordings. Emailing support uses your email provider as well as the support mailbox. Do not send passwords, sign-in codes or unnecessary child/medical details.

The app has no advertising SDK or implemented sale-of-data feature. Providers process information to deliver their listed services under their own arrangements. We do not promise that every provider immediately erases copies when you delete an account. Contact us with questions about a particular provider or data transfer.

Why we use information

Information is used for account access, the organization features you request, communications, safety/report handling, abuse prevention and reliability. Optional camera, photos, microphone, location, calendar and notification permissions are requested for the corresponding feature; you may decline them and use other available features.

We use information to provide the services you request, protect accounts and other families, comply with applicable duties and understand product reliability. Where a separate choice is required for optional processing, we ask for it in the relevant flow. Device permission alone does not authorize every use of personal information. Privacy rights and the applicable legal basis for a use can vary by location; contact us to make a request or ask about a specific use.

App requests expose an IP address to our API. We use it and derived abuse-limit records to enforce request limits and protect sign-in, including email sign-in. Security records can have separate retention from the content you create or delete.

Retention and deletion

Content generally stays until removed, the applicable feature expiry runs, or account deletion is processed. Conversations can retain messages indefinitely or use the available 30/90/120-day retention choices. Read notification inbox entries older than 90 days are pruned. Unread notifications are not removed by that pruning job. AI capture draft/error content is cleared after 35 days; usage metadata and food-capture subject metadata remain. This is not deletion of every capture record. Reports/evidence have separate safety retention; an open case can delay erasure of its evidence.

Child removal first hides the profile and then follows the child-purge/restore-window process. Private saved media copies follow their source's takedown rules. These jobs and account deletion do not instantly erase backups, provider copies or copies another person made. Recovery, security, safety, dispute and legal records may be kept separately when needed; contact us about a particular request.

Open your photo menu → Settings → Delete account. Read the consequences, type DELETE, then choose Delete my account forever. Opening this page or the confirmation screen does not delete anything.

After the server accepts deletion, access and sessions are revoked immediately. Erasure runs in a background job; failures are retried a bounded number of times and then escalated to an operator. Immediate loss of access is not a promise that every stored copy has already been erased. Apple authorization revocation is attempted when available.

Your account/profile, personal media, private events, errands, notification records, Assist history/preferences and your messages are scheduled for removal. Messages you sent appear as removed. Events you host in a Circle are cancelled; their public page and associated event conversation become unavailable.

Shared Home calendar entries may stay with remaining adults, without your authorship. If other adults remain, the Home and child profiles may remain for them; your access and guardianship are removed. If you are the last guardian, the earliest-joined remaining adult—including a helper—is automatically promoted to guardian. Child profiles left without a guardian are assigned to a remaining guardian; this can give that adult authority over child records and photo-sharing controls. Review the remaining adults before deleting your account. If you are the only adult, the Home and its child profiles are deleted. A Circle may continue for other members; a Circle with no remaining members closes.

Other people may have downloaded or copied content outside the service. Backups, security records, reports and provider-held copies can remain after account removal when needed for recovery, safety or legal duties. Account deletion does not promise immediate erasure from every system. Contact us about the status of a specific deletion request.

When a Circle closes, exact evidence already captured for open reports can remain for an eligible reviewer while ordinary account and Circle deletion continues. This keeps no full thread or unrelated media. Retained orphan media becomes eligible for cleanup 90 days after its original quarantine; transferred text-only captured evidence expires 90 days after original filing, including when no reviewer is available. Earlier eligible expiry or closure still applies; transfer restarts no clock. Automatic expiry is not a human verdict. Report metadata and backups have separate handling; this does not promise immediate erasure from every system.

Deleting your account does not cancel a Plus subscription bought through the Apple App Store or Google Play; it keeps renewing until you cancel it in that store's subscription settings or the store stops it. The Home it covers keeps Plus until the period already paid for ends. The subscription record is deleted once the subscription has ended in the store.

Your choices and requests

Use profile visibility locks, guardian child-sharing controls, conversation retention, Memory/history controls, notification preferences and Home weather settings. You may revoke device permissions in your operating system, leave a Home/Circle, disable an invite you control, block/mute or report content. These actions do not necessarily erase previously shared records or recipients' external copies.

Contact admin@joincococircles.com to request access, correction or deletion, or raise a privacy concern. We verify the requester before disclosing or erasing account information and respond under the rules applicable to the request. Do not email identity documents unless a secure process specifically asks for them. If you have a right to complain to a privacy authority, you may exercise it.

Website and changes

The legal and support pages contain no analytics, cookies, forms or remote fonts. Hosting still receives ordinary request and network metadata for service operation and security; other pages may have different resources.

This Policy is effective 2026-10-09. We will date material changes here and provide additional notice or seek renewed consent when applicable law requires it. Viewing this page does not itself record agreement or SMS consent.