Privacy Policy
Cofoxi is operated by Akanksha, Germany. Full legal-entity and postal details are in the Impressum.
We tried to write this in plain language. If anything here is unclear, contact us (see §12) and we'll explain — or fix the wording.
1. What Cofoxi is
Cofoxi is an ambient co-presence app: you join a small room with a handful of other people who are also focusing, and share audio and video during a timed session. Each room has a text chat. There are also solo focus features that don't involve other people.
2. Data we collect
Sign-in: when you create an account, we receive your email address. If you sign in with Apple or Google, we also receive the name from your provider (or an Apple relay address if you use Hide My Email). If you sign up with an email and password, your password is handled securely by our authentication system and is never stored in a readable form. We never receive your payment details — those are handled by Apple.
Profile you set: display name, profile emoji, preferred language, notification schedule.
Focus activity: how you use Cofoxi — session count, time, streaks, and activity points — plus a short record for each session.
Live session: your camera, microphone, and — if you write one — a short check-in note are shared with others in your room during a session (see §4). This is not saved after the session ends.
Chat: while you're in a chat, your messages are visible to others in the room. Themed-room chat is wiped daily; user-created-room chat is wiped when the timer completes or the host ends the room. Carve-out: reported messages are kept with the report (see §5).
Safety tools: when you hide or report someone, we store the information needed to make that feature work. Your hide list is private to you and reversible anytime from Profile → Hidden people.
Moderation reports: when you report a user or a specific message, we record the report and the context our team needs to review it. Reports include identifying info about you and the reported party and the reason you selected. When reporting a participant, you can also attach a screenshot (kept with the report, not publicly readable). Retention is in §5.
Purchases and trial: we keep the minimum needed to grant paid features and to prevent the one-time free trial from being claimed more than once.
Terms acceptance: we record when you accepted our Terms and acknowledged this Policy, to administer your account.
On your device only: Cofoxi runs no third-party analytics or crash-reporting on your device. Anything stored locally is what's needed to keep you signed in and to run offline features.
3. What we use it for + legal bases
We use your data to run the app (authentication, sessions, chat, subscriptions, notification schedule), to keep the community safe (moderation, hiding, bans), to prevent free-trial abuse, and to comply with our legal obligations.
Legal bases (GDPR Article 6):
- 6(1)(b) — performance of a contract with you: running the app, recording Terms acceptance.
- 6(1)(f) — legitimate interests: moderation, anti-abuse, enforcement records after deletion, website operations.
- 6(1)(a) — consent: the waitlist signup on cofoxi.com.
Where we rely on legitimate interests you can object at any time (§6) — we'll assess whether your objection outweighs our interest.
We do not use your data for advertising, cross-app tracking, or profiling.
4. Service providers
We work with a small number of providers, each under GDPR Article 28 processing agreements (or Apple/Google's equivalent standard terms):
- Cloud backend and file storage — store your account, profile, focus history, and moderation records.
- Real-time audio/video — handles the live audio and video during your sessions. We do not record.
- Apple — for Sign in with Apple, subscription purchases and renewals, and platform anti-abuse.
- Sign in with Google — used only if you pick Google to sign in.
- Email delivery + team mailbox — used to send and receive moderation notifications.
- Website hosting — serves cofoxi.com; like any website, your device's IP address is briefly visible to the hosting provider.
International transfers
The core of your data stays in the EU. Some providers process outside the EU (typically in the US); for those, transfers are covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses per each provider's Data Processing Addendum. If any provider loses adequacy or DPF status we update this section.
5. How long we keep things
| Data | Retention |
|---|---|
| Account, profile, focus history | Until you delete your account |
| Live session data | Only while you're in the room |
| Chat in themed rooms | Wiped daily |
| Chat in user-created rooms | Wiped when the timer completes or the host ends the room |
| Reported message text, moderation reports, screenshots | 3 years after the report is closed. Longer where tied to an active ban, unresolved safety incident, or legal matter — reviewed periodically. |
| Enforcement records + anti-abuse controls | Retained after account deletion (see §7) |
| Data stored only on your device | Cleared when you sign out or uninstall |
6. Your rights
Under GDPR you can:
- Access — ask for a copy of the data we hold about you
- Rectify — correct anything inaccurate (or edit name/emoji yourself in the app)
- Erase — delete your account from Profile → Delete account (see §7)
- Restrict / object — pause or stop processing based on legitimate interests
- Portability — ask for an export of your profile data
- Complain to a supervisory authority — for us that's the state authority for Hessen (HBDI — Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden)
To exercise any of these, contact us (see §12) from the address on your account. We respond within a month (GDPR Article 12(3)).
7. Account deletion — what goes and what stays
Delete your account from Profile → Delete account.
Removed: your account, your profile, your focus history, and any local data on your device.
Retained (legitimate interests, GDPR Article 6(1)(f) — enforcing Terms, keeping moderation history accurate, preventing trial abuse):
- Moderation reports you appear in (whether you filed or were named in them). Reports are permanent once filed.
- Report screenshots you attached.
- Anti-abuse controls preventing repeat free-trial claims.
- A ban record if your account was terminated.
- Traces of you in other users' Hidden-people lists — the minimum needed for them to still hide you effectively.
To also remove your waitlist signup from the website's backend, contact us (see §12) from the same address you signed up with.
8. Children
Cofoxi is intended for people aged 13 and over. If we learn that someone under 13 has created an account, we'll delete it. If you believe a child under 13 is using Cofoxi, please contact us (see §12) and we'll act quickly.
9. Moderation
Someone on our team reviews every report within 24 hours — this is the commitment in our Terms (also required by App Store Guideline 1.2). Depending on severity we take appropriate action, up to and including terminating the reported account. A terminated account cannot rejoin Cofoxi. If a report you filed never seems to have been reviewed, email us.
10. The website (cofoxi.com)
The marketing site is separate from the app. Waitlist data is not linked to app accounts. The waitlist database is in the EU.
Waitlist signup collects your email address and context about the signup: the page you submitted from, how you reached us, your browser's language, and your browser's user-agent string (which describes your browser and device type). When you submit the form, we also look up your approximate location — city, region, and country — from your IP address, using a third-party geolocation service (GeoJS, geojs.io; if unavailable, ipwho.is). Your IP address is used only for this lookup and is never stored by us; we keep only the returned city, region, and country. The lookup happens only when you submit the form, never while you browse. If it fails or is blocked, your signup still works and no location is saved. We use this information to contact you about Cofoxi and to understand where interest in Cofoxi comes from.
Server logs. The hosting provider keeps standard short-lived server logs, used only for troubleshooting and abuse investigation.
Cookies + analytics: none. No first-party cookies, no third-party analytics or tracking scripts. The only third-party request we make is the geolocation lookup described in the waitlist section, and only when you submit the waitlist form.
To delete your waitlist row, contact us (see §12) from the same address you signed up with.
11. Changes to this policy
We may update this policy as Cofoxi evolves. The "Effective" date at the top always reflects the last substantive change. We will notify you of material changes before they take effect where required by law.
12. Contact
- Email: team@cofoxi.com
- Postal address: see the Impressum.
Data controller: Akanksha. Full contact and postal details are in the Impressum.