Privacy Policy

Version 2026-09-29 · Last updated 29 September 2026

PLACEHOLDER — NOT YET BINDING. The data controller is [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], company number [COMPANY NUMBER]. Contact for privacy matters: [email protected]. A data protection officer is [APPOINTED / NOT REQUIRED — decide and state which]. These placeholders must be replaced, and this document reviewed by a qualified lawyer, before CozBio is offered to the public. It is a competent starting draft, not legal advice.

This policy explains what CozBio collects, why, and what happens to it. It covers the CozBio mobile app and website.

1. What we collect

Account details — your email address and password (stored only as a cryptographic hash, never in readable form), and your date of birth, which we need because CozBio is 18+.
Profile — display name, bio and photo, if you add them.
Content you create — videos, live streams, chat messages and gift messages.
Transactions — coin purchases, gifts, content purchases, refunds and payouts. Purchases are processed by Apple or Google; we never see your card details.
Payout details, if you are a creator — bank account or IBAN and tax identifier. These are encrypted at rest with a key held outside the database, and are shown masked everywhere except to the small number of staff who process payments.
Safety records — reports you file or that are filed about you, blocks you make, and moderation decisions.
Technical data — IP address and basic request information, used to operate the service, apply rate limits and investigate abuse.

We do not sell your personal data, and we do not use it for advertising profiling.

2. Why we use it, and on what legal basis

To provide CozBio — performance of our contract with you.
To keep people safe — moderation, reports, blocks, suspensions: our legitimate interest in a safe service, and compliance with legal obligations.
To verify you are 18+ — legal obligation and legitimate interest.
To take payments and make payouts — contract, and legal obligations for accounting and tax.
To prevent fraud and abuse — legitimate interest.

3. Who we share it with

Only with the providers that run the service, each processing data on our instructions:

Replit — application and database hosting;
Cloudflare — profile photo storage (R2) and this website;
Cloudflare Stream — video storage and delivery;
LiveKit — live streaming;
Resend — transactional email, such as password resets;
Expo, Apple and Google — delivery of push notifications, if you allow them;
Apple and Google — in-app purchases.

We also share data where the law requires it, and we report child sexual abuse material to the relevant authorities.

4. Deleting your account

You can delete your account at any time from Profile → Delete account in the app, or by writing to [email protected]. There is also a deletion request page.

Deleted immediately:

your email address, replaced with an unusable placeholder so the real address is released;
your password;
your display name, bio and photo;
your bank, IBAN and tax details, including the encrypted copies;
the text of your chat and gift messages;
any outstanding password reset link.

Your videos and live streams stop being available to anyone immediately.

Kept, and why:

Payment, coin purchase and payout records — we are required to keep these for accounting and tax, typically for [RETENTION PERIOD — commonly 6–10 years, set per jurisdiction]. They no longer carry your name.
Moderation records, where there are any — so decisions about safety stay reviewable.
Reports you filed — so a decision made on them stays reviewable.
An anonymous internal identifier, because those records refer to it. It is not linked to you once the details above are erased.

Any coins in your balance are lost. They are not refundable and cannot be transferred.

5. How long we keep things otherwise

Account data is kept while your account exists. Chat messages are kept while the stream record exists. Technical logs are kept for a short operational period. Financial records are kept for the statutory period above.

6. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, object to or restrict our use of it, and receive a copy in a portable form. In the EU/EEA and the UK these rights come from the GDPR. Write to [email protected] and we will respond within one month.

You may also complain to your local data protection authority.

7. Where your data is held

CozBio's servers and providers are located in [REGIONS]. Where data is transferred outside your region we rely on [TRANSFER MECHANISM — e.g. Standard Contractual Clauses].

8. Children

CozBio is 18+. We do not knowingly collect data from anyone under 18. If you believe a child has an account, write to [email protected] and we will close it and delete the data.

9. Changes

We will publish any updated policy here and, for material changes, ask you to accept it in the app.

10. Contact

[LEGAL ENTITY NAME], [REGISTERED ADDRESS] — [email protected].