Privacy Policy

1. Overview

This Privacy Policy explains what CoPact ("we", "our", or "the app") processes, why we process it, which service providers receive it, and how long it is retained. Apple Screen Time usage reports and selected-app identities stay on your device and are not uploaded to CoPact's backend. If you sign in, your account profile is synced as described below. App selections and Apple's Screen Time reports remain on your device. When you use crews, CoPact also stores the shared plans, replies and participation records described in section 8. If you agree to share usage analytics, CoPact records how you use its own features, never which apps.

2. Data that stays on your device

CoPact uses Apple's FamilyControls, ManagedSettings, and DeviceActivity frameworks. CoPact does not upload:

• Screen Time usage reports. App-by-app usage, pickups, notifications, and Screen Time statistics are processed locally through Apple's APIs.
• Selected-app identities. App and category selections used for blocking remain on device and are never uploaded, on their own or as a count.
• Browsing history and personal content. CoPact does not access or upload messages, contacts, browsing history, or content inside other apps. It reads a photo from your library only when you choose one: a screenshot for a problem report (section 3), or your picture for your crews (section 8). The system's photo picker hands CoPact only the photo you tap.
• Apple Health. If you grant it, CoPact reads one Apple Health category, sleep analysis, to sharpen your daily Balance. It is read on your device, never written to, and never uploaded. Declining leaves everything else working.
• Precise location. CoPact does not request precise location permission. Google Sign-In's SDK declares coarse-location and technical-data processing when that sign-in option is used.

3. Data we process

Depending on how you use CoPact, we process:

• Account and sign-in information: Name, email address, Firebase user ID, authentication provider, account timestamps, and credentials or tokens handled by Firebase Authentication, Sign in with Apple, Google Sign-In, or an email address and a password. Google's SDK also declares possible processing of phone number, coarse location, device ID, and other sign-in usage or technical data.
• Purchase information: App Store purchase history, subscription status, product identifiers, entitlement status, and a RevenueCat customer record linked to your Firebase user ID after sign-in.
• Profile metadata: App version, time-zone identifier, and sync timestamps. Signed-in accounts sync this automatically. Profile metadata is separate from shared crew records. CoPact does not upload your selected apps, category tokens, blocklist names or Apple's Screen Time usage reports.
• Usage analytics, only if you agree: CoPact asks during setup, right after your name. Nothing is recorded, and the analytics software does not start, until you agree. If you agree, it records which onboarding steps you reach, when you view the price page and how a purchase attempt ends, the kind, mode and length of the pacts you create, breaks you take, pacts you end early or delete, Emergency Pass use, the days you open the app with how many schedules you have and whether you are in a crew or signed in, invites you share, open or send to friends in the app, crews you join, whether your picture is a photo, a character or initials, whether camera access was denied, how often you block or report someone and, for a report, its reason, your answers to Blue's questions (what you want back, who you're doing it with and who they are to you, and in broad ranges your age, your daily phone hours and how much time you want back), and the size of your crews in broad ranges. It is stored under a random analytics ID linked to your subscription record. It never includes which apps or categories you block, how many, anything from Apple's Screen Time reports, Apple Health data, your name, email, crew names, who you invite, block or report, or anything you type, and your IP address is discarded. If you tell CoPact you are under 16, it stops, deletes what was recorded and keeps the setting off. Turning it off in Settings, then About, also stops it and deletes what was recorded. Saying no changes nothing else in the app.
• Subscription events: For every subscriber, whether or not you agreed to usage analytics, RevenueCat sends subscription events (trial start, renewal, cancellation, billing issues, expiration and plan changes) to PostHog for purchase analytics, under your RevenueCat customer ID, which is your account ID once you sign in, with the attributes CoPact stores on that record. If you agreed to usage analytics, they are joined to your analytics ID. If you delete your account while an App Store subscription is still active, RevenueCat can keep sending its renewal or expiry events to PostHog under your former account ID until the subscription ends. Cancel the subscription in Settings to stop them.
• Problem reports: Settings, then Help, then Report a problem stores a report under your user ID containing the category you picked, what you wrote, the reply address you gave if you gave one, the app version and build, the operating-system version, your device model, your locale and your time zone. A counter of how many reports you have filed is stored alongside them, to cap abuse.
• The diagnostics attached to a problem report: The composer attaches a snapshot of the app's state unless you switch it off, and the switch is on by default. The snapshot holds the phase, enforcement and blocking mode of anything running, its timestamps, counts of tasks and blocklist entries and of the app identifiers inside them, whether uninstall protection and hiding blocked apps are on, whether an Emergency Pass is available or spent, whether a PIN is set, your subscription status, whether Screen Time and notification permission are granted, and whether the phone is in Low Power Mode. It holds counts of blocked apps, never their identities.
• The screenshot, if you attach one: You may attach one image from your photo library to a problem report. It is downscaled and sent with the report, and it is deleted with the report when your account is deleted. Apart from a photo you pick or take for your own picture (section 8), CoPact reads no other photo, and it reads none unless you pick one.
• Diagnostics: Crash traces, app and operating-system state, installation identifiers, and related diagnostic data processed by Firebase Crashlytics, Firebase Authentication, and Cloud Firestore to diagnose failures and measure service reliability.

4. How we use your data

We use this data to authenticate accounts, store your signed-in profile, run crews, validate purchases, restore subscriptions, prevent purchase fraud, answer the problem reports you send, diagnose crashes, measure app and subscription reliability, understand where people get stuck and which features help, and analyse subscriptions. We disclose data to the processors listed below only for these purposes or when required by law. We do not display third-party advertising.

5. Storage, retention and security

Local app data remains on your device until you remove it through the app, delete the app, or erase the device. Synced Firebase account data remains while your account exists and is removed from active CoPact collections when account deletion completes, subject to Google's backup, security, and legal-retention processes.

Google states that Firebase Crashlytics retains crash traces and associated installation identifiers for 90 days before removal begins. RevenueCat and Apple may retain purchase and customer records as needed to validate entitlements, prevent fraud, operate subscription analytics, and meet financial or legal obligations.

PostHog (PostHog Inc., EU Cloud in Frankfurt) holds usage analytics and subscription events. Turning usage analytics off or telling CoPact you are under 16 deletes your usage analytics there, and deleting your account deletes your records there, each about an hour after the request.

Firebase encrypts supported data in transit and at rest. No internet service can guarantee absolute security.

6. Processors

• Google Firebase Authentication and Google Sign-In process account, profile, credential, identifier, and SDK diagnostic data for sign-in, account security, and authentication analytics. Firebase Authentication is processed in US data centers.
• Google Cloud Firestore stores your signed-in profile and your problem reports. The crew data described in section 8 is stored there too.
• Google Firebase Crashlytics processes crash and diagnostic data for app stability and troubleshooting.
• Resend delivers every problem report to our support address by email. Resend receives the message, your user ID, the report ID, your reply address if you gave one, the app and device facts above, the whole diagnostics snapshot if you left it attached, and the screenshot as an attachment.
• Google Cloud Functions handles delivery of problem reports and crew operations, including scheduled pacts, notifications, shared summaries and account erasure, and forwards requests to delete usage analytics to PostHog. These functions access the data needed for those operations.
• PostHog (PostHog Inc., EU Cloud in Frankfurt) processes usage analytics and subscription events on our behalf. Section 5 says when your records there are deleted.
• RevenueCat and Apple StoreKit process purchase history, identifiers, and entitlement data for payment validation, subscription access, restore purchases, fraud prevention, and subscription analytics.
• Apple Sign in with Apple and Screen Time services provide optional authentication and on-device blocking and report functionality under Apple's privacy terms.

7. Account deletion and your rights

Depending on where you live, you may have rights to access, correct, or delete personal data and to object to or restrict certain processing.

• Use Settings, then Account, then Delete Account to remove your Firebase account, your synced Firestore profile, your problem reports with anything attached to them, your crew reports, your friends list and invites, and your picture. Section 8 describes what deletion does to your crews.
• Manage or cancel an App Store subscription separately in Apple's subscription settings. Deleting a CoPact account does not cancel it.
• Contact us for an access, correction, deletion, restriction, or objection request.

Apple, Google, and RevenueCat may retain records where needed for security, backups, transaction validation, fraud prevention, or legal obligations. Contact privacy@copact.app for requests not completed in the app.

8. Crews

Crews arrived in CoPact 3.0. This section describes what CoPact 3.1 stores.

Crews require an account. Solo blocking works without signing in. Creating or joining a crew needs a signed-in account, because the people in a crew have to be able to see each other.

What is stored when you create or join a crew.

• Crew and membership. CoPact stores your crew's name, chosen relationship illustration, owner, creation time, time zone, member IDs and member permissions. Member records contain display names, pictures (a character, or the version label of a photo), roles, joining times and each member's invite link. Shared counters and pointers identify current and next planned pacts.
• Invites. A link contains an opaque token. Its record identifies its crew and sharer, creation information and the crew's invite revision. A new invite revision invalidates older links for joining. The preview contains the crew name and relationship illustration, member count, sharer's display name, the sharer's character if they picked one (never a photo) and, when available, the next pact's terms. A person holding a valid link can read its preview before joining, signed in or not. The preview does not list every member's display name. An invite sent to a friend in the app is stored on your account and delivered to theirs; it carries the crew name, your name and the invite code.
• Plans and repeating plans. CoPact stores chosen weekdays, start time, duration, time zone, Flexible or Strict terms, activity, creator, active status and the IDs of members counted in. Individual occurrences store their agreed times, plan revision and repeating-plan reference. Your reply contains your member ID, In or Out answer, time and accepted plan revision.
• Participation and votes. Each pact stores its state, actual start and end, early start, ending reason, who started or planned it, and whether members kept it together. Participant records contain joining and leaving times and status. Strict end votes and member reminders are linked to their senders and recipients.
• Shared history. Feed events contain actor identity, display name, event time and relevant pact terms or outcome, such as a vote, an opening or Emergency Pass use. Monthly summaries record kept pacts and time together, including each member's contribution. Other members can see this shared participation history. They cannot see your app selections or Screen Time reports.

What other members see. Your display name, your picture (a photo, a character or your initials), and what you did in crew pacts. Members never see your app or category selections, your blocklists, or your Screen Time reports, because those never leave your device.

Your picture. You can add a photo, pick a character, or keep your initials. A photo is resized on your phone to two small copies and stripped of location and camera details before it leaves your phone. It is shown only to the people in your crews, in the app, on their Lock Screen and in crew notifications on their phones. Your photo is never in an invite link, a shared image or on the website; a link's preview shows the sharer's name and, if they picked one, their character. Phones drop a photo once they no longer share a crew with you. It is deleted when you change or remove it, leave a crew, are removed from it, or delete your account. You can report a person for an inappropriate picture; reports go to us at support@copact.app and we review every report.

Friends. CoPact remembers the people you share or have shared a crew with, with their name and, if they picked one, their character, so you can invite them again. That list, and the people you removed or blocked, is kept on your phone and in a private backup that only you and our server can read. Our server reads your blocked list to drop invites from people you blocked, without telling them. An invite you send in the app is kept on your account until you withdraw it or delete your account, and waits on your friend's account until they answer or you withdraw it. Deleting your account deletes all of it.

Push notifications. While signed in, CoPact stores an FCM device registration token and update time for crew push delivery. Settings offers Pact activity, Planned pacts, Reminders from your crew and Monthly story. Their preferences are stored on your account and checked when the server sends. Turning one off keeps the token so other enabled categories can still arrive. Turning off Notifications disables all four categories. An offline preference change takes effect on the server after it syncs. Signing out requests token removal, and account deletion removes the user profile. APNs and Firebase Cloud Messaging deliver the notifications.

Retention. Crew membership lasts until departure or crew deletion. Shared kept pacts and monthly stories can remain for the crew's history. Other ended or cancelled pacts and feed events carry 90-day expiry timestamps. Current invite records use revision invalidation and do not carry an automatic expiry date. An expiry field does not by itself delete a record. Until automatic deletion is confirmed for the deployed database, these records may remain until crew deletion, account erasure or a removal request. Account erasure removes account-linked records while preserving anonymized shared history.

Leaving a crew. Open the crew, tap More, then Leave Crew. Leaving removes your membership, your member record and your picture in that crew, and writes one neutral row to the feed saying you left. While you are in a Strict pact that is still running, leaving waits until it ends. If you own the crew, it passes to the person who has been in it longest.

Deleting your account. Settings, then Account, then Delete Account. In-app account deletion removes your profile, problem reports, crew reports, friends list and invites, and requests server erasure from crews. The server removes membership, standing repeating-plan membership, replies, participation, votes, linked reminders, individual month attribution and your picture in every crew. It replaces linked author identities in shared history and plan records with an opaque former-member identity, shown as "Former member". Other members' records remain. If an owner leaves a surviving crew, ownership passes to a remaining member, and an empty crew and its descendants are removed. This cleanup can finish after the app completes sign-out. Apple subscriptions must be cancelled separately.

Reporting a crew member. A report about another member is stored under your user ID and holds the crew, that member's user ID, the reason you chose and up to 2000 characters of free text. Other members, including the person reported, cannot read it.

The camera. CoPact asks for camera access to scan a crew invite code and to take your picture. The camera runs only while the scanner or the photo screen is open. A scanned code is read and nothing is kept. A photo you take is cropped and resized on your phone into the two small copies described above; the full picture is never saved or uploaded. Choosing a photo from your library needs no camera or photo access: the system picker hands CoPact only the photo you tap.

Processors this section adds to section 6.

• Firebase Cloud Messaging and Apple's Push Notification service deliver crew notifications. The message itself carries the crew name, the name of the member who acted, their user ID and the pact's length. Your phone uses the ID to add the sender's picture from its own copy; the message does not carry the picture.

9. No tracking

CoPact does not use data to track you across apps or websites owned by other companies for targeted advertising or advertising measurement. We do not use IDFA, sell personal data, or provide data to data brokers. Analytics data is never used for advertising or shared with data brokers.

10. Children's privacy

CoPact is designed for individual use and is not directed at children under 13. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy as CoPact, its processors, or legal requirements change. The current version and effective date will be posted on this page.

12. Contact

Questions about this Privacy Policy? Contact us at privacy@copact.app.