Privacy Policy

Introduction

Coji Universe ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use our neurodivergent and chronic illness management platform.

Information We Collect

We collect information you provide directly to us, including:

• Account information (email, preferred name, age, location)
• Health tracking data (energy levels, feelings, sleep, pain scores, and optional daily movement and body-state answers)
• Task and calendar information
• Health data (menstrual cycles, appointments, medications)
• Financial notes and budget information
• Journal entries and personal reflections

Coji Cycle

Cycle tracking is optional. With your explicit agreement, Coji stores the bleeding dates, flow, notes and treatment context you choose to record. Linking your existing energy check-ins is a separate choice. Cycle details are excluded from analytics, marketing, session recordings and AI services. You can turn off linking, export your account data, or delete all cycle records and settings from Coji Cycle. Deleting cycle data leaves your energy check-ins in place. Deleting your account also deletes its cycle records.

Coji Kitchen

Food Profile is optional. With your agreement, Coji Kitchen stores the dietary requirements, allergies, intolerances, medical exclusions, sensory preferences and preparation needs you choose to enter. These details filter food ideas and help order suggestions. They remain in your account until you edit or delete them. You can inspect and delete your profile in Coji Kitchen; deleting it leaves My Foods intact. Optional feelings selected for today stay in memory and reset at the start of a new day.

Saved foods, feedback and cooking progress are stored in your account. Kitchen details are masked from session replay, and food names, profile details and feelings are excluded from Kitchen analytics. Kitchen does not send these details to an AI recipe service. Your account export includes Kitchen records. Deleting your account deletes these live records; backup copies follow the database provider's retention arrangements.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Personalise your experience and provide tailored recommendations
• Analyse trends and patterns in your health and energy data
• Communicate with you about updates and features
• Ensure the security and integrity of our platform

Capacity Check (Beta)

Capacity Check stores your functional answers, activity and recovery reports, goals, event boundaries and quiet settings privately in your account. Calendar context uses events already synced into Coji. Coji no longer connects to device health stores or imports health summaries.

You can disable health context in Capacity Check to remove imported summaries and their saved forecast inputs. Device permissions are managed in your health app. Choosing “Help me interpret this” sends the current question and your answer to Coji's configured language provider (OpenAI by default); the suggestion is reviewed before use. Ordinary option-based assessment answers do not need this external language step. Answer text and health values are excluded from product analytics, and capacity screens are masked from session replay.

Data Storage and Security

Your data is stored securely using Supabase, a trusted database provider with enterprise-grade security. We use encryption, secure authentication, and row-level security policies to protect your information. Your data belongs to you, and we will never sell or share it with third parties without your explicit consent.

Third-Party Services

We integrate with the following third-party services:

• Google Calendar: If you choose to connect your Google Calendar, we access your calendar events and can add tasks to your calendar. We only access the calendar data you explicitly authorise.
• Microsoft Outlook: Similar to Google Calendar, we only access Outlook calendar data with your permission.
• Pendo: Product analytics, so we can see which parts of Coji are helping and which ones need more work. Pendo receives two things: a random identifier that only we can link back to you, and the pages you open. That is the whole list.
• PostHog: Product analytics, hosted in the EU. PostHog receives your account identifier, your email address, the pages you open, and the buttons and links you use. It is how we work out which tools earn their place and where a screen gets confusing.
• Microsoft Clarity: Session replays and heatmaps, so we can see how a screen actually behaves and fix the parts that fight you. Your journal entries and your assessment answers are masked, so they are hidden from the replay before it ever leaves your device.
• Sentry: Error and crash reporting, so a bug that hits you reaches us without you having to write in. Sentry receives the error and the page it happened on. Email addresses, identifiers and access tokens are stripped out before a report is sent, and where a recording is attached to an error, all text and images in it are masked.

These services have their own privacy policies, and we encourage you to review them.

Calendar and energy context

The daily sleep and activity questionnaire and device health integration have been retired. Coji does not request Google health permissions or import sleep, steps or heart-rate data. Forecasting uses your recorded energy and permitted calendar context. Missing data stays unknown.

Personal energy forecast

Energy Forecast is a beta estimate. Your reported energy takes priority. If you choose saved feedback, Coji stores your optional fit and usefulness responses separately from the prediction, and records which saved forecasts you viewed to measure participation. These responses are not energy scores and are not sent to product analytics. Opting in also allows grouped evaluation of this beta, restricted to cohorts of at least 20 people. Individual health assessments are not shared with employers. You can stop feedback collection and delete responses, export your forecast data, or clear saved forecast learning in Analysis. Forecasts and linked responses are cleared daily once their forecast date is over 180 days old. Correcting or deleting a source check-in clears derived forecast learning and linked responses. New forecasts can begin learning again from the check-ins you keep. No wearable permissions or integrations are added.

Coji compares forecasts with your energy check-ins to learn your own patterns. Forecasts can use permitted calendar timing and weather alongside recorded energy. Calendar events do not prove that activity happened. Connected sources lets you control these inputs.

Your Rights

You have the right to:

• Access, update, or delete your personal information
• Export your data in a portable format
• Withdraw consent for data processing
• Request deletion of your account and all associated data

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you delete your account, we will permanently delete your data within 30 days, except where we are required to retain it by law.

Children's Privacy

Coji Universe is designed for users aged 13 and above. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.

Subscriptions and Payments

When you purchase a subscription through Coji Universe, payment is processed by:

• Stripe: for web and PWA subscriptions. Stripe's privacy policy applies to payment data.
• Google Play Billing: for subscriptions purchased through the Android app. Google's privacy policy applies to payment data.

We do not store your payment card details. Subscription status is synced to our database so your access is consistent across all platforms. You can cancel your subscription at any time through the Google Play Store or your account settings.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date below.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at: hello@cojiuniverse.app