Privacy — Coco

Your conversations belong to you. This policy explains what Coco stores, why, who helps us run it, and the choices you have. It applies to cocoreflect.com and everything you do on it.

Who we are

Coco is operated by ACE AI Spark, Inc. (“we”, “us”), which is responsible for your personal data (the “controller” under EU and UK data protection law). You can reach us at contact@aceaispark.com. More details are in our Impressum.

What we store

Account: email address, display name, timezone, preferences, sign-in method.
Conversations: chat messages, call transcripts, short summaries, duration, and a mood score.
Memories: facts, preferences, goals, and concerns taken from your conversations.
Billing: plan, credit used, and a Stripe customer reference. Never card details.
Technical: the minimum needed to keep you signed in and the service secure.

What you share with Coco may include things about your feelings, relationships, or health. The law treats this as sensitive data. We only process it because you ask us to, with your explicit consent, which you give when you start using Coco. You can withdraw it at any time by deleting your conversations, memories, or account.

Why we use it

To run Coco for you: reply to you, remember what matters to you, and show your history (to perform our agreement with you, and with your explicit consent for sensitive data).
To keep people safe: to notice crisis language and show crisis resources (with your consent and, where someone may be at risk, to protect vital interests).
To take payments and keep records the law requires (legal obligation).
To keep the service secure and fix problems (our legitimate interest in a safe, working service).

We do not sell your data, we do not use it for advertising, and we do not use your conversations to train AI models.

Who else handles your data

To run Coco, your data passes through a few services that work on our behalf:

Supabase: stores your account, conversations, and memories.
Vercel: hosts the website.
Anthropic (Claude): writes Coco's text replies, summaries, and reflections.
ElevenLabs: runs voice calls.
ACE AI Spark and Tavus: run video sessions with Coco's avatar.
Stripe: handles payments. We never see your card details.
Resend: sends account emails, such as sign-up confirmation, and daily check-in emails if you turn them on.

These providers are mainly based in the United States, so your data may be processed outside your country. Where the law requires it, these transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses in the providers’ terms.

Who can see your conversations

No person is on the other side of your conversation with Coco. We don’t read conversations. While Coco is in beta, a small team may look at a conversation only when it’s needed for safety, for example when crisis language is detected, or to fix a problem.

How long we keep it

We keep your conversations and memories until you delete them or your account. Billing records are kept as long as tax law requires. Our providers may keep short-lived copies and backups for a limited time under their own terms.

Your rights

See and download your data: Settings → Download my data.
Delete any memory (Memory or Settings) or conversation (History).
Delete your entire account and all its data: Settings → Danger zone.
Correct your data, restrict or object to how we use it, or withdraw consent: email us.
Complain to a data protection authority, for example the one where you live. In the EU this is your national supervisory authority.

If you live in Indonesia, you have the rights set out in Law No. 27 of 2022 on Personal Data Protection (UU PDP), including to access, correct, delete, and withdraw consent, and you can use the same routes above.

Cookies and local storage

Coco uses no advertising or tracking cookies and no analytics. We only store what the site needs to work: your sign-in session, your light or dark theme, and small notes such as today’s check-in, kept in your own browser. Because these are strictly necessary or set by you, no cookie consent banner is needed. If this ever changes, we will ask you first.

Age

Coco is for adults 18 and over. We do not knowingly collect data from anyone younger. If you think a child has used Coco, email us and we will delete the account.

Not medical care

Coco is an AI companion for reflection. Nothing we collect is used for clinical or diagnostic purposes.

Changes

If we change this policy in a way that matters, we will tell you in the app before it takes effect.