# Privacy Policy Last updated: January 2025 ## 1. Introduction CozyTwo ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service. CozyTwo is a platform for couples to watch videos together and share intimate relationship-building activities. ## 2. Information We Collect ### 2.1 Account Information When you create an account, we collect: - **Email address:** Used for authentication and account recovery - **Display name:** Your chosen name shown to your partner (up to 20 characters) - **Avatar URL:** Optional profile image you provide - **Timezone:** Auto-detected or manually set for scheduling features ### 2.2 Google OAuth Data If you sign in with Google, we receive your email address, name, and profile picture from Google. We do not receive or store your Google password. ### 2.3 User-Generated Content We store content you create, including: - **Chat messages:** Text messages and image URLs shared with your partner (up to 2,000 characters) - **Journal entries:** Personal journal entries with mood tracking (up to 5,000 characters) - **Daily question answers:** Your responses to relationship prompts (up to 2,000 characters) - **Shared notes:** Collaborative notes in your shared room (up to 10,000 characters) - **Calendar events:** Events, dates, and busy times you create - **Status updates:** Your status text and emoji (up to 100 characters) - **Accountability items:** Custom goals and check-in history - **Wishlist items:** Movies, shows, and videos you want to watch - **Message reactions:** Emoji reactions to chat messages ### 2.4 Payment Information Payment processing is handled entirely by Stripe. We do not store your credit card numbers, CVV codes, or full payment details. We only store: - Stripe customer ID (a reference to your Stripe account) - Subscription status and tier (free, yearly, or lifetime) - Subscription period end date ### 2.5 Technical Data We automatically collect: - **Browser type:** For compatibility warnings (e.g., in-app browsers) - **Timezone:** Detected via your browser for scheduling features - **Session tokens:** Stored as secure HTTP-only cookies for authentication ## 3. How We Use Your Information We use your information to: - Provide and maintain the CozyTwo service - Authenticate your identity and secure your account - Enable features like synchronized video playback and real-time chat - Process subscription payments through Stripe - Send authentication emails (magic links for login) - Display your content to your linked partner - Provide customer support when requested ## 4. Information Sharing ### 4.1 With Your Partner When you link with a partner, they can see your display name, avatar, timezone, status updates, and all content in your shared room (chat messages, notes, calendar events, etc.). Your email address is not shared with your partner. ### 4.2 Third-Party Services We share data with the following services: **Stripe (Payment Processing)** Your email address is shared with Stripe to create and manage your subscription. Stripe handles all payment card data directly. [Stripe's Privacy Policy](https://stripe.com/privacy) **Supabase (Database & Authentication)** Your account data and content are stored on Supabase's infrastructure. Supabase provides our database and handles email authentication. [Supabase's Privacy Policy](https://supabase.com/privacy) **Google (OAuth Authentication)** If you sign in with Google, authentication is handled through Google's OAuth system. We receive your basic profile information. [Google's Privacy Policy](https://policies.google.com/privacy) **YouTube (Video Playback)** Video playback uses YouTube's embedded player. Your video search queries are sent to the YouTube API. YouTube may collect its own analytics. [YouTube Privacy Policy](https://policies.google.com/privacy) **Google Fonts** Our website loads fonts from Google Fonts, which may log your IP address and browser information when fonts are loaded. ### 4.3 No Advertising or Analytics We do not use third-party advertising networks, analytics services (like Google Analytics), or tracking pixels. We do not sell your data to third parties. ## 5. Data Storage and Security ### 5.1 Storage Location Your data is stored on Supabase's PostgreSQL database. Session tokens are stored as secure HTTP-only cookies in your browser. ### 5.2 Security Measures We implement the following security measures: - HTTP-only, secure, SameSite cookies for session management - CSRF protection for all state-changing operations - Input validation and sanitization - Rate limiting on sensitive operations (e.g., partner invites) - URL validation with SSRF protection for user-provided image URLs - Row-Level Security (RLS) policies in our database ## 6. Data Retention and Deletion ### 6.1 How Long We Keep Data We retain your data for as long as your account is active. Status history is automatically cleaned up after 12 hours. ### 6.2 Account Deletion Process When you delete your account: - **7-day grace period:** You can log back in to cancel the deletion - **After 7 days:** All your data is permanently deleted, including: - Profile information and avatar - All chat messages, journal entries, and notes - Calendar events, accountability items, and check-ins - Wishlist items and memory board content - Message reactions - Rooms you own (with all associated data) - Stripe subscription (canceled and customer deleted) ### 6.3 Partner Unlinking When you unlink from a partner, your shared room and all its data (chat, notes, calendar, etc.) is permanently deleted for both users. ## 7. Your Rights You have the right to: - **Access:** View your profile and all content you've created - **Edit:** Update your display name, avatar, and timezone at any time - **Delete:** Delete individual messages, journal entries, calendar events, and other content you've created - **Account deletion:** Delete your entire account through Account Settings - **Clear room data:** As a room owner, clear all shared room content ## 8. Cookies We use the following cookies: - **sb-access-token:** Session authentication (HTTP-only, secure) - **sb-refresh-token:** Token refresh (HTTP-only, secure) - **csrf-token:** CSRF protection (HTTP-only, secure) We do not use advertising cookies, tracking cookies, or third-party analytics cookies. ## 9. Local Storage We store your video watch history in your browser's localStorage for your convenience. This data stays on your device and is not sent to our servers. You can clear this data by clearing your browser's local storage. ## 10. Children's Privacy CozyTwo is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will delete that information promptly. ## 11. International Users CozyTwo's servers are located in the United States. If you access the service from outside the United States, your information will be transferred to and processed in the United States or other countries where our service providers operate. ## 12. Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of changes by posting the new Privacy Policy on this page with an updated "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy. ## 13. Contact Us If you have questions about this Privacy Policy or how we handle your data, please contact us at privacy@cozytwo.com.