Privacy Policy

Information you give us

• Account & sign-in. Your email address and password, or — if you sign in with Google or Apple — the basic profile details those providers share. Sign-in and credentials are handled by our authentication provider, Supabase. We also store your username, display name, and account status.
• Profile.Anything you add to your profile: bio, website, city, avatar and cover images, links to your other social accounts, and an “open to work” status. Accounts migrated from our previous platform may also include fields such as date of birth, gender, or approximate location; you can ask us to update or remove these.
• Content you create. Posts, photos, videos, reels, stories, articles and blog comments, forum threads and replies, comments (including audio and file attachments), polls, photo albums, marketplace listings, job posts, events, and the Pages and Groups you run. Uploaded media is stored with our storage provider, Cloudflare R2.
• Messages, calls & live. The content of your direct and group messages (including media you send), your participation in 1:1 audio/video calls, and live streams you broadcast or watch — including live chat and, where you enable it, a recording of your stream.

Information we collect automatically

• Usage & analytics. We use PostHog to understand how the Service is used; once you sign in we identify you by your account ID and attach your email, and we record pageviews and in-app interactions. We also use Vercel Analytics for aggregate traffic measurement. For browser push notifications we store the push endpoint and your browser's user-agent string for each device. Our sign-in forms use Cloudflare Turnstile to detect bots.
• Activity signals. Follows, blocks, mutes, reactions, bookmarks, event RSVPs, which posts you have been shown, your watch history, and posts you mark as “not interested.” We use these to rank and personalize your feed and recommendations.
• Cookies. We use cookies to keep you signed in (a session cookie from Supabase) and for analytics (PostHog). We do not currently show a cookie-consent banner; you can control cookies through your browser settings.

Payment information

When you subscribe to CoThWo Pro, buy or sell in the Marketplace, or pay to boost content, payments are processed by Stripe. We do not store your full card details — Stripe does. We keep records such as your Stripe customer and subscription identifiers, order and transaction history, and, for sellers, your payout (Stripe Connect) details and wallet balance.

How we use your information

• Operate, maintain, and secure the Service.
• Personalize your feed, search, and recommendations — including by creating numerical “embeddings” of content and learning from your activity signals.
• Power the AI features described below.
• Keep CoThWo safe through automated and human content moderation.
• Process payments, subscriptions, and seller payouts.
• Send notifications (in-app, email via Resend, and browser push) and respond to you.
• Comply with the law and enforce our Terms.

AI features and your content

CoThWo uses AI throughout the product. To provide these features we send the relevant content to our AI providers, who process it to deliver the feature:

• Anthropic (Claude) powers the in-app assistant, the post composer and “Content Boost,” the AI Blog Studio, smart-reply suggestions in chat, and automated content moderation. Depending on the feature, this can include the text and images in your posts and articles, recent messages in a conversation (to suggest replies), and content that is reported or automatically scanned for safety.
• Google powers semantic search and feed similarity by turning the text of posts, articles, and forum threads into embeddings.

This means some private content — including direct-message text used to suggest replies or scanned for safety — is sent to these providers as part of operating the Service. We send only what a feature needs. Conversations with the in-app assistant are sent to our AI provider to generate responses but are not saved to your account. AI output can be inaccurate; review it before you rely on or publish it.

How we share information

We do not sell your personal information. We share it only in these ways:

• With service providers who run CoThWo on our behalf: Supabase (database, accounts, sessions), Cloudflare R2 (media storage), Cloudflare Turnstile (bot protection), Stripe (payments and payouts), LiveKit (calls and live streaming), Anthropic and Google (AI features), Upstash (rate limiting), Resend (email), PostHog and Vercel (analytics), web-push services (notifications), and our hosting and content-delivery providers. We also load fonts from Fontshare, which receives your IP address when your browser requests them.
• Publicly, as you direct — content you post, your public profile, and anything you share is visible according to the privacy settings you choose for it.
• For legal reasons — to comply with the law, enforce our Terms, or protect the rights and safety of our users and the public.
• In a business transfer — if CoThWo is involved in a merger, acquisition, or sale of assets.

Your choices and rights

• Edit your profile, manage email and push notification preferences, and set who can see each post (public, followers, only you, or mentioned).
• Block, mute, hide, and report other users and content.
• Turn on two-factor authentication.
• Request a copy, correction, or deletion of your personal data, or deletion of your account, by emailing support@cothwo.com. We currently handle these requests by email — there is no self-service account-deletion button yet.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA. Contact us to exercise them.

Data retention

We keep your information for as long as your account is active and as needed to provide the Service. When content is removed it is generally deactivated and taken out of search rather than erased immediately; we retain some records (for example, payment and moderation records) as needed for legal, security, and accounting purposes. If you ask us to delete your account, we will remove your personal data except where we are required to keep it.

Security

We protect your account with measures including optional two-factor authentication, bot protection on sign-in, rate limiting, database access controls, signed and time-limited upload links, and signature verification on payment webhooks. Photos you upload are re-encoded in your browser before upload, which removes embedded location metadata; other files, such as video, may retain it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

International transfers

CoThWo relies on providers based in the United States and elsewhere (for example, PostHog, Stripe, Anthropic, Google, and our hosting). Using the Service may involve transferring your information to countries whose data-protection laws differ from those where you live.

Children

CoThWo is not directed to children. You must be at least 13 years old — or the minimum age of digital consent in your country, such as 16 in parts of the EU — to use the Service. We do not knowingly collect personal information from children under that age; if you believe a child has provided us information, contact us and we will remove it. Note that we do not currently verify age at sign-up.

Changes to this policy

We may update this policy from time to time. If we make material changes we will revise the date above and, where appropriate, notify you. Continuing to use the Service after a change means you accept the updated policy.

Contact

Questions or requests? Email us at support@cothwo.com. See also our Terms of Service.