Privacy policy
Version 2026-10-08
What we keep
Your account: your email address, the name you give, and your password (stored only as a hash). If you sign in with Apple, Google or GitHub, we receive the email address and name they share with us.
What you publish: specialists, works, comments and posts you choose to make public, with your public name.
What you use: which model was used and how many tokens, which specialist ran and whether it passed, how long it ran, and the credits that moved. When you build a specialist, that you started, whether the build finished or why it stopped, and how long it took. For a specialist you wrote yourself we get no name, only that it ran and how it went. We do not keep the text you send to a model or the text it sends back, and never your inputs, outputs or files.
Runs we hold for you: when you hand a specialist to our cloud, the inputs you give it, what it produces and its run record are kept on that machine so you can read them later.
Your devices: a push token if you allow notifications, and the pairing between your phone and your computer.
Cohowork sites (web addresses people make for their specialists): Cohowork records your use of them under your account — which sites you visit and on which days, when you sign in or create an account through one, what you run there, what it costs and when a limit stops you, and anything you report — together with a hash of your network address. The site and its owner never see this: they only ever see an anonymous number for you — and the owner sees your name only if you agreed to show it, which you can change on the site.
What stays on your computer
Specialists you run on your own computer run there. The files they read and write, your saved passwords and your run records stay on that computer and are not sent to us, except what you choose to share (for example, publishing a work) and the usage counts above.
Why we keep it
To run your account, run specialists for you, show you what they did, bill credits, keep the market safe (reviewing what is published and acting on reports), and tell you when something needs you. We do not sell your data and we do not use it for advertising.
Who else handles it
Only the services we need to run Cohowork, each for its part: Cloudflare (our servers), Neon (our database), Fly.io (cloud machines), Resend (email), Stripe (payments, and identity checks for people who sell), Expo and Apple (push notifications), and the AI model providers that answer a model request — they receive the request itself, not your account details.
How long
As long as your account exists. A cloud run record that nobody comes back for is deleted after 14 days. What you did on Cohowork sites is kept for 400 days. When you delete your account, your account, your cloud machine and the data tied to them are deleted; what you published stops being shown.
After you delete your account, Cohowork keeps for 12 months a one-way fingerprint of your email address and of the way you signed in. It cannot be turned back into your address, and it is used only to stop free credits being claimed again by signing up again.
Your choices
You can see and change your profile in the app, turn notifications off, and delete your account from Me → Settings in the phone app, or by writing to the address below. To ask for a copy of your data or anything else about it, write to the address below.
Cohowork is not for anyone under 16.
Contact
Questions about your data: support@cohowork.ai. Reports about content: abuse@cohowork.dev. When this policy changes, the version at the top changes and we tell you in the app.