Privacy Policy

Cohara is operated for an invitation-only trusted-family pilot. This Privacy Policy describes Cohara's current practices for that pilot.

1. Who we are

Cohara is operated by Cohara AI Inc. (“Cohara,” “we,” “us”), 1300 Grant Ave #204, Novato, CA 94945, United States. Contact: jr@cohara.ai.

1a. Who Cohara is for

Cohara is for adults 18 and older, or the age of majority where they live, whichever is higher. The information about children in Cohara is provided by their parent or guardian (§3). We do not knowingly collect personal information from anyone under 18 who uses Cohara. If we learn that a user is under 18, we will suspend the account and delete it, through the same deletion path a parent can use (§7). If you believe a child has used Cohara, contact privacy@cohara.ai.

2. What this Policy covers

This Policy describes what information Cohara collects during the trusted-family pilot, how Cohara uses it, who it is shared with, how long it is kept, and what rights parents have over it.

This Policy does not cover websites or services operated by third parties (Google, Twilio, Vercel, Supabase, Resend, Anthropic), whose own privacy policies apply when their services are used.

3. Children's information — parent-provided family context

Cohara does not offer accounts to children. Children do not log in, register, or interact with the Cohara product directly. Information about children is provided by a parent or legal guardian on the child's behalf as part of parent-controlled family context (e.g., the child's first name, grade level, schedule context, observations, school name) to enable Cohara's morning-brief, action-plan, and family-context features.

Cohara treats parent-provided child information with the same protections required of “personal information” under 16 CFR Part 312 (the Children's Online Privacy Protection Act / COPPA Rule):

• We obtain parent consent before collecting it.
• We minimize what we collect to what is reasonably necessary for the parent's stated use.
• We do not sell child information.
• We do not use child information for behavioral advertising or profiling.
• We provide parents with rights of access, correction, and deletion (§7).
• We use reasonable technical and organizational measures to protect it (§9).
• We retain it only as long as reasonably necessary for the stated purpose (§8).

4. Categories of information we collect

4.1 Parent identity + account information

• Parent first name, last name (user_profiles.first_name, user_profiles.last_name) — collected at onboarding.
• Email address (user_profiles.email) — collected at signup; used for invite, account access, account communications.
• Phone number (user_profiles.phone and/or sms_consent_records.phone) — collected at onboarding when phone is provided.
• Authentication tokens / session cookies (operational; not used for advertising).
• Parent expressive / family-context content (family_profiles + user_profiles fields including values, tone_preference, what_matters, pain_points, priorities, parent_challenges_note, priorities_note, suggestions_note, coaching_tone) — parent-authored content describing the family's preferences and context; used to personalize action plans + morning brief content.
• Parent consent records — per-document acceptance + version + timestamp + IP address + user-agent (consent_records, sms_consent_records; including document_version, consent_type, revoked_at, child_data_consent columns).
• COPPA-consent flag at family level (families.coppa_consent_given, families.coppa_consent_at).

4.2 Parent-provided family context (about children)

Cohara stores parent-provided child information in two related places: a children record for each child added to the workspace, and per-child attribution on items the parent records (calendar events, plans, tasks, artifacts). The categories captured:

• Child first name (children.first_name).
• Child last name (children.last_name) — optional; collected only if the parent enters it.
• Child grade and grade band (children.grade, children.grade_band).
• Child birthdate (children.birthdate) — optional; collected only if the parent enters it.
• Child pronouns (children.pronouns) — optional.
• Schools, activities, school type (children.school_name, children.school_type).
• Parent-narrated child attributes — strengths, interests, support needs, school-support status (children.strengths, children.interests, children.support_needs, children.school_support_status).
• Parent observations / notes about the child (children.notes).
• Child avatar choice (children.color, children.avatar_url).
• Schedules, calendar events, and tasks the parent associates with the child (schedule_events.child_ids, tasks.related_child_id).
• Parent observations, plans, action items the parent records about the child (artifacts.raw_text, artifacts.file_url for parent-uploaded child documents).
• AI-co-generated content attributed to the child — action plans, hypotheses, scripts (plans.bottleneck_hypothesis, plans.script_*, plans.assumptions, plans.safety_flags, plans.escalation_guidance). These are AI inferences based on parent-provided context; the parent reviews and accepts or rejects each plan.

We do not collect child contact information (no child email, no child phone, no child home address). We do not enable children to communicate with us. The child information we hold is exclusively what the parent has chosen to record in their own family-context workspace, plus AI-co-generated inferences from that recorded context.

4.3 Co-parent / caregiver / non-account adult information

The persons table stores parent-recorded contact details of non-account adults associated with the family:

• Co-parent first + last name, email, phone (persons.first_name, persons.last_name, persons.email, persons.phone).
• Caregiver / emergency-contact names, emails, phones (persons.is_emergency_contact, persons.can_receive_updates).
• Invite token + invited_at (when the parent has invited the co-parent through the S-15 cascade or family-page Send invite).
• Service providers — third-party professional contact details the parent records (doctors, therapists, school staff). Stored in the providers table with name, role, email, phone, notes.

4.4 Calendar integration (Google Calendar)

• Calendar event metadata read via Google OAuth, scoped to the calendars the parent grants access to.
• Event titles, start/end times, locations, descriptions, attendee information visible to the parent.
• We do not write to the parent's Google Calendar; integration is read-only.
• We do not access calendars the parent does not grant.
• The list of calendars on the connected Google account (each calendar's name and identifier), so the parent can choose which calendars Cohara reads.
• A change-notification registration with Google, so that when a granted calendar changes Google tells Cohara and Cohara re-reads it. Google sends only the fact that something changed, not the event itself.
• How we use it. Calendar events build the family's schedule: the Today view, the morning brief, answers to schedule questions in chat, and spotting overlaps and gaps in who is covering what. When Cohara answers a question or prepares a brief, the relevant events (for chat, today and the next 14 days: titles, times, locations, descriptions) are included in what is sent to our AI processor, Anthropic (§6, §11).
• Who can see it. Calendar data is visible to the adults in the parent's family workspace. Cohara staff do not read a family's calendar data except with that parent's permission (for example, to resolve a support request), where necessary for security, or to comply with the law.

Google API Services User Data Policy. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. Cohara's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google is used only to provide and improve the features described above; it is never used for advertising, never sold, and never used to train generalized AI or machine-learning models.

4.5 SMS messages — the Cohara morning brief (optional)

If the parent opts into SMS at onboarding, Cohara collects:

• Mobile phone number.
• SMS opt-in consent record (consent copy + version + timestamp + IP + user agent).
• Inbound parent replies to the morning brief (sent to a Twilio-managed number).
• Outbound message body, message timestamps, and delivery status.

The full SMS program description (frequency, message and data rates, STOP/HELP keywords, opt-in screen rendering, sample messages) lives at SMS Consent & Messaging Practices and is summarized in §13 below.

4.6 Action plans + chat (AI-co-created content)

• Parent-authored plans, action items, observations.
• AI-co-created suggestions and brief content (see §11 — AI processing).
• Saved conversations — off unless you turn it on. Cohara does not save your chat with it unless you turn saving on. This is your own setting: another adult on your family account cannot turn it on for you, and turning it on for yourself does not turn it on for them. If you do turn it on, your conversation is there when you come back to it — on your phone, and on another device — instead of starting blank every time. We also review saved conversations internally to understand how Cohara is used and to improve it (§5). What is stored is what you write to Cohara and what Cohara writes back, one exchange per record, in the chat_history table, with your account, your family workspace, which child the conversation was about, and which conversation it belongs to. They are yours: another adult on your family account cannot read them — that, and the setting itself, are enforced by the database rather than only by the app — and Cohara works the same whether saving is on or off.
• Saved conversations are deleted automatically after 30 days (§8). You can turn saving off at any time, which stops Cohara saving anything new — what is already saved is not deleted by that switch, and ages out on the same 30 days — and you can clear everything already saved straight away, which deletes it immediately. Turning it off and clearing it are two separate things on purpose: Cohara does not delete your conversations as a side effect of a setting you changed.
• Chat and thread messages the parent writes to Cohara AI, and the text of documents the parent uploads. Unless the family has opted into saved conversations above, we do not store a transcript of a conversation. What Cohara keeps from them either way is a short list of durable facts about the household that Cohara derives automatically — for example “bedtime is 7pm on school nights” — each one a single sentence of at most 280 characters. They are stored per family in the living_understanding table with the surface the fact came from, how confident Cohara is in it, and whether a parent has confirmed it.
• A fact Cohara derived on its own is an unconfirmed candidate, never a statement the parent made, and Cohara records the difference. Facts about a specific child are kept at the lowest confidence and are not treated as established. When a newly derived fact contradicts one Cohara already holds, both are kept and the conflict is recorded — Cohara does not overwrite what it previously believed, and it does not replace a fact a parent wrote or confirmed.

4.7 Operational + audit data

• Request logs (request URL, status, duration; no body content unless explicitly logged).
• Audit logs for outbound dispatch events (error class + error code only; no raw error messages or stack traces).
• Deletion-request records (a record of any deletion request a parent makes, kept for audit purposes per §312.10 retention rules).

4.8 What we do NOT collect

• We do NOT collect child contact information.
• We do NOT enable children to register or communicate with us directly.
• We do NOT track parent or child location, and we never store device geolocation. The only location information we hold is what a parent enters or what appears in a calendar event: an event’s venue, and — only if a parent saves one under Settings → Home — the family’s home address. Cohara uses a saved home address to work out drive times and when to leave for events on the family’s calendar, automatically: when the address is saved, its text goes once to our mapping provider (Google Maps Platform) to be matched to a map location; after that, each night, the home’s map location and the map location of each of tomorrow’s event venues are sent to Google Maps Platform to estimate the drive, and that estimate is shown in the Morning Brief and quoted in the Thread. A home address is never used for tracking, advertising or profiling. Saving a home address is how a parent turns this on; a parent who never saves one has no home location collected, and removing the address under Settings deletes it and every drive estimate made from it. When a parent asks Cohara in the Thread about a drive, Cohara may look up the place she named or an event’s venue and the drive between them with Google Maps Platform at that moment; the answer says so, and such lookups are capped per family per day. A parent may also turn on Use where I am to plan routes under Settings → Home: with that switch on, and only when she asks for a route that needs it, her browser asks her permission and her current position is used once for that answer and then discarded — it is never stored, never logged and never used for any other purpose. The switch is off until she turns it on, and she can turn it off at any time.
• We do NOT collect biometric identifiers (no facial recognition, no voiceprints, no fingerprints).
• We do NOT use behavioral-advertising or profiling identifiers.
• We do NOT operate as a “third party” data broker.

5. How we use information

We use the information in §4 only for the following purposes:

1. To provide the trusted-family-pilot product — onboarding, the family-context workspace, action plans, the morning brief, the co-parent invite flow, and the deletion request flow.
2. To send the Cohara morning brief SMS to parents who have opted in (see §13).
3. To respond to parent support requests.
4. To improve the trusted-family pilot through controlled, internal review of pilot usage (no behavioral advertising; no profiling; no sale).
5. To meet legal / regulatory / security obligations.

We do not use the information for behavioral advertising. We do not use the information to build advertising profiles. We do not sell the information.

6. Who we share information with

The trusted-family pilot uses the following third-party processors. Each processor sees only what is reasonably necessary for its operational role.

We do not share information with any party not listed above. We do not share information with advertisers. We do not share with data brokers.

Mobile phone numbers and SMS consent information are not shared with third parties or affiliates for marketing or promotional purposes. Twilio is the SMS-delivery vendor; phone numbers are not shared with any party outside that delivery-vendor relationship.

If a co-parent is invited by a primary parent, the co-parent's email is used by Cohara only to send the co-parent the invitation and (after the co-parent accepts) to enable the co-parent's access to the same family context, subject to the same Privacy Policy.

7. Parent rights — access, correction, deletion, consent withdrawal

The parent who created a family-context workspace has the following rights with respect to the information described in §4:

1. Access. Request a description of categories of information Cohara has collected, and the specific content where reasonable.
2. Correction. Request that we update inaccurate information, including anything in the durable facts described in §4.6.
3. Deletion. Two different requests, with two different scopes:
   • Delete your account. Removes your parent profile (name, email, phone number), your place on the family account and the setup progress recorded for you, any screen design you chose to try, your consent records, your Cohara AI conversation history, your Google Calendar connection and the stored Google permission behind it, and the calendar events Cohara synced from that connection. If another adult on the family account is still active, the family-context workspace itself continues: the other parent keeps their access, parent-provided child information stays, and content created inside Cohara (manually added events, tasks) stays with the family with your name removed from the fields that stored it. Anything you were down to do goes back to the family as an open item: your name on it is replaced with “Former member” and it is marked as still needing someone, rather than continuing to read as covered by a parent who has left. If another parent had handed you something, it returns to them, still needing someone; if you had handed something to another parent, it stays with them, because that is their commitment and not yours to withdraw. If a departing parent was the account's primary parent, another active adult becomes primary so the family is not left without one.
   • Delete the family-context workspace (including parent-provided child information, and what Cohara has learned about the family — the durable facts in §4.6, which are deleted in full and carry no retention exception). This is also what happens automatically when the last active adult on a family account deletes their account — there is no one left for the workspace to survive for.
4. Consent withdrawal. Withdraw consent for SMS, calendar, saved conversations, AI processing, or the pilot itself at any time. Withdrawal of SMS consent stops further SMS dispatch; withdrawal of calendar consent stops further calendar reads; turning saved conversations off (§4.6) stops Cohara saving anything further, and clearing them deletes what is already saved; withdrawal of overall consent triggers the deletion path (3).
5. Right to refuse further collection. Direct Cohara to stop further collection of child information from the parent's workspace while leaving prior data in place.
6. Right to be told what categories of personal information have been collected from a child (16 CFR §312.6).

How to exercise. Email jr@cohara.ai from the email address on the family account. We will verify the requestor is a parent on the family account before disclosing or deleting information, in a manner reasonably designed not to be unduly burdensome (16 CFR §312.6).

Response time. We will acknowledge receipt within 5 business days and complete the request within a reasonable time appropriate to the request type (typical deletion: within 30 days; access: within 30 days).

8. Retention + deletion

Cohara maintains a written data-retention policy:

• Parent identity / account information — retained for the duration of the family's pilot participation plus a reasonable wind-down period for audit / dispute resolution, and deleted on the account-deletion path described in §7 when that parent deletes their account.
• Parent-provided child information — retained only while reasonably necessary for the parent's stated use. When the parent withdraws or deletes the family-context workspace, parent-provided child information is deleted on the operator-executed deletion path.
• Consent records (Terms / Privacy / Pilot Agreement / SMS) — retained for an audit-appropriate period after the relevant version is no longer in effect, to provide a record of consent capture per §312.5.
• Saved conversations (chat_history, §4.6) — retained for 30 days from the exchange each record holds, then deleted. That deletion runs automatically every day across all accounts, so the 30 days holds whether or not you are still using Cohara. They are also deleted when you clear them, when you delete your account, and when the family-context workspace is deleted. They carry no partial-retention exception (§8.1).
• Brief-ranking signals (brief_item_features) — a record of how each morning brief ordered a household's items (rank, whether it was shown, whether it led), used to improve that ordering over time. It carries no message text, no note or event description, and no child or contact name. Retained for 90 days from when it was recorded, then deleted; that deletion runs automatically every day across all accounts, so the 90 days holds whether or not you are still using Cohara. Also deleted outright when the family-context workspace is deleted. Carries no partial-retention exception (§8.1).
• Durable family facts (living_understanding, §4.6) — retained while the family-context workspace exists, and deleted with it. A fact Cohara stops relying on is marked as no longer current rather than erased, so that it stays visible in an access request and can still be corrected; it is deleted outright when the family-context workspace is deleted. These rows carry no partial-retention exception (§8.1).
• Operational + audit data — retained per security / fraud-prevention / regulatory obligations.
• Calendar data — purged when the parent revokes calendar access, and purged with the parent's account when they delete it: Cohara does not keep a copy of a calendar it no longer has access or consent to read. A remaining parent who wants those events back can be given access to the calendar in Google and re-sync it under their own connection.
• SMS data + dispatch logs — retained for an audit-appropriate period to support TCR / A2P 10DLC compliance and delivery auditing.

When information is no longer needed, Cohara deletes it using reasonable measures designed to protect against unauthorized access or use during deletion (16 CFR §312.10).

8.1 Partial-retention exception list

The following tables are retained even after a parent's account-deletion request, for compliance audit purposes:

A completed deletion also leaves one record behind that is not in this list, because a deletion creates it rather than keeping something that was already there: the receipt described in §8.3.

• sms_consent_records (phone number + consent copy verbatim) — retained for TCR / A2P / TCPA defense audit.
• invites (recipient emails) — retained as an audit trail of the original invitation.
• signup_invites (pre-account invitations) — the recipient's email address is used once to send the invitation and is not stored; what is retained is a token-based audit record with no address a stolen copy could recover. An invitation not accepted within 30 days expires automatically, and the record's address-matching value is cleared at that point too. When the account that sent an invitation is deleted, any invitation still outstanding is revoked, and both the recipient's email address and the link to the sender are removed from the retained record.
• morning_brief_log (SMS dispatch records + inbound parent reply text in feedback_text) — retained for TCR / A2P / Twilio carrier-audit purposes.

8.2 What an account deletion does not remove: text another family member wrote

When one parent deletes their account and another adult on the family account remains, Cohara deletes what belonged to the departing parent and removes their name from the structured fields that stored it — the person record for that parent, the fields on a calendar event that record who an item is assigned to, and the record of who is down to do a shared item (§7).

Cohara does not rewrite free text that a different family member wrote. An event title, a description or a note typed by the other parent — for example “Dad picks up Owen at 3:30” — may still refer to the departing parent by name, and is left exactly as its author wrote it.

This is a deliberate limit and we would rather state it than imply otherwise. Matching a person's name inside sentences other people wrote fails in both directions: it removes records that were never about that parent (a child named after them, a common first name) and misses the ones that were (nicknames, “Dad,” initials). Rewriting that text would also silently alter a different parent's own record of their family's week. A parent who leaves Cohara is not erased from their co-parent's schedule.

If you want text another family member wrote removed as well, email jr@cohara.ai and we will review the specific request with the family.

8.3 What a completed deletion leaves behind: a receipt that it happened

When a deletion completes, Cohara keeps one small record (deletion_receipts) that the request was made and that we acted on it, so we can show afterwards that it was honoured. Without it, “we deleted everything you asked us to” and “you never asked” would look identical to us as well as to you.

That record holds only four things: the date the request was made, the date it ran, a scrambled stand-in for the email address that was on the account, and a note of which version of that scrambling produced it. The stand-in lets Cohara check an address you give us later against the record, so you can ask us to confirm your own deletion; it cannot be turned back into an address by anyone who obtains a copy of it.

The record holds no email address, no name, no phone number, nothing you or your family wrote, and no count of what the account held — and nothing in it points back to your family. It is kept indefinitely, because a record that expires stops being proof at exactly the point someone asks for it.

9. Security

Cohara maintains a written information security program (WISP) with safeguards appropriate to data sensitivity and operator size/complexity. Components include: designated security coordinator (Justin Roberts), at-least-annual risk assessment, technical and organizational safeguards (HTTPS everywhere, per-family row-level security, service-role-key compartmentalization, audit logging, env-var-gated dispatch surfaces, signature verification on inbound Twilio webhooks), regular testing/monitoring, at-least-annual program evaluation.

No security program eliminates all risk. Parents should use a strong unique password for the email account they use with Cohara.

10. Children's privacy and COPPA

See §3 above. Cohara treats parent-provided information about children with the protections required of “personal information” under 16 CFR Part 312, the COPPA Rule. Cohara itself is for adults only; see §1a.

11. AI processing

Action plans and chat are AI-co-created, and chat answers draw on the family's calendar (§4.4). The AI model is operated by Anthropic. AI outputs are draft suggestions for parent review — they are not professional advice and are not a substitute for parent judgment. The same applies to the durable facts Cohara derives from a parent's messages and documents (§4.6): they are Cohara's working notes about the household, they can be wrong, and a parent can correct or delete them. See the AI / Vendor Disclosure for the full disclosure.

12. Pilot scope

• The trusted-family pilot is invitation-only. There is no self-serve signup.
• Only adults 18 and older can create an account or accept an invitation, and each confirms it when they do (§1a).
• The pilot is operated by Cohara as a single-operator team. There is no customer-support team beyond jr@cohara.ai.
• Features may change, pause, or be removed during the pilot.

13. SMS Program — the Cohara morning brief

Cohara operates an SMS program called the Cohara morning brief for parents who explicitly opt in during onboarding. The program disclosure below is summarized; see SMS Consent & Messaging Practices for the full opt-in flow, the rendered opt-in screen, sample messages, and the consent-record schema.

• Program name: Cohara morning brief.
• Description: One short informational SMS per day per opted-in parent, summarizing the family's schedule and priorities for the day. No promotional, marketing, or third-party content is sent.
• Opt-in is explicit. Parents opt in via a dedicated on/off toggle during onboarding (screen S-13). The toggle is OFF by default and requires entering a mobile number before opt-in is captured.
• Frequency. Up to one message per day per opted-in parent.
• Message and data rates may apply. Rates are set by your mobile carrier; Cohara does not bill you for SMS.
• Opt-out. Reply STOP to any message to opt out. Cohara also honors OPTOUT, CANCEL, END, QUIT, UNSUBSCRIBE, and REVOKE as opt-out keywords.
• Help. Reply HELP (or INFO) for support instructions and a contact path.
• Support contact: privacy@cohara.ai.
• No third-party sharing. Mobile phone numbers and SMS consent information are not shared with third parties or affiliates for marketing or promotional purposes. Twilio is the SMS-delivery vendor (see §6); phone numbers are not shared with any party outside that delivery-vendor relationship.
• Consent record. The exact consent copy shown at opt-in, the consent version, IP address, and user agent are stored in the sms_consent_records table for compliance auditing.

14. Changes to this Policy

We may revise this Privacy Policy. Any material revision will be communicated to parents on the family account, and re-acceptance may be required where the change materially affects parent-consent scope. Prior consent versions are retained in consent_records for audit.

15. Disputes

Disputes about this Policy or Cohara's privacy practices should first be raised by email to jr@cohara.ai.

16. Contact

• Email: jr@cohara.ai
• Cohara AI Inc., 1300 Grant Ave #204, Novato, CA 94945, United States