Privacy Policy

1. Introduction

2. Information We Collect

2.1 Information You Provide to Us

When you register for and use Cohera, we collect:

• Account Information: Email address, username, password, full name, profile picture
• Profile Information: Bio, timezone, language preferences, subscription tier
• Content: Posts, captions, hashtags and media files you create or upload, and the energy check-ins, feelings, contributors you choose, weekly intentions and journal entries you record
• Communications: Messages you send us, customer support interactions, feedback
• Payment Information: When you subscribe to paid plans, payment details are processed by our payment provider (we do not store full credit card numbers)

2.2 Information Collected Automatically

When you use our Service, we automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Account milestones: the date your account first reaches steps such as confirming your email, starting your trial, connecting a platform, scheduling and publishing a first post, payments, requesting a cancellation and access ending, plus the social platform you came from when we can tell. We use this to see where people get stuck and improve Cohera. It never includes what you write.
• Where you came from and how you heard about us: the tag on the link you arrived through (a source such as "ellabel" and a campaign such as "instagram-bio", kept on your device for up to 30 days as described in Section 14), your answer to "How did you hear about us?" if you choose one when signing up, and the reason you choose if you cancel from the Stripe cancel screen. We use these only to understand which content brings people to Cohera. The source and campaign are also sent to Stripe with your checkout. Nothing here is sold or shared for advertising.
• Usage Data: Pages visited, features used, time spent, click patterns
• Log Data: Access times, error logs, referring URLs
• Location Data: General location based on IP address (not precise GPS location)

2.3 Information from Third Parties

We receive information when you connect your social media accounts (detailed in Section 3) and from analytics providers that help us understand how users interact with our Service.

3. Social Media Platform Data

Cohera allows you to connect various social media accounts to create and publish content. When you connect a social media account, we access specific data from that platform with your explicit authorization. Below is a detailed breakdown of what we access for each platform:

4. How We Use Your Information

We use the information we collect to:

4.1 Provide and Improve Our Service

• Create and manage your Cohera account
• Enable you to create, schedule, and publish content to your connected social media accounts
• Display analytics and performance metrics for your content
• Provide customer support and respond to your inquiries
• Improve and optimize our Service based on usage patterns

4.2 Personalization

• Suggest optimal posting times based on your audience engagement
• Provide AI-powered content suggestions tailored to your style
• Customize your dashboard and user experience
• Offer optional support after a low-energy check-in, and extra support if you choose Blocked on several days in a row. These offers are based only on the choices you record; they are not a diagnosis. To offer the extra support only once, Cohera keeps a note of the date it was offered.
• Show patterns in Rhythm from your own check-ins, such as which contributors come up on which energy days. This is calculated inside Cohera and is not sent to AI providers

4.3 Communication

• Send transactional emails (account verification, password reset, posting confirmations)
• Send product updates and feature announcements (you can opt out)
• Notify you about scheduled posts and performance milestones

4.4 Security and Legal

• Detect and prevent fraud, abuse, and security incidents
• Enforce our Terms of Service
• Comply with legal obligations

5. AI-Powered Features

Cohera uses artificial intelligence to enhance your content creation experience. Here's how we use AI and what data is involved:

5.1 AI Content Suggestions

We use AI models (including OpenAI and Anthropic) to generate content suggestions, captions, and hashtag recommendations. When you use these features:

• With your explicit permission, draft captions, selected past captions and your hashtags are sent to Anthropic to write captions in your voice, with OpenAI as a backup. Caption requests made through Cohera's API are sent to OpenAI
• Voice analysis and Rhythm's voice reflection send up to 30 recent published captions to Anthropic. For the reflection, Anthropic receives only the caption text. Your check-ins are compared with the result inside Cohera, and the reflection is not saved
• Similar posts features send your published captions to OpenAI for matching
• Inbox reply suggestions send the audience message, the sender's name, and your post caption to OpenAI
• Support-chat replies send recent support conversation messages to Anthropic
• Campaign help sends campaign images and context to Anthropic
• Turning a written description into post details sends that description to Anthropic
• AI providers process this data according to their privacy policies
• We do not use your content to train or fine-tune any AI model
• You can decline or withdraw permission and continue using exact captions and publishing without AI

5.2 Voice Personalization

To make suggestions sound like you, Cohera references examples of your own past posts at the moment a suggestion is generated (a technique known as retrieval). Your posts are used only as reference material to personalize suggestions for you. They are never used to train or fine-tune AI models, and they are never used to generate content for other users. You can also create "tone profiles" that help describe your preferred writing style; this data is stored in your account and used only to personalize suggestions for you.

5.3 Third-Party AI Providers

We work with the following AI providers:

• OpenAI - Backup caption writing, API caption requests, similar-post matching, inbox reply suggestions and embeddings (Privacy Policy)
• Anthropic - Caption writing in your voice, voice analysis and content assistance (Privacy Policy)

Cohera records the version of the disclosure you accepted. If the disclosed sharing changes materially, we ask again before sending content. You can withdraw permission in Settings; withdrawal stops future requests to these providers.

Change on 17 October 2026: caption writing moved from OpenAI to Anthropic, with OpenAI as a backup. The information sent and why it is sent are unchanged.

6. Data Sharing and Disclosure

We do not sell your personal information. We share your information only in the following circumstances:

6.1 Service Providers

We share data with trusted service providers who help us operate our Service:

• Supabase - Database hosting and authentication
• Vercel - Application hosting
• Vercel Analytics - Aggregate usage and performance analytics, loaded only if you accept optional cookies
• Sentry - Error monitoring and, if you accept optional cookies, session replay with text inputs and media masked. We work to keep the content you write, such as journal entries and captions, out of error reports.
• Resend - Transactional email (verification, password resets, notifications)
• AI providers - Content generation (OpenAI, Anthropic)
• Stripe - Subscription billing and payment processing. Your card details are provided directly to Stripe and are never stored on our servers
• Apple - In-app subscriptions on iOS. Apple handles payment and your Apple ID; Cohera never sees your card details and receives only purchase and transaction status
• RevenueCat - Manages subscription status for purchases made in the iPhone app
• Cloudflare Turnstile - Bot protection on our signup and login forms. Turnstile runs invisibly (no puzzle is shown) and evaluates signals such as your IP address and browser characteristics to distinguish people from automated traffic. This processing is governed by Cloudflare's Turnstile Privacy Addendum
• Upstash - Rate limiting, which stores short-lived request counts linked to an account or IP address
• Discord - If you link a Discord account, we store your Discord user ID to manage your community membership

Cohera records account milestones, such as when you connect a platform or publish a first post, to understand and improve onboarding.

6.2 Social Media Platforms

When you publish content through Cohera, your content is sent to the social media platforms you've connected. Each platform processes this data according to their own privacy policies.

6.3 Legal Requirements

We may disclose your information if required by law, including:

• In response to valid legal processes (subpoenas, court orders)
• To protect the rights, property, or safety of Cohera, our users, or the public
• To detect, prevent, or address fraud or security issues

6.4 Business Transfers

If Cohera is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

7. Data Retention

We retain your information only for as long as necessary to provide our Service and fulfill the purposes described in this policy. Here are our retention periods:

8. Data Security

We implement industry-standard security measures to protect your information:

8.1 Encryption

• In transit: All data is encrypted in transit using TLS (HTTPS)
• Social media tokens: Encrypted with AES-256-GCM before they are stored in our database
• API keys: Stored only as a one-way hash; we cannot read your key after it is created
• Everything else: Stored with our database provider, which encrypts its disks, and protected by the access controls below

8.2 Access Controls

• Row-level security means a signed-in account can only read its own records through the app
• Media you publish or upload is stored at hard-to-guess links, which social platforms need in order to publish it; anyone who has a link can open that file
• Administrative access to our database and hosting is limited to our founding team, each using two-factor sign-in

While we take extensive measures to protect your data, no method of transmission or storage is 100% secure. If you believe your account has been compromised, please contact us immediately.

9. Your Rights and Choices

9.1 Account Controls

You can:

• Access and update your profile information in Settings
• Connect or disconnect social media accounts
• Delete your content (posts, drafts, media)
• Delete your account

9.2 Data Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Restriction: Request we limit processing of your data
• Objection: Object to certain processing activities

To exercise these rights, contact us at support@coheraapp.com. We will respond within 30 days (or as required by applicable law).

10. International Data Transfers

Cohera is based in Australia. Our database is hosted in India (Mumbai). Our hosting, email and AI providers process data in the United States, and our error monitoring is hosted in Germany. Using Cohera means your information is transferred to and processed in those countries.

For transfers from the European Economic Area (EEA), UK, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Privacy Framework certifications where applicable
• Adequacy decisions for certain countries

11. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

11.1 Your California Rights

• Right to Know: Request disclosure of data collected, used, and shared
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out: Opt out of "sales" or "sharing" of personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

11.2 Do Not Sell/Share My Information

We do not sell or share your personal information, including for cross-context behavioral advertising. We do not share your data with advertising partners. If our practices ever change, we will update this policy and provide an opt-out mechanism before doing so.

12. European Residents (GDPR)

If you are located in the European Economic Area (EEA), UK, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

12.1 Legal Bases for Processing

We process your data based on:

• Contract Performance: To provide you with our Service (account management, publishing)
• Legitimate Interest: To improve our Service, ensure security, and communicate with you
• Consent: For marketing communications and other optional features
• Legal Obligation: To comply with applicable laws

12.2 Your GDPR Rights

• Access your personal data
• Rectify inaccurate data
• Erase your data (right to be forgotten)
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent at any time
• Lodge a complaint with your local supervisory authority

13. Children's Privacy

Cohera is not intended for users under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child, please contact us immediately at support@coheraapp.com, and we will take steps to delete such information.

14. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our Service:

14.1 Types of Cookies

• Essential Cookies: Required for the Service to function (authentication, security)
• Cookie choice (essential): remembers whether you accepted or declined optional cookies, across coheraapp.com and app.coheraapp.com, for up to one year.
• Where you came from: when you arrive from a link, we keep the name of the site or campaign (for example Instagram) on your device for up to 30 days, so that if you sign up we know which platform you came from. It is not used to follow you on other sites.
• Functional Cookies: Remember your preferences (theme, language)
• Analytics: Help us understand how the Service is used. Loaded only if you accept optional cookies.

14.2 Managing Cookies

You can control cookies through your browser settings. To change your choice about optional cookies, use the Cookie settings link at the bottom of our website. Disabling essential cookies may affect how the Service works.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you by email (for significant changes)
• Display a prominent notice in the Service

We encourage you to review this policy periodically. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all inquiries within 30 days.