Privacy Policy

1. Who we are

Cocowork gives people and their AI agents a shared place for files, pages, data, context and discussion. This policy covers cocowork.ai, app.cocowork.ai, coco.page and our API and MCP services.

Operator: Ofer Razon, operating Cocowork, based in Israel. Contact support@cocowork.ai for privacy questions or requests.

We determine how account, authentication, security and service-operation data is used. A person or organization that puts other people’s information in a coco is responsible for having permission or another lawful basis to do so and for choosing who can access it.

2. Information we handle

• Account information: email address, name, account identifiers, plan, verification status and authentication records. Our authentication provider processes passwords when you choose password sign-in.
• Your work: files and their contents, pages, data, descriptions, memory files, comments, version titles and snapshots, and sharing settings submitted by you, collaborators or authorized agents.
• Connections and sharing: agent names, permissions and credential records; invitations and recipient email addresses; saved shares and update subscriptions.
• Activity: resource access, actions, timestamps, actor identifiers, request outcomes and timing, and browser-session and presence signals. Platform administrators can see operational account and activity information.
• Support: messages and information you choose to send us.

Our application’s access logs do not store content bodies, passwords, raw access keys, IP addresses or browser user-agent strings. Hosting and authentication providers may separately process IP addresses, device information and technical logs to deliver and secure their services.

3. Sign in with Google

Google sign-in requests only basic identity scopes: openid, email and profile. Google and our authentication provider process your Google account identifier, verified email and basic profile information, such as your name and profile picture. Cocowork uses identity information to create or recognize your account and sign you in; the current app stores your name, email and identity mapping.

Google sign-in does not give Cocowork access to Gmail messages, Google Drive files, contacts or your calendar. If you separately authorize an external agent to read an email verification code, that happens under the agent’s own permissions and privacy policy.

We use Google identity information for authentication, account operation, support and security. We do not sell it, use it for advertising, or use it to train AI models. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements where applicable.

4. Why we use information

We use information to create accounts, store and display work, preserve versions, apply access controls, connect agents, operate sharing and discussion, provide support, prevent abuse and understand service reliability and usage.

We send verification emails. The current alpha records update subscriptions and prepares invitation and version-update email previews; those previews are not yet delivered as notifications.

Where data protection law requires a legal basis, we rely on performing our agreement with you for the service you request, legitimate interests for proportionate security and service operation, consent where required, and legal obligations where applicable. You can contact us to object to processing based on legitimate interests.

We do not sell personal information, run targeted advertising, or use stored work to train our own AI models. Agents that you connect may process work under their own providers’ terms.

5. People, agents and shared links

New cocos are private. Inviting people or authorizing agents gives them access according to the permissions you grant and the access you hold. An agent with sharing permission can invite others or create public links on your behalf. Review the permissions before connecting an agent and disconnect it when access is no longer needed.

Anyone who receives an active public link can access its permitted content, subject to any configured password. Links may be forwarded. A shared item exposes that item and any history you allow; a shared coco exposes the content permitted by the coco’s access settings. Recipients and agents can copy or download information they can access.

Coco owners can see access history and approximate live viewers. When signed in, your account identity, including name or email, may appear in those records. Anonymous visitors receive a coco-specific browser nickname; this is not a verified identity and can change when cookies are cleared or another browser is used.

Revoking access stops future access through Cocowork, but cannot retrieve copies already downloaded, received by an agent, or shared outside the service. Accepting an invitation or saving a public link can make that work discoverable to your authorized agents.

6. Service providers and international processing

We use service providers to operate Cocowork, including Vercel for hosting, Supabase for authentication, database and file storage, Resend for transactional email, Google Workspace for support email, and Cloudflare for domain DNS. Google also provides optional Google sign-in. These providers process information needed for their respective services.

Information may be processed outside your country. Our current primary database is configured in the United States; that does not mean all provider processing is confined to that region. Where applicable law requires international-transfer safeguards, those safeguards must apply to the relevant processing.

We may disclose information when reasonably necessary to comply with law, respond to valid legal requests, protect people or the service, or handle a business transfer with appropriate notice and protections. We do not routinely publish private work.

7. Cookies and browser storage

Cocowork uses cookies for sign-in, temporary sign-in validation, recognizing anonymous visitors within a coco, and operational browser-session measurement. Viewer layout preferences, such as the floating control’s position, are stored locally in your browser.

• Browser sign-in sessions last up to 30 days when you choose to stay signed in, or up to one hour otherwise; the temporary Google sign-in cookie lasts up to ten minutes.
• Anonymous coco visitor cookies can remain for up to one year.
• The operational browser-session cookie can remain for up to 30 days; a new session is recognized after inactivity.
• Viewer preferences remain until changed or cleared.

We do not currently use advertising cookies. You can clear or block browser storage in your browser settings. Doing so may sign you out, reset preferences or prevent reliable visitor recognition.

8. Retention and deletion

Account information and work are retained while needed to provide your account, collaboration and version history. Removing an item from the working version does not necessarily remove it from past snapshots. Revoking a link or an agent connection does not erase access history.

Application request metrics and browser-visit records are subject to cleanup after approximately 30 days. Stale live-presence records are cleaned up after about one day when subsequent heartbeats run. Historical coco access logs and version snapshots do not currently have automatic age-based deletion.

To request account closure, an export, or deletion of personal information or retained versions, email support@cocowork.ai. The alpha handles these requests manually after checking identity and authority. We will explain any information we must retain for security, legal obligations or other people’s rights. Copies in backups or provider logs may remain until their applicable retention cycle ends; copies independently kept by recipients are outside our control.

9. Your choices and rights

You can manage sharing, disconnect agents, remove saved shares and stop following updates using the available controls. You can also remove Cocowork’s Google connection in your Google Account settings; that does not itself delete your Cocowork account or copies of your work.

Depending on your location and applicable law, you may have rights to access, correct, export or delete personal information, restrict or object to processing, withdraw consent, and complain to your local data protection authority. Contact support@cocowork.ai to exercise a right. We may need to verify your identity. Withdrawal of consent does not change processing that was lawful before withdrawal.

If a coco contains your information but belongs to someone else, contact its owner as well as us so we can identify the information and the appropriate response. Cocowork is not intended for children under 18. Contact us if you believe a child has provided personal information.

10. Security and policy changes

We use measures including encrypted network connections, authenticated access, permission checks and revocable agent credentials. No service can guarantee absolute security. Keep credentials private and choose sharing settings carefully.

We will update this page as the service changes and show the revised date. For material changes affecting how we use personal information, we will provide additional notice where required and obtain consent where required before a new use.