Cocoon Privacy Policy

Effective date: 2026-06-15 Last updated: 2026-10-30

Cocoon is a private, offline-first journal and tracking app for parents and caregivers. This policy explains, in plain language, what information Cocoon handles, why, and the choices you have. We've tried to keep it readable — your family's data is yours, and we treat your child's information as sensitive.

This app is provided by Cocoon ("we", "us"), Australia. If anything here is unclear, contact us at privacy@getcocoonapp.com.

A note on who this is for

Cocoon is a tool for adults — parents and caregivers. The account holder is an adult (the parent or caregiver who signs up). The subject of the records you keep — feeds, sleep, nappies, photos, milestones — is your child. Cocoon is not directed to children and is not intended to be used by children to create their own accounts. You, the adult account holder, decide what to record about your child and who in your family can see it. You are responsible for the child information you choose to enter.

What we collect

We only collect what's needed to run the app for you. The app contains no advertising or third-party analytics SDKs, and we do not sell your data. (Our website, getcocoonapp.com, uses Google Analytics: see "Our website" below.)

1. Account information

  • Your email address and an authentication credential (password, managed securely by our authentication provider). Used to create your account, sign you in, secure your data, recover access, and send essential service emails (for example, password resets and family invitations).
  • Your name, as you type it when you sign up or as Apple or Google share it when you sign in with them. It is shown to the caregivers you invite, so they know who logged what.
  • You don't need an account to use Cocoon on one phone. Without one, what you log stays on that device.

2. The family and child data you log Everything you choose to enter about your child or family, including:

  • Child profiles (name or nickname, date of birth, sex if you enter it, photo, and optional gestational weeks at birth for babies born premature).
  • Tracked events — feeds (breast/bottle/pump), nappies/diapers, sleep, solids, growth measurements, health and medication notes, milestones, and free-text notes.
  • Photos, videos and voice notes ("moments") you add to the journal, plus any captions, tags, people, or mood you attach.
  • Optional location tags on journal moments (see "Location" below).
  • Milk stash entries, import data you bring in from other apps, and any preferences/settings.

3. What you send to the optional AI features If you use one of Cocoon's optional AI features — the assistant, voice logging's catch-all for phrases the phone can't read, scanning a daycare day sheet, a personalised sleep-plan write-up, or a weekly note — we process what you send and the parts of your own logged data needed to answer (see "The AI features" below).

4. Limited technical data Basic information needed to operate and secure the service (for example, authentication tokens and timestamps), and crash and error reports if something goes wrong (see "Crash reports" below). We do not build advertising or cross-app tracking profiles.

5. Feedback and support If you send feedback in the app, we collect your message, rating/category, app version/platform and account identifier (when signed in), plus an email address if you choose to provide one. We use this to respond to you and resolve problems.

6. Usage analytics (first-party) The app sends a small set of named usage events to our own backend so we can understand which features are used and improve the app (see "Usage analytics" below).

We do not intentionally collect device identifiers for advertising, contacts, your address book, or your browsing history.

Usage analytics (first-party)

With “Help improve Cocoon” enabled in Settings → Privacy, the app records first-party usage events — for example: the app being opened (used for daily/monthly active-use counts), an account being created, an event or journal entry being logged, the trends or import screens being viewed, a caregiver invitation being sent or accepted, and interest registered in a paid tier. Each event carries its name, a small set of non-content properties, and a random per-install identifier (a UUID generated on your device and stored locally) so we can count installs and repeat use. When signed in, events are associated with your account ID. Non-content properties include the platform, app version/build, feature type, and whether an operation succeeded or failed, its elapsed processing time and a predefined error category. Updated builds also report visits, screen categories, time with the app in the foreground, device language and time-zone settings, and an approximate network country. A visit starts on a fresh launch or after at least 30 minutes away. Background feed and sleep timers do not count as foreground use. App-error reports use predefined categories, such as a render failure or TypeError, rather than raw exception messages or stacks. Country comes from a first-party endpoint using our host Vercel’s network-country header; it is not a home address, and VPNs or travel can change it. We do not store raw IP addresses, city, postcode or GPS coordinates in these analytics. Authorised operators can view aggregate trends and account-level product activity to diagnose problems; account-detail lookups are audited.

  • What it is not: these first-party events never include the content of your logs, journal entries, photos or messages, or precise location, and they carry no advertising identifiers — they go only to our own backend (Supabase, same region and protections as the rest of your data). No third-party analytics service receives them.
  • Why: to measure whether the app works, understand repeat use and feature adoption, prioritise languages and diagnose failures.
  • Your choice: first-party usage measurement is on by default. Turn off Help improve Cocoon in Settings → Privacy to stop new usage, network-country and first-party error reports from that device. This does not affect care logging, syncing, essential security records or the separate scrubbed Sentry reports described below. The setting applies to each device separately; turning it off does not delete already received reports.
  • Retention: usage events are kept while your account is active. Deleting your account also deletes the usage analytics associated with it, and the local install identifier is cleared from your device.

Crash reports

If the app hits an error, it can send a crash report to our error-monitoring provider, Sentry, so we can find and fix the fault. Before anything leaves your device the report is scrubbed: it carries no account identity, no request contents and no console logs, and every record id in it is replaced with a placeholder. Crash reports never include the content of your logs, journal, photos or messages.

Voice logging

When you log by voice, your phone's own speech recognition (Apple's or Google's, under their terms) turns what you say into words; Cocoon receives only the words. Most phrases are understood on your device. Once you have allowed AI features, a phrase the phone can't read is sent to our AI provider to be read and comes back as a draft for you to confirm, unless you turn the AI catch-all off in Settings → Voice logging (see "The AI features" below). Until you allow AI features, nothing you say leaves your phone this way.

Location (optional)

Precise device location is always optional and only used if you ask for it. The separate, approximate network-country analytics described above do not access your device’s GPS. When you tap "use my location" on a journal moment, the app reads your device's precise GPS coordinates at that moment to help label where a memory happened (for example, "Grandma's house"). The place tag you attach (label plus coordinates) is saved as part of that journal entry, so it syncs to our backend with the rest of your journal. Frequently used place labels are remembered locally on your device to autofill the field; these "remembered places" are private and are not synced to our servers.

If you choose to turn those coordinates into a place name, the app sends them to a third-party reverse-geocoding service (BigDataCloud) to get back a nearby locality name. This only happens on your explicit action and while you're online; if it fails, you simply type a label yourself. We never read GPS location in the background and never use these journal coordinates for advertising or analytics.

How we use your information

  • To provide the app: store and display your logs, journal, trends, growth percentiles, milestones, and guides; keep the app working offline and sync across your devices.
  • Multi-caregiver sharing: let caregivers you invite see and add to a shared child's records.
  • The AI features: answer your questions about your own logged data, read a phrase or a day sheet, or write a summary, only once you have allowed AI features and only when you use one.
  • Security and integrity: authenticate you, protect accounts, prevent abuse, and fix bugs.
  • Essential communication: account, security, and family-invitation emails.

We do not use your data for advertising, and we do not sell or rent it.

How your data is stored and protected

  • Offline-first: what you log is saved on your device first and works with no connection. Sync is a background convenience, not a requirement.
  • Cloud storage: when you're signed in and online, your data syncs to our backend hosted on Supabase. Photos and videos are stored in private, access-controlled storage and served only via short-lived signed links to people who are authorized.
  • Encryption: data is encrypted in transit (HTTPS/TLS) and at rest.
  • Access control: Row-Level Security (RLS) is enforced on the server so each family can only ever read or write its own records. Your child's information is treated as sensitive.

Sharing — only with people you invite

  • Caregivers you invite: when you invite a partner, grandparent, or nanny to your family, they can see and contribute to the shared child's records. Membership is at the family level — inviting someone once gives them access to the children in that family. You control who is invited.
  • Running timers: a nap or breastfeed you time is shared with those caregivers while it runs (which child, whether it's a nap or a feed, when it started, its pauses and sides, and who started it), so any of them can pause or stop it. When it stops, it becomes the usual entry in the child's records. Pump sessions and the feed-safe timer stay on your phone.
  • No selling, no ads: we never sell your data and run no advertising.
  • Service providers (sub-processors): we use a small number of vetted providers strictly to run the service (see "Third parties" below). They process data only on our instructions.
  • Legal: we may disclose information if required by law, or to protect the rights, safety, and security of users and the service.

The AI features — how your data is handled

Cocoon's AI features are optional, and each one runs only when you ask for it. They are a transparent lens on your own logged data: they do not diagnose and are not medical advice, and they point you to your own doctor or nurse for any health concern.

  • Your permission first: before any AI feature sends anything, Cocoon asks you once, naming our AI provider, Anthropic, and listing what each feature sends. Nothing is sent unless you choose Allow AI features. You can turn AI features on or off at any time in Settings → Data & privacy → AI features. Turning them on shows the same explanation first; once they are off, nothing more is sent.
  • What happens: the request goes to our secure server function, which authenticates you, reads only your own family's data through the same Row-Level Security controls, and sends what the feature needs to our AI provider, Anthropic (the Claude API), to produce a reply.
  • What the provider receives, feature by feature:
    • Assistant: your typed message and the specific logged data needed to answer it (for example, summaries of recent sleep or feeds). The app shows you which data the assistant looked at under each answer.
    • Voice catch-all (a setting in Settings → Voice logging, used only once you have allowed AI features): the words of a spoken phrase the phone could not read. The result comes back as a draft; nothing is logged until you confirm it.
    • Day-sheet scan: the photo of the daycare or nanny sheet you choose. It is read once to draft the day's entries for you to review and is not stored.
    • Sleep-plan write-up and weekly note: summaries of your child's recent logged sleep, feeds and patterns.
  • Training: we instruct our AI provider to process your inputs only to return a response to you, and not to train their general models on your data. Anthropic processes the data as our service provider under their commercial terms.
  • Key safety: your device never holds the AI key; all AI processing is server-side. A guardrail reframes any reply that drifts toward medical claims.
  • Optional: if you never use an AI feature, nothing is sent to our AI provider.

Children's data

The records in Cocoon describe a child, but the account is held and controlled by an adult. Cocoon is a parenting/caregiving utility intended for use by adults; it is not directed to children and we do not knowingly allow a child to register their own account. Because the adult account holder enters and controls all child information, that information is handled under this policy with the same protection as any other sensitive personal data. If you believe a child has created an account, contact us at privacy@getcocoonapp.com and we'll act on it.

How long we keep your data, and how to delete it

  • While your account is active, we keep your data so the app works across your devices and for your invited caregivers.
  • In-app deletion: you can delete your account at any time from Settings → Data & privacy → Profile & account → Delete account (type DELETE to confirm). If you signed in with Apple, Apple asks you to confirm, and Cocoon's access to your Apple Account is revoked as part of the deletion. This permanently removes your account and the records of any child you solely manage. Important: families you share with others keep their data for those other caregivers — your deletion does not erase a shared family's history from the other members' accounts. This action cannot be undone.
  • Export first if you want a copy: you can take a complete copy of your data with you before deleting. Settings → Data & privacy → Backup & account controls → Export everything produces a single backup file containing every log, growth measurement and journal entry plus your photos and videos, which you can restore on any device. You can also export a date-range report as PDF or CSV from the summary screen.
  • After deletion, residual copies may persist for a short period in encrypted backups before being overwritten on our providers' normal cycles.

Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your data, to object to or restrict certain processing, and to withdraw consent. You can exercise most of these directly in the app (view, edit, export, and delete). For anything else, contact privacy@getcocoonapp.com and we'll respond within a reasonable time. Australian users may also contact the Office of the Australian Information Commissioner (OAIC); EEA/UK users may contact their local data protection authority.

Third parties (sub-processors)

Provider Purpose Where
Supabase Cloud database, authentication, file storage, sync (encrypted, RLS-protected) Managed cloud infrastructure
Anthropic (Claude API) Powers the optional AI features (assistant, voice catch-all, day-sheet scan, sleep-plan write-up, weekly note); processes what you send plus your own data slices to return a reply Per Anthropic's commercial terms
BigDataCloud Optional, on-demand reverse-geocoding of coordinates into a place name (only when you tap "use my location" and choose to label it) External API
Sentry Crash and error reports, scrubbed of identity, request contents, logs and record ids before sending Sentry's cloud infrastructure
Google Analytics Our website only (getcocoonapp.com): counts visits to the site's pages. Never in the app Google's cloud infrastructure

The app contains no third-party advertising or analytics SDKs, and we do not sell your data or use it for ad targeting.

Our website

Our marketing website, getcocoonapp.com, uses Google Analytics to count visits: which pages are viewed, how visitors arrived (for example, from a search), and their general location, device and browser. Google Analytics sets cookies in your browser to tell one visit from the next. We use it only to understand which pages help people, not for advertising, and the website has no ads. Nothing from the Cocoon app reaches Google Analytics, and the website cannot see what you log in the app.

You can stop it at any time: block or clear cookies for getcocoonapp.com in your browser, or install Google's opt-out add-on at tools.google.com/dlpage/gaoptout. Google's use of the data is described at policies.google.com/technologies/partner-sites. If you join the beta list or a waitlist on the website, we keep the email address you give only to contact you about it, and delete it with your account or on request.

International transfers

Cocoon relies on cloud service providers that may store and process your data in various locations, which can include countries outside your own. Where data is processed internationally, we rely on appropriate safeguards and process only the minimum necessary.

Changes to this policy

We may update this policy as the app evolves. We'll revise the "Last updated" date and, for material changes, provide notice in the app.

Contact

Questions, requests, or privacy concerns: privacy@getcocoonapp.com Cocoon, Australia

Cocoon is not a medical device and does not provide medical advice or diagnosis. It is an observation and context tool. For any health concern about your child, contact your doctor or child-health nurse.