Privacy Policy

CoGo is operated by Brendan Born, a sole proprietor based in Washington State, USA, doing business as "CoGo." In this policy, "we" / "us" means CoGo and "you" means the person using the product.

We take privacy seriously. We only collect what we need to run CoGo, we don't sell your data, and you can delete your account at any time.

• Account info: your name, email address, and a password hash when you sign up.
• Trip data: anything you add to a trip: blocks, notes, travelers, budgets, photos, forwarded booking emails, so we can save and sync it across your group.
• Basic usage analytics: events like page views and feature usage via PostHog, used to improve the product. These run only if you allow analytics cookies. See "Cookie preferences" below.
• Contact form submissions: the name, email, and message you send us via our contact page.
• Billing info: if you subscribe, Stripe collects and stores your payment method on its own servers; we receive a customer ID and subscription status only.
• Published boards: we may collect and store visible collaborator content and selected user-owned media in a durable, immutable publication copy, together with version information, visibility choice, optional public byline, publication and byline consent records, source and remix lineage, downstream-publication permission, and moderation or reporting records. We collect only the fields needed to operate the publication, prevent abuse, provide appeals, and maintain limited internal audit history.

We don't collect payment card numbers directly. Stripe handles all card data. We don't track you across the web. We don't sell or rent your data to advertisers, and we don't use your trip content to train AI models.

We use the data above to run the product, including syncing trips, sending account emails, parsing forwarded booking confirmations using Anthropic's Claude API, communicating service-related changes, and improving CoGo. For published boards, we use the durable, immutable publication copy to display Public boards, provide link-based access to Unlisted boards, support exact version links, discovery, and independent CoGo remixes, record publication and byline choices, investigate reports, administer moderation and appeals, and enforce the publication rules. The publication and moderation purposes described here apply to published content and associated operational records, not a general permission to inspect unrelated private trip content. A publication acknowledgement is not consent to product analytics. PostHog analytics on publishing screens and elsewhere remain gated by the analytics-cookie choice described below.

The published-board provisions in this Privacy Policy are provisional and pending review by CoGo's outside law firm. CoGo may update them after that review and will handle meaningful changes under the Changes section below.

CoGo uses the following providers to operate. Each has its own privacy practices.

• Supabase: authentication + database hosting
• Vercel: web hosting + edge functions
• Postmark: transactional email + inbound email parsing
• Anthropic: Claude API, used to extract booking fields from forwarded emails
• Google Gemini: AI extraction of place and booking details from videos you save to a trip feed, and text/design generation for printed photo books
• Stripe: payment processing for subscriptions and printed photo books; shipping address captured at checkout is shared with Stripe and our print partner
• Prodigi: print + ship partner for photo books; receives the recipient name, shipping address, and the print-ready PDF for each order
• PostHog: product analytics (only with your consent)
• Google Maps Platform: Food discovery search, map content, and live place details and photos on published boards
• Mapbox: geocoding (turning an address or place name you type into coordinates) and the interactive maps on the trip board, the planning view, and the dashboard globe
• Unsplash: image search and delivery for eligible published-board imagery. When a board displays an Unsplash image, the browser may request that image from Unsplash's servers. That request may include network or browser information handled under Unsplash's terms and privacy practices. CoGo keeps the required photographer and Unsplash attribution with the image.

Food search text and the requested map area are processed by Google to render Food discovery. When the provider runtime is used, ordinary network and device data can reach Google under its own policies.

CoGo stores a Google Place ID when you save a restaurant, together with CoGo-owned trip state. When you publish a board containing a Google-backed place, its Place ID becomes part of that published version, and an independent remix can retain the reference. A viewer's browser may contact Google to show current place details and photos. CoGo does not persist Google names, photos, ratings, reviews, addresses, hours, or other provider result content. For more information, see the Google Privacy Policy.

Analytics cookies (PostHog) are optional. They run only if you allow them, and you can change your choice here at any time.

We keep account, trip, and publication data while it is needed to provide the service and administer the choices you make. When a source trip or account is deleted, our deletion process removes the live source publication and its stored publication-version snapshots. Pausing, unpublishing, retiring, revoking, or deleting the source can end availability through CoGo, but CoGo cannot recall copies already downloaded, shared, cached, or indexed outside CoGo. An independent remix is a separate copy and may remain. Surviving remix lineage may retain opaque publication identifiers, terminal state, and immutable visibility, permission, and timing receipts needed to explain or enforce that remix, but not the deleted source snapshot or byline.

Resolved moderation cases, reports, evidence, appeals, clearance history, and case events become eligible for deletion at the case retention deadline, currently 12 months after resolution by default. A legal hold, an applicable appeal state and deadline, pending notification or delivery work, or another applicable dependency can prevent cleanup. The reporting system separately cleans expired or consumed verification challenges, old rate-limit windows, moderation request receipts, and trip-deletion receipts when their respective cleanup conditions are met.

Publication-operation receipts, including prior byline choices, remain while the source trip exists and are removed with that trip. Limited staff-access and revocation ledgers currently have no automated cleanup. This does not make all audit history permanent. We do not promise immediate erasure from backups, logs, email systems, caches, vendors, or copies controlled by other people unless the relevant provider procedure and applicable law support that result.

Reports are handled through restricted operational systems and may be submitted by an account holder or through a verified-email flow. We use the information needed to verify the report, capture the reported publication, investigate, and communicate an outcome. Reports do not automatically make a board unavailable. If CoGo revokes a board and an appeal is available, the owner may submit an explanation through the provided appeal process. Authorized staff and service providers acting for CoGo may process these records, and we limit access according to the operational need.

Product analytics are optional and run only when you allow analytics cookies. The publication acknowledgement does not replace that choice. External image delivery is different from CoGo analytics: an Unsplash image request can send network or browser information to Unsplash, and CoGo cannot control Unsplash's independent handling of that request.

All traffic to CoGo is encrypted with HTTPS. Passwords are hashed by Supabase Auth using industry-standard algorithms. We never see your password. We do our best to keep your data safe, but no internet service can guarantee perfect security.

CoGo isn't designed for children under 13. We don't knowingly collect personal information from anyone under 13. If you believe a child has signed up, email us and we'll delete the account.

You can export your trip data, edit your profile, or delete your account at any time from settings. You can also email us to request a copy of the data we hold about you, or to ask us to correct or delete it. We'll respond within 30 days.

If we make meaningful changes to this policy, we'll notify active users by email before the changes take effect.

Questions about privacy? Reach us through cogo.travel/contact. We respond to every message.