Privacy policy

Who we are

Cofocus is run by ElysiumOne OÜ, a company registered in Estonia (registry code 14873737), at Telliskivi tn 60a/5, 10412 Tallinn, Estonia. We decide how your personal data is used, which makes us its controller under the EU's General Data Protection Regulation (GDPR). Write to privacy@cofocus.one about anything in this policy.

What we collect

Your account

Your email address, and a password if you choose to set one. Signing in is handled by Clerk, which sends you a one-time code or checks your password; Clerk stores the password, not us.

Your profile

Your first and last name, your display name, your username, and anything else you choose to add: a picture, a cover image, a short bio, where you are, the languages you speak, your work, your interests, your pronouns, your date of birth, answers to profile questions, and how you like to work in a session.

Your sessions

The sessions you book and cancel, who you were matched with, when you joined and left, the title, description, tags and colour you give a session, and anything you write in a session's chat. From these we work out your statistics, streaks, badges, leaderboard places and how reliably you attend. We also keep your tasks, goals and repeat bookings.

Video calls

Calls are never recorded. Nothing you say or show in a call is kept, and we never take pictures of it. Your camera and microphone go straight from your browser to your partner's. When a direct connection isn't possible, the call passes through our relay server or, if that fails too, a video service that carries calls for us. Neither stores the call. Background blur works inside your browser, so your camera picture without the blur never leaves your device.

To keep calls working, we keep a short technical report on each call. It holds numbers about the connection, never what you say or show: whether and how your browsers connected, each step of joining, the type of network, your browser and device, and, every 10 seconds, how fast the call's data travelled each way, how much of it was lost on the way, and how smoothly the picture came through.

Messages, community and connections

Your direct messages, which we store so they are there when you come back. They are not end-to-end encrypted. Your posts, comments, reactions, poll votes and bookmarks in the community. Your connections, favourites, blocks and breaks.

Reports

When you report someone, or someone reports you, we keep the report: who made it, who it is about, what was reported and why, and the notes we make when we review it.

When you report a problem with Cofocus, we keep what you write and any screenshots you add, with the page you were on, your browser and system, your window size and time zone, the version of Cofocus you were using, and when you sent it.

Payments

If you buy a plan, Stripe takes the payment and holds your payment details; we never see your full card number. Stripe tells us your customer and subscription numbers and, for each card that pays, its brand, last four digits, country and fingerprint, and the wallet it paid through, such as Apple Pay or Google Pay. A fingerprint is a code that recognises the same card again without revealing its number. We record each payment you make, with its amount and the plan it paid for, so we can see which sites, pages, campaigns and countries the people who pay come from.

Your device and connection

Whenever you use Cofocus while signed in, we record your IP address, your browser and device, the approximate location your IP address points to (country, region, city, time zone, and sometimes a postcode and map position), the network it belongs to, your browser's languages, which page or action you used and when, and whether your Cofocus tab is in front and being used, left idle, or in the background. We also record which emails we send you, never what they say. The links in our emails name the email they are in, and the first page you open from a link is recorded with the campaign tags in it (such as utm_source) and the name of any click id on it, so we can see which emails and campaigns bring people back.

While you are signed in, your browser also works out its fingerprint: a code made from how it draws, handles sound and describes itself, which recognises the same browser again on any account. It sends us only that code, and stores nothing in your browser to make it.

When you visit without signing in

When you open our pages without being signed in, the page tells us which page it is, the name of the site that sent you, any campaign tags in the link you followed (such as utm_source), and how long the page stayed on your screen. If an ad or a social site added a click id to that link (such as Google's gclid), we keep only the click id's name, never its value. When you try to sign in or create an account, we record how the try ended, such as a code being sent or a wrong password, never the email you typed. From your connection we add your country, and your browser, operating system and type of device. We count you by a code made from your IP address and browser with a key we replace every midnight (UTC) and then delete, so you have the same code for one day and nobody can trace it back to you afterwards. Your IP address isn't stored with the visit, and we set no cookie and store nothing in your browser for it. If you then create an account, the record of your sign-up keeps the site that sent you, the first page you opened, any campaign tags and click id name you arrived with, and your code for that day, so the pages you opened that day are linked to your account. Since nothing is stored in your browser, our links into sign-up and sign-in carry these in their address.

When a search engine or an AI service fetches our pages, we record which one it was and whether it was for search results, for an AI's answer, or for training an AI.

When you write to us

Your email and what you tell us.

How we use it

Each use below names its legal basis under the GDPR.

To run Cofocus for you

Creating your account, matching you with partners, connecting your calls, carrying your messages and posts, working out your statistics, and taking payment. The basis is our contract with you: the terms of service.

To sync your Google Calendar

Only if you connect it. The basis is your consent, which you withdraw by disconnecting it (see Google Calendar).

To keep members safe

Reviewing reports, screening what people write, holding suspicious new accounts for review, recognising people we have banned when they come back under another account, and spotting fraud and abuse. Your IP addresses, device details, browser fingerprints and card fingerprints are used for this. The basis is our legitimate interest in keeping members safe when they meet on camera.

To keep it working and make it better

Call reports, the problems you report, error records, the record of which pages and actions people use, which emails we send them and which payments they make, and the count of visits to our pages and where they came from. The basis is our legitimate interest in a service that works.

To email you

Sign-in codes, the email that welcomes you when you join, and messages about your plan, such as a payment that failed, are part of running your account, as are the email that tells you why if we suspend it and the one that confirms you deleted it. So are emails about your sessions: reminders before the sessions you book, at the times you choose, which you can turn off, an email telling you your partner is waiting when you haven't joined a session that has started, and one telling you we froze your account when you missed a session. We may also email you news about Cofocus, on the basis of our legitimate interest in telling members about the service they use. Every news email has a link to stop them.

To meet our legal duties

Keeping accounting records, and answering lawful requests from authorities.

We don't sell your data, we don't use it for advertising, and nothing on Cofocus tracks you across other websites.

Automated decisions

Some things on Cofocus are decided by the system rather than by a person:

• Matching. You are paired with someone who has booked the same time, never with anyone either of you has blocked or taken a break from, and preferably with someone who attends about as reliably as you do.
• Reliability. It goes down when, in a session your partner attends, you don't join, join late or leave well before the end, and when you cancel a matched session in the last minute before it starts. How many sessions you can have booked at once depends on your plan and on how often you attend.
• Missed sessions. If you haven't joined a session 10 minutes after it started, your booking is frozen until you unfreeze it, as the terms describe.
• Screening. A word filter refuses messages, session chat, profile text and posts containing certain words, such as sexual terms and the names of other coworking services. Community posts and comments are also checked by an automated moderation service; if it flags one, for example for nudity, threats or self-harm, the post is removed at once, you are told, and a person on our team reviews it. We keep a record of what the screening catches longer than the rest of your data: what you wrote, what was caught, which part of Cofocus it was in, and when. For a year after it was written the record is linked to your account, even if you delete your account sooner; after that we remove your account from it and keep the rest with no end date.
• Sign-up checks. A new account first seen on Tor, a VPN, a datacenter network, a network in a country we watch for abuse, or a network whose time zone is far from the account's can be held until a person on our team reviews it.

None of these decides anything about you outside Cofocus. You can ask a person to look again at any of them by writing to privacy@cofocus.one.

What other members see

Everything on Cofocus is behind sign-in except your booking and invite links. Profiles and the community are not public on the web.

• Signed-in members can see your profile: your name, username, picture, cover, whatever else you have added to it, your age if you gave your date of birth, and when you joined. They also see your activity grid, badges, number of sessions, streak, how reliably you show up, leaderboard places, and your community posts and comments. Unless you hide them, they see your local time and your connections.
• Open times. Any member can see the sessions you have open to book with you directly, unless you narrow "Who can book you directly" in Settings › General.
• While a session of yours waits for a partner, members looking at that time see your name and picture on it.
• Your session partner sees your name, username and picture, the tasks on that session (each one's title, and whether it is done), and whatever you show and say in the call and its chat. The title, description and tags you give a session stay private to you.
• Anyone with your booking link sees your name, your picture and the times you have open over the next two weeks. An invite link shows your name, picture and the one time it offers.
• Images you upload are kept at web addresses that are hard to guess but not protected by sign-in. Anyone who has the address of an image can open it.

Who else handles it

These companies handle data for us, only to provide their part of Cofocus. We name the ones you deal with directly. For the others we say what they do and where they are based, and we send the full list to anyone who asks at privacy@cofocus.one.

• Clerk (USA) runs sign-in and sends sign-in codes.
• Stripe (Ireland and USA) takes payments.
• Google (USA) receives your sessions if you connect Google Calendar. It also helps your browser set up each call, which shows it your IP address.
• Hosting providers (USA) run our servers and our database.
• A cloud storage provider (USA) holds the images you upload.
• A video service (USA) carries a call when your browsers can't connect any other way. It doesn't record calls.
• An email service (USA) sends the emails about your plan and your sessions, with each session's time and the title you gave it, and any news from us. It doesn't record whether you open them or which links you click.
• A moderation service (USA) checks the text and images of community posts and comments for harmful content, and doesn't use them to train its models. Messages and sessions are never sent to it.
• A place search service (Germany) suggests places as you type where you are on your profile. It receives only the text you type, from our server, not who you are or your IP address.

The radio stations in Music stream from the stations' own servers, which see your IP address and browser while you listen.

We may also share data with professional advisers, with authorities when the law requires it, and with a company that takes over Cofocus, which would then be bound by this policy.

Data sent outside Europe

Several of these companies are in the United States. Where a company is certified under the EU-US Data Privacy Framework, that framework protects the transfer. Otherwise we rely on the European Commission's standard contractual clauses. Write to us for a copy of the safeguards that apply.

How long we keep it

• Your account, profile, sessions, statistics, tasks, messages and posts: for as long as you have an account.
• Call reports: 90 days.
• The record of pages and actions: your IP address and browser until 90 days after we last see them. The rest of the record, with its approximate location and type of device, for as long as you have an account.
• Visits to our pages without signing in, and what search engines and AI services fetched: no end date. A visit is kept under its day's code, never an IP address.
• The record of what our screening caught: linked to your account for a year after it was written, whether or not you still have an account, then kept with no end date without your account. This is writing the word filter refused, such as the name of another coworking service or sexual language, and posts our moderation check removed, for example for nudity, threats, hate, self-harm or graphic violence.
• The IP addresses your account has used, the fingerprints of the browsers it was used in, and the fingerprints of the cards that paid: for as long as you have an account, and with no end date after you delete it, as Deleting your account explains.
• A break you take from someone ends when you set it to; a block stays until you remove it.
• Payment and accounting records: as long as accounting law requires, which in Estonia is seven years.
• Bans, sign-up checks, reports we took action on, and the notes made on them: no end date.
• Reports we took no action on, and the copies of what was reported kept with them: they name who made the report and who it was about for a year after it was made. After that we remove the names and keep the rest with no end date. A report that names someone whose ban is still in force keeps the names until the ban ends.

Deleting your account

You can delete your account in Settings › Account. If you have a plan that renews, cancel it first. Deleting ends any plan on the account, lifetime access included, and time left on it is not refunded; if you want a refund, ask before you delete. We can't delete an account while a report about it is waiting for review.

Deleting your account removes at once:

• Your sign-in, profile, settings, statistics, badges, tasks, goals, connections and blocks.
• Your call reports and the images you uploaded.
• The record of the pages and actions you used, except what our screening caught.
• Your community posts, comments, reactions, poll votes and bookmarks.
• The text of every message you sent. Each one becomes an empty placeholder in the other person's conversation.
• The events we created in your Google Calendar for upcoming sessions, and our access to it.

Your past sessions, bookings, the list of people you had sessions with, your leaderboard rows and the fact that you sent messages (without their text) stay under your account's ID, with no name, picture or profile attached. Other members see you as "Cofocus User". Your username is held for 30 days so no one else can take it straight away. We normally delete your customer record at Stripe 120 days later; Stripe keeps the payment records the law requires.

These records are kept with no end date, because they are how we stop banned people returning, deal with reports and see who has broken our rules:

• A record that the account was deleted, with its email address, its sign-in and Stripe IDs, and its usernames.
• The IP addresses the account used, with their location, network, browser and languages.
• The fingerprint, brand, last four digits and country of each card that paid.
• The fingerprint of each browser the account was used in, with the browser's name and when it was used.
• Bans, reports, sign-up checks and the notes made on them. A report we took no action on stops naming the account a year after it was made, unless someone it names is banned.
• What our screening caught: each piece of writing the word filter refused, with the words it caught, which part of Cofocus it was in and when it was written, and each post our moderation check removed, with the reason. Each stays linked to the account until a year after it was written; after that, the account is removed from it.
• Copies of what the account wrote and uploaded, if at the time it was deleted it was banned, its sign-up was still being reviewed, or a report about it was still waiting; copies of any post our screening removed; and the reported words in reports over a year old that we took no action on, which by then no longer name the account.

Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you, in a format you can take elsewhere;
• correct it, though you can change most of it yourself in Settings and on your profile;
• delete it, which you can do yourself by deleting your account;
• limit how we use it while you dispute its accuracy or our use of it.

Your right to object. You can object at any time to any use of your data that rests on our legitimate interests: the safety checks, the record of pages and actions, and news emails. We then stop, unless we have compelling grounds that override your interests, such as keeping a banned person off Cofocus. You can always stop news emails, with no reason needed.

Write to privacy@cofocus.one. We answer within a month and may ask you to confirm the request from the email address on your account. Where you gave consent, such as connecting Google Calendar, you can withdraw it at any time.

If you think we have mishandled your data, you can complain to the Estonian Data Protection Inspectorate (aki.ee) or to the data protection authority where you live.

If you live in California or another US state with a privacy law, you have the right to know what we collect, to have it corrected or deleted, and not to be treated differently for asking. We do not sell or share personal data for advertising.

Cookies and browser storage

Cofocus sets one cookie of its own, to keep you signed in, and uses no advertising or analytics cookies, which is why there is no cookie banner.

• Cofocus sets one cookie when you finish signing in, holding only the ID of your login. Cofocus can't keep you signed in without it, so it needs no consent. Clearing this site's data removes it and signs you out.
• Clerk sets the cookies that keep you signed in. Cofocus cannot work without them, so they need no consent.
• Stripe sets cookies on its own checkout page, which opens on stripe.com, to prevent fraud.
• Your browser's local storage holds what makes Cofocus open quickly and as you left it: who is signed in on this browser, with their name and picture, your theme, views and settings, your camera, microphone and blur choices, your timer and music settings, posts you have not finished writing, and a call report waiting to be sent. Signing out removes who was signed in; the rest stays on this browser until you clear this site's data.

We don't track you across websites, so Do Not Track and Global Privacy Control signals change nothing here.

Google Calendar

If you connect Google Calendar, Cofocus puts your sessions into the calendar you choose. Cofocus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we ask Google for: permission to create, change and delete events (calendar.events), and to see the list of your calendars (calendar.calendarlist.readonly), so you can choose which one your sessions go into.
• What we read: your list of calendars and Google's event colours. We never read the other events in your calendar.
• What we send: one event per session, with its time and length, your title for it or your partner's name, your description, your name, the session's ID, a link to Cofocus, your reminder and colour choices, and, hidden from view, your Cofocus account ID and how many people are in the session.
• What we store: the access and refresh tokens Google gives us, your Google email address, the calendar you chose, your reminder and colour settings, and the ID of each event we create.

We use this data only to keep your calendar in step with your sessions. We don't share it, use it for advertising, or let anyone read it, except where you ask us to, where security requires it, or where the law does.

Disconnecting in Settings › Integrations removes the upcoming events we created and deletes our tokens. You can also remove Cofocus's access in your Google Account at myaccount.google.com/permissions. Deleting your Cofocus account does both.

Children

Cofocus is for people aged 17 and over. When you create an account you confirm you are 17 or over, and Cofocus won't accept a date of birth on your profile that makes you younger. We don't knowingly collect data about anyone younger, and we close any account we learn belongs to a child. If you think a child is using Cofocus, write to privacy@cofocus.one.

Security

Everything travels between your browser and Cofocus encrypted, our database provider encrypts what it stores, and only people who need personal data to run Cofocus can reach it. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

Changes to this policy

When we change this policy, we post the new version here with a new date. If a change matters to how your data is used, we tell you by email or in Cofocus before it takes effect.

Contact