Your Privacy Rights

This Privacy Policy explains what personal data UrCosmo (“UrCosmo,” “we,” “us,” or “our”) collects, why we collect it, how we use, share, and protect it, and the choices and rights you have. It applies to the UrCosmo website, applications, and services (the “Service”). It forms part of, and should be read with, our Terms of Service and Security overview.

Our approach is simple: your data exists to make the product work for you. We don't sell it, we don't advertise against it, and no other user can see your private content.

1. Who we are

UrCosmo is the operator of the Service and the data controller responsible for your personal data. For any privacy question or to exercise your rights, contact us at [email protected].

2. Information we collect

Information you provide

• Account information from your sign-in provider. When you sign in with Google or GitHub, we receive your name, email address, avatar, and a stable account identifier. We use this only to create and identify your account. We never receive your password.
• The content you create. Everything you enter into the modules you use — tasks, reminders, schedule blocks, journal entries, reflections, memorable days, dreams and bucket-list items, books, job applications, links, notes, documents, contacts, movies & series, and projects — along with any files you upload. This exists solely so the product can work for you. Sensitive free-text fields (such as journals, reflections, note bodies, contact notes, and vault secrets) are encrypted at rest, as described in our Security overview.
• Information about other people that you enter. If you add contacts, share a reminder with someone, or invite a collaborator, you provide us with their information (such as a name and email). See section 7.
• Preferences and settings. Your enabled features, theme, timezone, country/locale, dashboard layout, and notification preferences.
• Communications. If you email us for support or disclosure, we keep that correspondence.

Information we collect automatically

• Usage and product analytics. We use privacy-conscious analytics (PostHog, hosted in the EU) to understand which features are used and to improve the Service — for example, page views, session length, device, operating system, browser, approximate location derived from your IP address, and interactions with the product.
• Device and log data. Basic technical information such as your IP address, browser type, and timestamps, used for security, debugging, and abuse prevention.
• Cookies and similar technologies. See section 6.

3. How we use your information

• To provide, maintain, and operate the Service and its features;
• To authenticate you and keep your account and data secure;
• To send transactional and service messages, and — if enabled — reminder and digest emails and push notifications;
• To provide optional, user-triggered AI features when you use them (see section 8);
• To understand usage and improve, debug, and develop the Service;
• To prevent, detect, and address fraud, abuse, security incidents, and violations of our Terms;
• To comply with legal obligations and enforce our agreements.

4. Legal bases for processing (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Performance of a contract — to provide the Service you sign up for and the features you use.
• Legitimate interests — to secure, improve, and understand the Service, in a way that does not override your rights.
• Consent — where required, for example for certain analytics or optional communications; you can withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law.

5. What we never do

• We never sell your personal data.
• We never share it with advertisers or use it for cross-context behavioral advertising.
• We never use your private content to train third-party AI models.
• No other user can ever see your private content.

6. Cookies and analytics

We keep cookies to a minimum. We use:

• Strictly necessary cookies — a secure session cookie to keep you signed in, and a small preference cookie that remembers your light/dark theme so the page doesn't flash on load. These are essential for the Service to function.
• Analytics — our EU-hosted analytics (PostHog) to measure product usage and improve the Service. Analytics requests are routed through our own domain, and we do not use advertising or cross-site tracking cookies, and no data is sold.

You can control cookies through your browser settings; blocking strictly necessary cookies may prevent you from signing in.

7. Information about other people

When you add a contact, send a reminder to someone, or invite a collaborator to a Project, you provide us with limited personal data about that person so we can deliver the feature you asked for. In that context, you determine what to enter, and you are responsible for having a lawful basis to do so and for handling that information appropriately. We process it only to provide the relevant feature to you, and reminder emails can only be sent to addresses that already exist in your own contacts (or your own address), which prevents the Service from being used to email arbitrary strangers.

8. AI features and your data

UrCosmo includes optional, user-triggered AI features — the Cosmo assistant, the daily-digest introduction, and the notes “Enhance” action. When you use one of these, the relevant content you submit is sent to a third-party AI provider (for example, via an AI gateway, or Google's Gemini for note enhancement) to generate a response, and the result is returned to you. If a feature's AI provider is not configured, the feature falls back to a non-AI behavior. We do not use your content to train third-party models, and AI providers process it only to return your result. If you never use these features, your content is never sent to an AI provider.

9. How we share information — sub-processors

We do not sell your data. We share it only with vetted service providers who process it on our behalf to run the Service, under contracts that require them to protect it and use it only for that purpose. Our current sub-processors are:

We may also disclose information if required by law, to comply with a valid legal process, or to protect the rights, safety, and security of UrCosmo, our users, or the public. If UrCosmo is ever involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, and we will notify you and honor this Policy.

10. International data transfers

UrCosmo and its providers operate globally, so your data may be processed in countries other than your own, including outside the EEA, UK, or India. Where we transfer personal data across borders, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses — to ensure it remains protected.

11. Data retention

We keep your personal data for as long as your account is active and as needed to provide the Service. When you delete content, it is removed from the live Service, and when you delete your account, your associated data is deleted — cascading through the records you created — except for limited residual copies in routine backups, which are overwritten on a rolling basis, and information we are required to retain to comply with legal obligations or resolve disputes.

12. How we protect your data

We use encryption in transit (HTTPS/TLS), application-layer AES-256-GCM encryption at rest for sensitive fields, private file storage with short-lived signed URLs, strict per-user access control, and input validation. Full details are in our Security overview.

13. Your rights

Whatever your location, you can:

• Access & portability — the personal data export gives you a complete, structured copy of everything UrCosmo holds about you, in a machine-readable format.
• Correction — edit or update any of your content at any time directly in the app.
• Deletion — delete individual content or your entire account and all associated data.

If you are in the EEA or UK (GDPR)

You also have the right to restrict or object to certain processing, to withdraw consent where we rely on it, and to lodge a complaint with your local data-protection authority. We respond to rights requests within the timeframes required by law.

If you are in California (CCPA/CPRA)

You have the right to know what personal information we collect and how we use and disclose it, to access and delete it, to correct it, and to not be discriminated against for exercising your rights. We do not sell or share your personal information as those terms are defined under California law, so there is nothing to opt out of — but you can still exercise your access, deletion, and correction rights at any time.

If you are in India (DPDP Act)

You have the right to access and correct your personal data, to request its erasure, to nominate another person to exercise your rights in the event of death or incapacity, and to an accessible means of grievance redressal. Contact us at [email protected] and we will respond promptly.

14. How to exercise your rights

The fastest way to access and correct your data, or delete content and your account, is directly in the app — the data export gives you everything at once. For anything you can't do in the app, or to make a formal request, email [email protected] and we'll handle it. We may need to verify your identity before acting on a request.

15. Children's privacy

Students of all ages use UrCosmo — for example, to plan study schedules. The Service is available to users aged 13 and over, and users under the age of majority (typically 18) should use it with the involvement and consent of a parent or guardian. We do not knowingly collect personal data from children under 13, and we do not serve advertising, sell data, or profile students. Where a higher minimum age of consent applies (for example, up to 16 in parts of the EEA), a parent or guardian must provide consent. If you believe a child under 13 (or under the applicable minimum age) has provided us with personal data without the required consent, contact us at [email protected] and we will delete it promptly.

16. Third-party links and shared content

The Service may contain links to third-party sites, and public content you choose to share is governed by your choice to share it. This Policy does not cover third-party sites; please review their privacy policies.

17. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you in the app or by email before they take effect and update the “Last updated” date above. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

18. Contact us

Questions, requests, or complaints about privacy? Email [email protected]. See also our Terms of Service and Security overview.