Cossy Privacy Policy

1. Information We Collect

Cossy is a social app for the cosplay community developed by nstudio. We collect only the information necessary to operate the app, keep the community safe, and improve your experience.

• Account data: Email address and a display name when you register.
• Profile data: Bio, avatar image, links, and other profile details you add.
• Content you create: Posts, images, comments, cosplans, budgets, event attendance, and messages in direct and group chats.
• Photos & camera: Only the images you choose to attach to posts or your profile, accessed with your permission on the device.
• Approximate location (stays on your device): Only if you grant permission, the app reads your approximate, city-level position to show how far conventions are from you ("Near me"). Distances are worked out on your device; your position is never sent to us or to anyone else, and we don't store it. You can decline and still use Cossy.
• Crash & diagnostics: Collected automatically via Sentry to find and fix bugs. Not linked to your content for advertising.
• Push notification identifier: Via OneSignal, so we can send the notifications you enable.
• Usage analytics: Which screens and features you use and what you search for in the app, collected via PostHog on EU servers and linked to your account ID, so we can see what works and what to improve. You can switch this off in the app under Profile → ☰ → Legal & support.
• Basic technical data: App version, device type, and similar information used to operate and secure the service.

2. How We Use Your Data

We use the information we collect to run and improve Cossy:

• To provide the app: your account, feed, profiles, messaging, and the cosplay toolkit
• To keep the community safe: moderating shared images and handling reports, blocks, and takedown requests
• To send the notifications you have enabled
• To detect bugs, crashes, and performance issues and improve reliability
• To understand how Cossy is used, such as which features and searches matter, and to improve it (usage analytics, which you can switch off)
• To comply with legal obligations

3. Advertising and Tracking

We do not use advertising, we do not sell your personal data, and we do not track you across other apps or websites.

4. Content Moderation & Safety

Cossy is a user-generated-content platform. Images shared on Cossy may be screened automatically and reviewed by a human moderator to enforce our Community Guidelines. You can report or block other users and mute content. Rights holders may submit takedown requests via our DMCA process.

5. Data Sharing

We do not sell your personal data. We share data only with service providers who process it on our behalf under contract, and only as needed to run Cossy:

• Supabase: Database, authentication, and storage.
• Sentry: Crash and error reporting.
• OneSignal: Push notifications.
• PostHog: Product usage analytics (EU hosting).
• Cloudflare / object storage: Media delivery.
• Cossy website (cossy.social): Public profile, post, and event pages are also shown on the Cossy website when someone opens a link shared from the app or scans a Cossy QR card. The website shows only what is already public in the app (your username, display name, avatar, bio, and approved public posts), so anyone with the link can see it without installing the app.

6. Data Retention

We keep your data while your account is active. You can delete your account at any time from within the app, or by contacting us at the address below. We then delete or anonymize your personal data, except where we must retain it for legal reasons. Some content shared with others, such as messages they received, may persist for those users.

7. Your Rights

Depending on where you live, including the EU/EEA under GDPR and California under CCPA, you may have the right to access, correct, delete, or export your data, and to object to or restrict certain processing. Our legal bases under GDPR are performance of our contract with you, your consent (for camera, photos, device location, and notifications), and our legitimate interests in a safe, functioning service. To exercise any of these rights, please contact us.

8. Children's Privacy

Cossy is not directed to children under 13, or the minimum age in your country. We do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. International Transfers

Your data may be processed in countries other than yours. Where required, we use appropriate safeguards for such transfers.

10. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or misuse. No method of transmission over the internet is 100% secure, but we strive to use commercially acceptable means to protect your information.

11. Changes to This Policy

We may update this privacy policy from time to time. We will post the new version on this page and update the Last updated date above. Material changes will also be notified in the app. Continued use of Cossy after changes constitutes acceptance of the updated policy.