Privacy Policy

This policy explains what personal information Cotokim collects on cotokim.com, why, who receives it, where it is stored, how long we keep it and what you can do about it. Your due date and your baby's information are health data: our Consumer Health Data Privacy Policy covers them in detail.

Who we are

Cotokim is an online service, run from Brazil, that helps families plan what their baby needs. Cotokim decides how your information is used and is responsible for it. For any privacy question or request, write to contato@cotokim.com.

What we collect

We get it from you, from the people you invite to your list, from the guests of your shower page and, when you pay, from Stripe.

• Your account: your email, so you can sign in with a code instead of a password, and the name you want us to call you, if you give one.
• Your list answers: your city, the month and year your baby is due, the number of babies and the other answers that shape the list, such as how often you do laundry, whether you have a dryer and whether your home is heated in winter. We keep the exact due date only if you give it to us for the full plan.
• Your baby's birth date, if you tell us when your baby is born.
• Your list: what you mark as already owned, the quantities you change, what you decide not to buy and, in the budget, the price of each purchase you note.
• Family on the same list: the people who join through your invite see the list and appear to each other by name or email.
• Your baby shower page, if you create one: title, message, event date, time and address, if you add them (the address shows only to guests who say they are coming), the due month only if you choose to show it and, if you choose to receive cash gifts, your PayPal.Me or Venmo username and the recipient name. From guests, only their first name, what they choose to give and, if they confirm, how many people are coming.
• The full plan purchase, if you buy it: amount, currency, date, status and Stripe's reference for the payment. You type your card details into Stripe's form on our page: Cotokim never sees your card number or security code.
• The waitlist, if you join it before the app opens: your email and the part of the site where you joined. We use it only to email you when the app opens, with a link to leave the list.
• Where your first visit came from, if you arrived through a tagged link, like the one in our Instagram bio: only the channel and campaign of that link, saved to your account when it is created.
• Page speed: when you leave a page, your browser sends how long it took to load and respond, with the type of page, phone or computer, and the connection type. No IP address and nothing that identifies you. We delete these measurements after 90 days. Visits that arrive through tagged links are counted per day, without knowing who visited.

We never ask for your weight, health conditions, complications, type of delivery, tests or medicines, and we do not collect your precise location. The due date and pregnancy week calculators on our pages work in your browser: what you type there is not sent to us. The free list without an account is also calculated in your browser and is not stored. Our server does not save your IP address: to block too many sign-in code requests, it only counts them for one hour, in memory, under a scrambled version of the address.

How we use it

1. To create your account and let you sign in.
2. To build, save and update your list and, with the full plan, the shopping list by size, the week-by-week plan and the budget.
3. To show your list to the people you invite, and your shower page, with the cash gift details you add, to whoever has its link.
4. To charge for the full plan, refund it when you cancel, and keep the purchase records that tax law requires.
5. To send service emails: sign-in codes, the receipt when you cancel a purchase and, if you joined the waitlist, the email that tells you the app has opened.
6. To protect accounts and the site against abuse and fraud.
7. To answer your messages and requests.
8. To know which channels bring new families, from the channel saved with each new account and the daily count of visits, and whether our pages load fast.
9. To comply with the law and with valid orders from authorities.

We do not sell your information. We do not show ads, we do not use your information for advertising and we do not share it for targeted advertising. We do not collect, use or sell personal information to train large language models or other AI models. We do not send marketing emails.

Who receives it

Service providers. They handle your information only on our behalf, to run Cotokim:

• Hetzner: the server that runs Cotokim and stores the database, in the United States (Oregon).
• Cloudflare: network and security for the site, and the delivery of the emails you send to contato@cotokim.com. It receives your IP address and what travels between your browser and our server.
• Resend: sends our emails, including our replies. It receives your email address and the message.
• Google (Gmail): the mailbox where the messages you send to contato@cotokim.com arrive.
• Backup storage: encrypted backup copies, kept in a storage service in the United States and on administration computers in Brazil.

Stripe processes payments and refunds. We send Stripe your account email, the price, the name of the plan and our purchase references, and you type your card details into Stripe's form. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal obligations, under Stripe's privacy policy.

Anthropic provides Claude, the AI tools we use to run Cotokim and to answer your messages. When we use them, Anthropic receives the information involved, which may include your list, your due date and the messages you send us, and also handles it under Anthropic's privacy policy.

People you choose. The family members you invite see your list and your due date. Whoever has the link to your shower page sees what you put there, including the cash gift details and the recipient name.

Authorities, when the law or a valid legal order requires it.

Where your information is

Cotokim's server is in the United States. Encrypted backup copies are kept in the United States and in Brazil. Cotokim is run from Brazil, so your information is also accessed from there, always under this policy.

How long we keep it

• Account, list and shower page: while you keep them. You can delete them at any time.
• Due date: we keep the month and year while you keep your list. If you gave us the exact date for the full plan, we delete the day 3 months after the due date and keep only the month and year and the sizes, so your list keeps working.
• Purchase records: for as long as tax law requires, without your name or email, even if you delete your account.
• Proof of consent: when you agree or withdraw, we record which text you saw and when. If you delete your account, the record stays only with a scrambled code instead of your email.
• Sign-in: a session lasts up to 90 days on each device, or until you sign out. Sign-in codes expire after 10 minutes.
• Waitlist: until you leave it, with the link in our email or by writing to us.
• Backups: encrypted copies are deleted on a rolling basis within 45 days.

Your choices and rights

In My account, at any time:

• Download my data: a file with your account, your list answers, your list, your baby's dates, your shower page and your purchases.
• Change the list answers: city, due date, babies and the other answers.
• Pause everything: your shower page is hidden until you come back.
• Delete the list and the baby's data: deletes the list, the budget, the shower page, the due date and your baby's information, and withdraws your consent to keep that data. Your account stays.
• Delete my account: deletes your account and everything that is yours on Cotokim, except the purchase record and the proof of consent described above.

By email, for anything else. Write to contato@cotokim.com from the email of your account to access, correct or delete your information, including what is not in the file, such as the record of your consents, or to withdraw a consent. We may ask you to confirm that it is you. We reply within 30 days, free of charge. If a request needs more time, we tell you why before then.

Appeal. If we decline a request, you can appeal by replying to our answer. We reply to your appeal in writing within 45 days, with our reasons. If we still decline it, we tell you how to contact your state attorney general.

Your state's law. Depending on where you live, your state's privacy law may give you more rights. Write to us and we answer under the law of your state. Nevada residents can send a request not to sell their information to contato@cotokim.com; we do not sell personal information.

Using these rights never changes the price or the service you get.

Cookies and similar technologies

Cotokim uses only what the site needs to work. We use no advertising cookies, no pixels and no analytics from other companies.

Your browser's own storage keeps your light or dark theme and what you check or type in some tools, such as the hospital bag checklist. That stays on your device and is not sent to us. When you save the free list, your answers wait there, during that visit, until you sign in and save them. During a visit, it also notes that a visit from a tagged link was already counted.

On the payment page, Stripe's form uses Stripe's own cookies to process the payment and prevent fraud. Apart from that, no other company collects information about your activity on Cotokim.

Because we do not track you across other websites, a browser's Do Not Track or Global Privacy Control signal has nothing to turn off, and the site works the same with it on. You can block or delete cookies in your browser settings. Without the session cookie, you cannot stay signed in.

Security

• The site uses an encrypted connection.
• Sign-in codes, sessions and invite links are stored only as one-way hashes.
• Your card details go straight to Stripe and never pass through our server.
• Backup copies are encrypted, and access to your information is limited to the people who run Cotokim and the AI tools they use.

Email is how we contact you. If a security breach affects your information, we tell you by email and with a notice in the app, without delay and within the time the law sets.

Children

Cotokim is for people preparing for a baby. It is not directed to children under 13, and we do not knowingly collect personal information from them. The information about your baby comes from you.

Changes to this policy

We publish changes on this page with a new date. If a change is material, such as new information, new uses or new recipients, we email account holders before it applies and, for health data, we ask for your consent first. The date of this version is the "Updated on" date at the end of this page.

Contact

contato@cotokim.com