Privacy Policy

1. Information collected

coco is committed to protecting user privacy. We collect only the following information, and only as necessary:

• Account info: registration email, name, hashed password
• Device info: device fingerprint (for the 3-device limit), OS, NIC MAC
• Usage records: login time, CLI heartbeats, action audit logs (security & compliance only)
• Payment info: order amounts, payment channels, invoice titles (we do NOT store card numbers)

2. Information use

We use your information to deliver the service, secure your account, and process payments and invoices. Without your consent, we will not use your personal information for other purposes or share it with third parties, except where required by law.

3. Data storage

Your source code, conversation history, and local workspaces always stay on your machine. coco servers do not store or transmit any code content. The server only stores metadata required for account, subscription, and device management.

LLM requests and responses flow directly between your machine and the model provider you selected (Anthropic, OpenAI, etc.); coco does not sit in the middle. You should follow the privacy policy of the model provider you choose.

4. Cookies & sessions

We use an encrypted session cookie to maintain your login state for 7 days. This cookie is not used for cross-site tracking or advertising.

5. Your rights

You can always:

• Change your password and revoke device authorizations from the dashboard
• Export your data: download a JSON copy of your account data anytime (PIPL Article 45)
• Delete your account: cancellable within 7 days of submission, permanent thereafter (PIPL Article 47). Owners must transfer team ownership or remove other members before deletion.
• Financial records (orders, invoices) are retained for at least 10 years per the PRC's Accounting Records Administration regulations; they are kept even after account deletion.

6. Contact us

To exercise these rights or for any privacy questions, contact: coco@sinoaus.net