Privacy policy

1. Controller and contact

Jesper Erlandsson is the controller for personal data processed in Cosgo. Contact cosgo.app@hotmail.com with questions or requests for access or deletion. Do not include passwords, identity documents or bank details in your initial message.

2. Data we use

• Account and profile: user ID, name, username, email address, date of birth, selected city, gender choice and phone number. You can choose not to disclose your gender. Firebase manages password sign-in. With Google or Apple sign-in, we receive an account identifier and the profile details that provider supplies. Apple's private relay email address can be used.
• Waitlist: email address, language, registration time and the version of the consent text you accepted. The form also uses technical protections against automated spam. We do not store your IP address or browser information in the waitlist entry itself, although such information may temporarily appear in ordinary server logs.
• Activity and results: steps you permit us to read from Apple Health, calculated levels and duel scores, participation, rewards, balances, invitations and offer redemption history.
• Information you provide: ideas, votes, applications and messages to us. If you request a withdrawal, we may process the recipient's name and details for your chosen payment method, such as a Swish number, PayPal email, Revolut username or bank details. Do not submit real payment details just to test the beta.
• Technical data: IP address, app version, device/installation identifiers, notification tokens, consent choices, timestamps and error logs. Sessions, language preferences and some activity information are also stored locally on your device.

Profile details come from you or your chosen sign-in provider. Results and technical data arise when you use the app. Invitations and results may also include information other participants provide about your participation.

3. Why we need the data

Account, features and participation

To create and manage your account, check the age requirement, show local offers and provide the features you use. The legal basis is performance of the service contract (GDPR Article 6(1)(b)).

Steps, optional permissions and advertising

We rely on consent for optional processing of step/health data and advertising processing that requires consent (Article 6(1)(a) and, for health data, explicit consent under Article 9(2)(a)). You may refuse permissions; features that depend on them may then be unavailable.

Waitlist and launch information

When you choose to join, we use your email address to administer the waitlist and send selected updates about testing and launch. The legal basis is your consent (GDPR Article 6(1)(a)). You can withdraw consent at any time by contacting us.

Support and security

We use data to answer questions, investigate faults and prevent abuse. The basis is our legitimate interest in a working, secure service (Article 6(1)(f)). You may object to this processing.

Obligations and legal claims

If a specific law requires a record to be retained, we rely on a legal obligation (Article 6(1)(c)). Necessary evidence for a legal claim may be retained on the basis of legitimate interests. This is not a general exception to your right to deletion.

The current registration form requires contact details, date of birth and city, among other fields, to be completed. You can read this policy without an account. Reading the policy or creating an account does not itself constitute consent to all optional processing.

4. Apple Health and steps

With your permission, Cosgo retrieves step data from Apple Health for current or previous days and weeks. Steps marked as manually entered in Apple Health are filtered out and are not included in Cosgo's activity calculations. We do not request write access to Apple Health or read medical records, heart rate or workout routes.

Steps are used to calculate levels, progress and duel results. Step totals may be cached on your device. Derived results, such as levels and daily duel scores, are stored in your cloud account and may be shown to other participants in the social features you use. This information should therefore not be considered purely local or anonymous.

We do not send steps or health data in our advertising requests or use HealthKit data for targeted advertising. You can disable read access in Apple Health or iOS settings. This stops further access but does not delete results already stored by Cosgo; contact us to request that deletion.

5. Permissions and advertising

Notifications: if you allow them, Apple Push Notification service and Firebase Cloud Messaging use a notification token to reach your device. The token is associated with your account for features including duel messages. You can disable notifications in iOS.

Contacts, camera and photos: the contact picker helps you choose a recipient in your phone's SMS flow; that flow does not upload your entire address book. Business users can scan offer QR codes with the camera or enter a code manually. Administrators can select images to upload for app content.

Advertising: Cosgo uses Google AdMob and Google's consent dialog where advertising is supported. Test ads can also involve technical data processing. Google Mobile Ads may process IP addresses, approximate location inferred from IP, device identifiers, performance, diagnostics and ad interactions. The IDFA advertising identifier requires permission through Apple's tracking prompt.

Change ad choices under Settings → Permissions & privacy and tracking choices in iOS settings. See Google's advertising data disclosure and Google's privacy policy.

6. Who receives the data?

Cosgo's administrator and technical providers process data for operation, support and the features you choose. Google/Firebase supplies accounts, storage, server functions, web hosting and notifications. Apple supplies Apple sign-in, Health, push and TestFlight. Google also processes advertising data as described above.

Names/usernames, city and participant results may be shown to other users in duels, results lists and community features. If a name is missing, a display name may be generated from the part of an email address before @. On redemption, the business receives the information needed to verify the offer. For an actual withdrawal, the selected payment provider receives the necessary payment details.

The app also downloads technical resources, such as icons and graphics libraries, through Cloudflare/cdnjs and jsDelivr. These providers receive network information such as IP addresses during downloads. We do not sell personal data. Information may be disclosed to authorities when required by law.

7. Where is data processed?

Cosgo's current file storage is in Frankfurt, Germany. Server functions are also used in the United States. Firebase Authentication processes account data in the United States, and some provider services may process data in other countries. We cannot therefore promise that all processing takes place within the EU/EEA.

Transfers use the applicable safeguards described in providers' data protection terms, such as EU standard contractual clauses where required. Contact us for information about the safeguards for your data. See Firebase privacy information and the Firebase data processing terms.

8. Retention and deletion

We retain personal data for as long as it is needed for the purposes described in this policy. Data that is no longer needed is deleted or anonymised so that it can no longer be linked to you.

• Account and associated data: profiles, balances and results needed for the service are retained while you have an account. When you request account deletion, we delete the sign-in account and delete or anonymise associated personal data in our active systems without undue delay, normally within 30 days of receiving your request. We may need to verify that the request comes from the right person.
• Support enquiries: messages and necessary case details are retained while the case is being handled and for no more than 90 days after closure for any follow-up. Data that is no longer needed is deleted earlier.
• Waitlist: the email address and consent record are retained until you withdraw consent or no later than 90 days after Cosgo's public launch. The entry is then deleted unless you have created an account and the information is needed under another legal basis. A request to leave the list is handled without undue delay, normally within 30 days.
• Transactions and specific exceptions: a limited portion of the data may need to be retained longer if a specific law requires it, for example for accounting, or if it is necessary to establish, exercise or defend a legal claim. In that case, we explain which data is retained, why, and for how long or which criteria determine the period. Access is restricted to that purpose; the remaining data is still covered by the deletion.

Logs and backups: ordinary server logs currently have 30-day retention. Cloud Storage has a 7-day recovery period for deleted objects. Google states that Firebase Auth data may remain in live and backup systems for up to 180 days after account deletion is initiated. Providers' technical deletion periods may therefore exceed the handling period in our active systems.

Uninstalling the app does not automatically delete your cloud account. During this beta, please send your deletion request to cosgo.app@hotmail.com, even if you have used the account button in the app, so that associated data can also be handled. Automatic, complete account deletion is not yet finished in the beta.

9. Your rights

You may request information and a copy of your personal data, correction, deletion, restriction and, where applicable, data portability. You may object to processing based on legitimate interests. You can withdraw consent at any time; this does not affect processing that was lawful before withdrawal.

Contact cosgo.app@hotmail.com. We may need to verify that the request concerns your account. We inform you about the handling of your request without undue delay and no later than one month after receiving it. If an extension is permitted under the GDPR, we inform you within that same month of the reasons and when you can expect a response. You may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

Levels, matching and results are partly calculated automatically according to the app's features. Withdrawal requests are handled administratively. Contact us if you want a calculation or result investigated.

10. Changes

When processing changes, we update this policy and the date above. We communicate material changes in the app or through your account contact details. If new processing requires consent, we ask before it starts.