Privacy policy

Effective September 24, 2026 · Updated September 27, 2026

cocoa helps you turn your characters into box collections and give them to friends. This policy explains what information we collect, how we use it, who processes it, and how you can delete it.

Information we collect

Account information: your registration email, password (stored only as an encrypted hash; we cannot see the original), public display name, and generated user code.
Your creations: reference images you upload, text you enter in creation conversations, and the resulting artwork, 3D models, packaging, cards, and boxes.
Collection and social records: records of claiming, opening, and gifting boxes; friend relationships and blocked accounts; and invite code usage.
Progress updates: system push tokens assigned when you enable creation progress on Dynamic Island, used only to update that progress.
Sign-in and security: IP addresses and device types recorded for sign-in sessions, used to protect accounts and investigate problems.

We do not access your contacts or precise location, use advertising or third-party analytics tools, or track you across apps.

Device permissions

Photos: we access only images you choose, up to four at a time, to upload as creation references.
Camera: frames used to scan friend and claim codes are neither uploaded nor saved. Creation reference photos are uploaded only after you select them.
Bluetooth, Nearby Interaction, and local network: used during in-person gifting to find nearby friends and confirm that two iPhones are close.
Microphone and speech recognition: used only when you activate voice input to turn speech into editable text. Audio may be processed by your operating system’s or browser’s speech service. cocoa does not save recordings or automatically send recognized text. Text is saved as creation content only after you send it.
Motion and fitness: used to play a sound when you shake an unopened box. The data stays on your phone.

Who processes information

The following providers process necessary data under our instructions to provide the service, and may not use it for other purposes:

AI generation: reference images and creation text are sent to AI services through CometAPI to generate designs, artwork, packaging, and cards. Tripo generates 3D models from artwork.
Servers and storage: Fly.io runs the service, Cloudflare R2 stores images and model files, and the database provider stores accounts and records.
Email: Resend sends registration verification and password reset emails.
Push updates: Apple Push Notification service updates Dynamic Island progress.

These providers’ servers may be outside mainland China, including Singapore and the United States. We do not sell your personal information or use it for advertising.

Who can see your content

Your collection is private by default. Friends can see your public display name and user code, but not your email. When you gift boxes or share a claim link, recipients can see the collection’s name, packaging, characters, cards, and the sender’s display name.

Storage and deletion

We retain the information described above while your account exists. You can delete your account in the app under Account → Delete account. Confirmation immediately deletes:

Your sign-in email, password, display name, and user code; friend and blocked-account lists; and unused invite codes.
Uploaded reference images, saved characters, and all creation conversations.
Collections that have never been gifted, including their artwork, 3D models, packaging, cards, and files.

Boxes already claimed by friends belong to them. Their collections remain available to open and collect, without your name or email, and no further generation takes place. Gifts you sent that have not been claimed are withdrawn. Gifts sent to you that you have not accepted are returned to the sender.

You can also email us to request access to, correction, export, or deletion of your information.

Minors

cocoa is not intended for children under 14. If you believe a child registered without a guardian’s consent, contact us to delete the account.

Policy updates and contact

When this policy changes, we update this page and the effective date above. Email support@cocoabox.app with any questions.