CozibudMain website

This policy page is published in English only. The English text is the authoritative version; the rest of the app follows the language you choose below.

Privacy and consumer health data policy

Effective November 6, 2026. YARRA LLC operates Cozibud at https://cozibud.com.

Cozibud records what a caregiver chooses to log about a baby. That is family data about a child who cannot consent, so this policy describes exactly what is stored, who can reach it, and how to get it back or remove it.

What we collect

Only what you enter or what the service must record to work:

Consumer health data

Feeding, sleep, diapers and potty use, pumping, growth measurements, temperature, medication, symptoms, activities, milestones, contractions and related notes can reveal a child's physical health or bodily functions. We treat those records, the child and caregiver identifiers linked to them, and health-related inferences produced from them as consumer health data.

The sources are caregivers who enter records, other members of their approved household, files they choose to import, and API or assistant connections they authorize. We collect and use this data to provide the requested record-keeping, household coordination, summaries, exports, security, support and account operations. We do not use it for advertising, data-broker profiles or model training.

Household members receive the tracking records needed for the shared household service. A connected assistant receives only the categories and permissions approved on its separate consent screen. Our service providers listed below process data only to operate Cozibud. Other than those requested disclosures, we do not share or sell consumer health data. We will disclose a new category, source, purpose or recipient and obtain any consent required by law before materially expanding these practices.

Phone and watch apps

Paired devices exchange account, household and care-record identifiers, device names, authorization credentials and operation identifiers with Cozibud to synchronize records securely and avoid duplicate saves. The phone keeps an encrypted local copy for offline use. Signing out or disconnecting a device removes its access to the service.

Routine reminders are optional. When you enable them in the Android app, Firebase Cloud Messaging and Firebase Installations process an app installation identifier and registration information to deliver reminders. Notification permission and reminder settings remain under your control. Firebase Analytics collection is disabled in the Android app.

Watch dictation opens your device's speech-input application. That application handles the recording under its own privacy practices and may use an online speech service. Cozibud receives the resulting text, not the audio recording. You review the text before sending it. A confirmed transcript and the context needed to interpret it are sent through the relay you connected to your chosen assistant provider. Relay transcripts and response envelopes remain in service storage until removed by the operator; automatic retention cleanup is not currently scheduled. Records you choose to save follow the normal care-record retention policy.

Reports and attachments

If you send feedback, we store your message, account and household references, the screen you reported, and any diagnostic details or screenshot you choose to include. Diagnostics describe the app's state and do not automatically include care records or credentials. Screenshots can contain information visible on your screen, so review them before uploading. We use reports to provide support and diagnose and fix problems, not for advertising or model training.

The operator may copy relevant feedback to a private GitHub issue for investigation. Uploaded attachment files have a 60-day deletion lifecycle in cloud storage. Resolved or closed report rows are eligible for cleanup 60 days after their last status change; open reports remain while support work is ongoing. Deletion requests include reports and attachments linked to the account or household, and require checking any copies in support systems.

Product analytics

When product analytics is enabled, we use it to understand signup completion, broad feature adoption and retention. Signed-in events use a stable pseudonymous caregiver identifier. We create it with HMAC-SHA-256 and a secret held byCozibud; PostHog receives neither the original account ID nor the secret. This reduces identification risk, but the linked events are pseudonymous personal data, not anonymous data.

Events can say that a caregiver completed signup or baby setup, saved a feeding, sleep, diaper, pumping, growth, activity or other broad record category, opened the calendar, used invitations, connected an assistant, changed language, or reached a subscription step. Properties are limited to interface language, product surface, input method, broad category, invitation status, billing interval and the time the product event was completed. We never send caregiver or baby names, email addresses, household or baby IDs, record contents, notes, health values, care-record start or end times, full URLs, assistant messages, bug messages or stacks. Medication, symptom and temperature records do not generate analytics events.

Automatic click capture, session replay, advertising profiles and PostHog error tracking are disabled. Anonymous marketing and pre-signup analytics require an affirmative browser choice. Your account may start with analytics on. Settings shows your current choice, and you can turn it off at any time. Turning it off stops future collection and clears the browser analytics ID. PostHog can retain events for up to one year. A deletion request marks the account's linked analytics history for erasure after the 30-day recovery period. Permanent erasure is not currently automated and may require operator processing; the timing disclosure below also applies to this analytics history. We do not sell personal information or share it for cross-context behavioural advertising.

Children's data

Cozibud is a tool for caregivers. Accounts are held by adults; the service is not offered to children and children do not use it. Records about a child are entered by their caregiver and are visible only to members of that child's household. We do not use them to train models and do not disclose them for any purpose other than running the service.

Assistant connections

You can connect an AI assistant, which then reaches your records through our Model Context Protocol interface. Connecting requires your explicit consent on a screen that names the assistant, the household and the permissions requested. Read access and write access are granted separately, and you can revoke any connection at any time from Settings; revocation takes effect immediately, including for a connection already open.

The assistant interface does not expose medication or symptom records: it will neither record them nor return them, whatever the assistant asks. Those records remain available to you in the app. Everything else your household tracks — including growth measurements and temperatures — is reachable by an assistant you have connected.

When you use an assistant, whatever it sends or receives is also handled by that assistant's provider under their own privacy policy, which we do not control. Consider that before asking one about your child's health.

Who else processes your data

We run Cozibud on services that necessarily handle data on our behalf:

Your records are stored in the United States. Each household's data is isolated in the database itself, so a request authorised for one household cannot read another's.

Getting your data out

A household owner can download the complete tracking archive as JSON at any time from Settings, including archived children, deleted records and correction history. It is your data and it leaves in a form you can read.

Deletion and retention

You can request account deletion on the web even if you no longer have the app installed.

We keep your records for as long as your account exists. When you request deletion of an account or a household, access is revoked immediately — sessions, API keys, invitations and assistant connections all stop working — and the data is held through a 30-day recovery period so you can restore access with the recovery code shown when you make the request. Recovery closes when that period ends, even if permanent erasure has not yet run.

After the recovery period, the account or household remains suspended and queued for permanent erasure from the live database. That maintenance operation is not currently scheduled or enabled, so we cannot promise that erasure will happen automatically or on the 30-day date. Until the operation is enabled or the request is processed by the operator, the suspended data may remain in live storage but is not available through the account. Email rongduan.zhu@gmail.com for the status of, or questions about, a deletion request.

Encrypted database backups are kept for disaster recovery and expire on their own schedule, so a deleted record can persist in a backup for a period after it is gone from the service. Restoring a backup replays deletions before the service accepts traffic. Records required for tax and accounting, such as payment history, are kept as long as the law requires.

Security

Traffic is encrypted in transit. Passwords are stored only as hashes, API keys only as digests, and assistant access tokens are opaque and short-lived. Access to production systems is limited to the operator. No service can promise it will never be breached; if one affects your data we will tell you.

Your rights

You can access, export, correct and request deletion of your data using the controls in the app. Depending on where you live you may also have the right to object to or restrict processing, or to complain to a data protection authority. Write to rongduan.zhu@gmail.com and we will answer.

For consumer health data, you may ask us to confirm whether we collect, share or sell data concerning you or a child you are authorized to represent; access that data and applicable recipient contact information; withdraw consent for future collection or sharing; or delete it. Use the signed-in controls where available or email rongduan.zhu@gmail.com. You do not need to create a new account to make a request. We will authenticate the request, respond without undue delay and within 45 days, or tell you within that period why one additional 45-day extension is reasonably necessary. Requests are free up to twice per year unless manifestly unfounded, excessive or repetitive.

If we refuse a request, reply to our decision with the word Appeal. We will review the appeal and respond in writing within 45 days. If we deny it, we will explain why and provide a way to contact the Washington Attorney General where applicable. Deletion requests are sent to applicable processors and other recipients. Backup deletion may be delayed only as permitted by law and never beyond six months for a request governed by Washington's My Health My Data Act.

Changes

If this policy changes materially we will say so in the app before the change takes effect. The effective date above always reflects the current version.

Contact

YARRA LLC — rongduan.zhu@gmail.com

Cozibud

Privacy policy