Privacy Policy

This Privacy Policy explains how Cochild Pte. Ltd. collects, uses, stores, and protects your personal data when you use the Cochild Application. It should be read alongside the Cochild End User Licence Agreement.

Cochild Pte. Ltd. (UEN: 202547888Z), 36 Carpenter Street #02-01 Carpenter Haus, Singapore 059915 is the data controller for the purposes of this Policy.

This Policy is written in plain language by design. If anything is unclear, please contact us.

---

1. What We Collect

We collect the following categories of data when you use the Application:

Account Information

Your name, email address, encrypted password, profile photo, and profile details provided during registration. You sign in to Cochild with your own email and password; Singpass is never a sign-in method. Where you choose to verify your identity through Singpass, the additional information described under "Singpass and Myinfo" below is also collected.

Singpass and Myinfo

Singpass is used only to verify your identity. It is never a sign-in method for Cochild, and you always sign in with your own email and password. Verification is optional, but we encourage it. You can use it instead of email verification when you link your Account to your co-parent's shared record (the single record that links both parents and their children in the Application), so that both parents on a shared record can be verified identities.

If you verify your identity through Singpass, then with your consent we retrieve the following from Myinfo, which is provided by the Government Technology Agency of Singapore (GovTech): your name, alias, NRIC number, email address, mobile number, registered address, and the records of your children held in Myinfo. We do not request your marital status, or any Myinfo field beyond this list.

Each field is used as follows: your name, alias, email address, mobile number, and registered address are used to pre-fill your registration details; your name and alias are matched against the parties named in any court order you upload, to confirm you are the parent named in it; and the records of your children held in Myinfo are offered to you for selection when you set up your shared record. Myinfo returns all of a parent's registered children, not only those relevant to this shared record — only the children you select are added to your shared record, and any records you do not select are discarded at the end of your Singpass verification session and are never stored. See Section 5 for how your children's data is otherwise handled.

Your NRIC number is used to establish your identity to a high degree of fidelity and to match your records, and is not stored in readable form: we keep only a keyed one-way hash (HMAC) of it, which lets us match records without being able to recover the number. The other Myinfo fields are stored encrypted. Cochild receives only the data you choose to share on the Singpass consent screen, and never your Singpass password or other Singpass credentials — these are never shared with, or visible to, Cochild.

Co-parenting Data

Children's names and dates of birth, access schedules, court order details, compliance events, and records relating to access that you enter. When you upload a court order PDF, your phone reads the text of the document, removes NRIC/FIN numbers, email addresses, and Singapore phone numbers written with the +65 country code, from that text, and sends only the resulting text to Anthropic for parsing. The PDF file itself never leaves your device, and Cochild does not keep it in a document vault. We store the details you review and confirm, such as parties, children, schedules, and maintenance terms.

Calendar

We collect the events and to-dos that you and your children add to the shared calendar: titles, dates and times, places, categories, who each item is for, who can see it, any repeat pattern, and whether a to-do is done. Notes you add are encrypted at rest, although Cochild holds the encryption keys. Children's birthdays appear in the calendar but are worked out from the date of birth already on your shared record, not stored separately. We also keep reminder records, which hold only item identifiers and times, so that we can send notifications. A parent chooses whether their co-parent and their children can see an item they add, except that an item assigned to a child is always visible to that child, and an item a child adds is visible to both parents. Notes on items that someone else can see are checked by AI before they are saved, as described in Section 6.

You can optionally copy calendar items into your phone's own calendar. This is off until you turn it on: a parent chooses, item by item, what to add to their phone calendar, and a child is offered the choice in Kids Mode. Cochild creates a separate calendar called "Cochild Calendar" on the phone and sends changes one way only, from Cochild to the phone; nothing is read back from your phone's calendar. Each copy contains the item's title and date and time and, unless a parent chooses generic titles, the item's notes and, for events, its place. On an iPhone, the Cochild Calendar is created in the phone's own account where it has one; otherwise it is created in the account the phone saves new events to, which is usually iCloud. Entries held in an iCloud, Google, or work calendar can then be copied to your other devices and be visible to anyone who can see that account, under that provider's terms and not this Policy. You can remove everything Cochild added from the calendar settings in the Application.

Information About Your Co-parent

You can enter your co-parent's details and a court order before they have joined Cochild. This means we may hold personal data about a person who has not yet created an account or seen this Policy. Please enter only information you are entitled to share. Once your co-parent joins, they have the same rights as any user, and a person whose details were entered before joining can contact privacy@cochild.com to ask what we hold and to request correction.

Receipts, Quotes, and Proof of Payment

If you attach a receipt, quote, or proof of payment (an image or, for payment requests, a PDF) to a maintenance payment or a payment request, we store the file with the shared record, together with the details you confirm, such as the amount, currency, date, and vendor or payee. Where you allow it when asked, the file is read by Anthropic using Claude Haiku to extract those details; you can enter them yourself instead. These files can show other personal information, including details about your children. Please remove anything you do not want processed before you attach a file.

Payment Requests

Parents can send each other payment requests ("I paid, please cover your share") and cost proposals ("do we agree before I commit"), in Singapore dollars only. They are for parents only and are never available in Kids Mode. For each request we store its title, category, amount, date, how the cost is split, and any note you add (notes are encrypted at rest, although Cochild holds the encryption keys), together with the receipts, quotes, and proof of payment you attach (images or PDFs of up to 10 MB each, up to 5 per request, plus a proof of payment). We keep an event trail of who did what and when, for example created, sent, viewed, counter-proposed, accepted, declined, marked as paid, and confirmed as received. Unlike pickups and drop-offs, no GPS position or IP address is recorded for payment actions.

So that your co-parent can pay you, your Singapore mobile number for PayNow is kept on your profile. A copy goes into each request you send and is shown to your co-parent from the moment you send it; if you change your number, you can refresh it on a request you have already sent. If you have verified your identity through Singpass, the mobile number from Myinfo may be offered to you as a suggestion, but it is saved only if you confirm it. Your name and PayNow number are shown to your co-parent by design. The PayNow QR code is built on your device, and "Save QR image" goes through your phone's share sheet.

Payment requests are on by default and work only when both parents have them on. Either parent can switch them off, and neither parent is told which of them did. We record each change to your switch (who made it, when, and the previous value) in a record that only Cochild's systems can read, never you or your co-parent, and that is deleted with your Account. Requests already in progress can still be answered, paid, confirmed, and cancelled after a switch is turned off.

Cochild is not a payment service. Cochild only provides QR codes and payment details that can be used in your own banking app. Cochild is not a payment service provider, a payment initiator, a payment gateway, or any other kind of licensed payment provider. It does not hold, receive, transfer, or process funds, does not instruct or connect to any bank, and cannot see whether a payment was made. "I've paid" is the payer's own claim and "Received" is the payee's own confirmation. Payments between parents are made in your own banking app, outside Cochild. The compliance report you can generate includes a "Shared expense requests" section, which leaves out notes and PayNow numbers.

Subscription Status

If you subscribe to Cochild Monthly, we receive your subscription status (for example, active, trialling, or cancelled) and the store's transaction identifier, which we use to match renewals and cancellations to your Account, from the App Store or Google Play, so the Application can unlock the features your subscription covers. We also create a random billing token for your Account and give it to Apple and Google when you purchase; it contains no personal data. A subscription is required to use Cochild as a parent: without one, access is locked, but your data is kept and not deleted (see Section 7). A child's messaging in Kids Mode works only while at least one parent on the shared record has an active subscription, so we use the parents' subscription status for that purpose. We never receive your payment card or other payment instrument details — these are handled directly between you and Apple or Google.

Parent Location and IP Address

When a parent records a pickup, a drop-off, or takes an emergency action in the Application, we capture that parent's GPS position and IP address at that moment. This record is visible to the co-parent as part of the shared access event log. It is separate from the Child Location feature described below.

Other Information You Add

Depending on the features you use, we also collect: wellbeing check-ins recorded by parents; Hopes & Goals entries; Conflict Resolution content, which is text you choose to share with your co-parent; visit journals; photos added to the shared album; the content of messages sent and received through Email Hub; push notification tokens for your devices; and profile photos.

Communication Data

Messages sent through the platform, subject to the AI moderation process described in the Cochild EULA. Once a message has passed moderation (or been rewritten and approved by you), it is encrypted and stored as part of your conversation history so that you and, for shared conversations, your co-parent can read it. A blocked message's text and the reason it was blocked are also stored, encrypted, so you can review the decision — a blocked message is never delivered to your co-parent. Message content is never used to train AI models. Message text is processed by Anthropic for moderation (see Section 6), and Cochild holds the encryption keys. Cochild staff do not read messages as a matter of routine and access content only where strictly necessary to investigate a reported problem, or where required by law.

Behavioural Metadata

Timestamps, frequency of interactions, schedule change requests, and moderation events. This is structural data about how the platform is used. It is not the content of your communications.

Device and Technical Data

Device type, operating system, and app version, used solely for maintaining and improving the Application.

Location Data

Where a parent has enabled Child Location sharing for their child, we collect the child's device location while the Kids Mode app is open, or when the child sends a manual "I'm here!" check-in. Outside of a scheduled access period, only an approximate location (accurate to roughly 3 kilometres) is ever calculated or stored — the precise position is never retained. Precise location is calculated and stored only during an active, scheduled access period. Location sharing is off by default, opt-in, and governed by permission tiers based on the child's age: for children under 13, a parent controls sharing; for children aged 13–15, sharing changes require both parents' agreement and the child's request; for children 16 and over, the child alone controls their own sharing. The trail of past locations is retained for 7 days and then automatically and permanently deleted; your child's single most recent shared location is kept only for as long as location sharing stays enabled, and is replaced each time a new position is shared. Cochild does not perform continuous background location tracking — location is only ever captured while the Kids Mode app is open in the foreground, or on a manual check-in.

Biometric Authentication

The Application may use your device's built-in biometric authentication (such as Face ID or fingerprint) to unlock the app or confirm the deletion of your Account. This authentication is performed entirely by your device's operating system. Cochild never receives, collects, or stores any biometric data itself.

---

2. What We Will Never Do

---

3. How We Use Your Data

We use your data for the following purposes and no others:

• To provide, maintain, and improve the Application and its features
• To operate the AI moderation (of messages, calendar notes, and payment request text), court order parsing, receipt reading, and Kin AI assistant features, including Kin's optional calendar access, described in the Cochild EULA
• To provide the shared calendar, the optional copies in your phone's calendar, and payment requests
• In future, to produce aggregated statistical insights for government agencies, research partners, and public health bodies, to improve family justice outcomes. Any such report would contain nothing that identifies an individual or a shared record. No such reports exist today and no data is shared with any agency or research partner. Support signals about a shared record are a separate matter, described in Section 10
• To detect and prevent fraud, abuse, or security incidents
• To comply with our legal obligations

---

4. AI Assistant (Kin)

Kin is an optional AI assistant available to parents within the Application. It provides supportive conversation and can proactively check in based on signals like an upcoming access handover or an overdue maintenance payment. Kin is never available to children.

To respond helpfully, every message you send Kin is accompanied by a pseudonymised summary of your situation: your access schedule, your compliance and maintenance payment status, and your current harmony score (the score shown on the Harmoniser screen) — each child identified only by a placeholder such as "child_1" with an age, never a full legal name. Kin never receives the content of your conversations with your co-parent.

If you allow it when asked, Kin can also look at the calendar items you can see and prepare drafts from what you ask. To do this, the titles, categories, dates, times, and places of those items, who each is for, your children's first names, the age a child turns on a birthday, and what you ask Kin are shared with Anthropic. Notes are never shared. This is the one case in which Kin sees a child's first name instead of a placeholder. Kin only prepares a draft: nothing is added to your calendar until you tap Save. If you choose Not now, Kin does not see your calendar.

Every message you send to Kin is checked by an automated wellbeing signal. If it detects language suggesting you may be in crisis, Kin responds with a fixed, calm message pointing you to appropriate support services (such as Singapore's National Care Hotline), and Cochild logs that a crisis-level message occurred. That log records only a hashed, non-reversible reference to your account and the time — never the message content itself — and is used solely to help us understand and improve this safety feature. It is not read by Cochild employees as a matter of routine and is never shared with your co-parent.

You may turn Kin off at any time from Settings or from within your Kin conversation, except while a crisis-support message is actively being shown to you.

---

5. Children's Data

Children's information entered into the Application — names, dates of birth, schedule details — is treated with the highest level of protection. This data is used solely to provide the co-parenting features of the Application. It is never shared with any third party other than the processors listed in Section 6, never used in aggregated analytics in any identifiable form, and never processed for any purpose other than delivering the service to you and, where applicable, your child — for example, your child's name and date of birth are sent to Anthropic only when a court order naming your child is parsed, as described in Section 6. Two other cases exist: your child's first name, and the age they turn on a birthday, are shared if you allow Kin to read your calendar (Section 4), and a receipt, quote, or proof of payment you choose to have read may happen to show your child's details (Section 1).

If a parent verifies their identity through Singpass, Myinfo may return records for all of that parent's registered children, not only those relevant to this shared record. These are shown to the parent for selection only — only the children they select are added to the shared record, and any records they do not select are discarded at the end of the Singpass verification session and are never stored. See "Singpass and Myinfo" in Section 1 for detail.

What Kid Mode Collects

If a parent sets up a Kids Mode account for their child, the Application additionally collects: a display name and a parent-set username and passcode for the child's sign-in; messages the child sends to and receives from their own parents; photos and other items shared to the family album; events and to-dos the child adds to the calendar, which both parents can see (and, if the child chooses, copies of calendar items in the phone's own calendar, as described under "Calendar" in Section 1); and, only if a parent has separately enabled it, the child's location, exactly as described under "Location Data" above. Kid Mode does not currently include a mood or wellbeing check-in feature. If we introduce one, we will update this Policy to describe what is collected and how before it is switched on, and any such feature will be optional.

Who Can See Your Child's Data

Your child's data is visible only to the two parents or guardians verified on that child's shared record inside the Application. It is never visible to a co-parent on a different shared record, a third party, an advertiser, or an analytics provider, and it is never used to build advertising profiles. This boundary is enforced in how our systems are built, not only in this Policy: the underlying access rules are structured so that a child's messages, location, and account details can only be read by the verified parents linked to that specific child, and by the child's own Kids Mode account for its own data — never a sibling's.

Our Legal Basis for Processing Your Child's Data

A child cannot register for the Application independently. A parent or guardian consents to the collection and processing of their child's data by accepting the Cochild EULA on the child's behalf when they add the child to their shared record or set up a Kids Mode account, and this parental consent is the basis on which we process a child's data generally.

For location sharing specifically, we layer an additional, age-tiered consent model on top of parental consent, consistent with Singapore PDPC guidance on processing children's data: for a child under 13, a parent controls whether sharing is switched on; for a child aged 13 to 15, turning sharing off requires the child's own request together with both parents' agreement, so the child has a genuine say; and for a child aged 16 or over, the child alone controls their location-sharing setting, and a parent cannot override it. Where a child's date of birth is not on record, we apply the most protective, parent-controlled tier by default.

Kids Mode Accounts

A parent may choose to set up a restricted "Kids Mode" account for their child, giving the child their own sign-in (a username chosen by the parent, and a passcode) to a deliberately limited part of the Application: messaging with their own parents, a shared family photo album, the shared calendar and to-dos, and — only if a parent has enabled it — location sharing as described above. A child's Kids Mode account cannot access payments, payment requests, court order documents, the co-parent conversation, or any other adult-only data. A parent can reset their child's passcode or pause their child's access at any time. We do not knowingly collect more personal data from a child than is necessary to provide these limited features, and Kids Mode contains no advertising and no Kin AI assistant.

Retention, Deletion, and Access Requests for Your Child's Data

Your child's data is retained for as long as either parent's Account remains active, subject to the more specific rules described elsewhere in this Policy — for example, the 7-day retention period for location history. A parent can pause their child's Kids Mode account or reset its passcode at any time from within the Application. To permanently delete a child's Kids Mode account and its associated data, or to request a copy of the data we hold about your child, contact us at privacy@cochild.com. As with the other rights described in Section 9, we will action your request within 30 days.

---

6. Third-Party Service Providers

Cochild uses a small number of third-party services to operate the Application. Google Firebase, Anthropic, and Twilio SendGrid are data processors acting on our instructions only:

• Google Firebase: secure data storage, authentication, and push notifications. Some Firebase services, including authentication and push messaging, operate globally
• Anthropic PBC ("Anthropic"): the provider of the Claude AI models behind several features, described feature-by-feature immediately below
• Twilio SendGrid: sending and receiving messages through your Cochild email addresses (the Email Hub feature)

Apple and Google are not Cochild's processors acting on our instructions. They act independently, each in two separate roles: as the platform through which the Application is distributed, and as the payment processor for Cochild Monthly subscriptions, under their own App Store and Google Play terms.

• Apple and Google: application distribution via the App Store and Google Play, and processing of Cochild Monthly subscription payments. Apple and Google handle your payment card details directly — Cochild never receives or stores them — and Cochild receives only your subscription status (for example, active, trialling, or cancelled) and the store's transaction identifier back from the store

The Government Technology Agency of Singapore (GovTech) is also not Cochild's processor acting on our instructions. When you choose to verify your identity through Singpass, GovTech is the source of the Myinfo data you consent to share with us on the Singpass consent screen. GovTech does not process data on our instructions, and your Singpass session itself is governed by GovTech's own terms, not this Policy.

• GovTech (Singpass and Myinfo): source of the Myinfo data described in Section 1, shared with us only with your consent, on the Singpass consent screen

We do not share your personal data with any other third party without your explicit consent, except where required by law.

Anthropic: What We Send, and Why

This section describes, in plain technical terms, what actually happens when a feature sends your content to Anthropic. It is additional to, and does not replace, what the Application tells you in-app the first time you use each of these features. For Kin, Kin's calendar access, court order parsing, and receipt reading, the Application asks for your agreement first, and if you decline, your content for that feature is not sent to Anthropic, regardless of what this Policy describes. Message moderation, calendar note checks, and payment request text checks run whenever you use those parts of the Application: the Application explains this the first time, but they cannot be switched off.

• Message moderation: before a message is sent to your co-parent, its text — together with a number of recent messages from that conversation, included as context for tone and meaning — is sent to a Claude model, which reviews the new message for hostile or harmful language and may suggest a rewrite. Only the new message is itself moderated, rewritten, or blocked. This is so your children are not exposed to parental conflict communicated through the platform, and so communication stays constructive. See the Cochild EULA for how the moderation outcome is handled.
• Kin, the AI assistant: every message you send Kin is sent to a Claude model together with a pseudonymised summary of your situation — your access schedule, your compliance and maintenance payment status, and your current harmony score — each child identified only by a placeholder such as "child_1" with an age, never a full name. This is so Kin can hold a supportive, contextually relevant conversation. Kin never receives the content of your conversation with your co-parent. See Section 4 and Section 8.
• Court order parsing: when you upload a court order PDF, its text is read on your device, NRIC/FIN numbers, email addresses, and Singapore phone numbers written with the +65 country code, are removed from it there, and only the resulting text — still including the names of parties and children, the access schedule, and maintenance terms, which the parsing needs — is sent to a Claude model so these details can be extracted and presented to you for review before they are used. This is so you do not have to enter a lengthy legal document by hand. The PDF file itself never leaves your device and is not retained after parsing; see Section 7.
• Receipt, quote, and proof-of-payment reading: if you allow it when asked, a receipt, quote, or proof of payment you attach (an image or, for payment requests, a PDF) is sent to Claude Haiku, which reads it to extract details such as the amount, date, currency, and vendor or payee. This is so a payment can be logged, or a payment request filled in, without you re-typing it.
• Calendar notes: when a parent adds a note to a calendar item that their co-parent or children can see, the note text is sent to a Claude model — shown in the app as "Cochild AI" — to check that it reads calmly. Only the note text is sent. Notes that only their author can see, and notes written by a child, are not checked. If the check cannot run, the note is not saved.
• Kin and your calendar: if you allow it when asked, the titles, categories, dates, times, and places of calendar items you can see, who each is for, your children's first names, the age a child turns on a birthday, and what you ask Kin are sent to a Claude model so that Kin can answer questions about your calendar and prepare drafts. Notes are never sent. See Section 4.
• Payment requests: when you send or reply to a payment request or cost proposal, the title and any note you write (including notes with a decline, a suggested split, or a "not received" reply) are sent to a Claude model — shown in the app as "Cochild AI" — to check that they read calmly. Only that text is sent. If the check cannot run, nothing is saved.

Overseas Transfers

Anthropic and Twilio SendGrid are processors based in the United States, so personal data sent to them leaves Singapore. In line with section 26 of the PDPA and the Transfer Limitation Obligation, we require a standard of protection comparable to that under the PDPA from both. For Anthropic specifically, this is secured through Anthropic's Data Processing Addendum, which forms part of our commercial agreement with them. It commits Anthropic to: process our data only on our instructions, and never sell it or combine it with data from other sources; encrypt data to a minimum of AES-256 at rest and TLS 1.2+ in transit; bind its staff to confidentiality; give us notice before engaging a new subprocessor; return or delete our data within 30 days of our agreement ending; and submit to an independent audit of its compliance. It also incorporates the EU Standard Contractual Clauses (Module Two) governing the transfer itself. Google Firebase services may also process data in more than one country.

Model Training

Under our commercial agreement with Anthropic, none of the content we send to Anthropic — message text, calendar notes, payment request text, court order text, receipts, quotes and proof-of-payment files, calendar details shared with Kin, or your Kin conversations — is used to train Anthropic's models. Anthropic uses commercial customer content for model training only where a customer has separately opted in to a programme for that purpose, and Cochild has not done so.

---

7. Data Retention and Deletion

We retain your personal data for as long as your Account is active. The following describes precisely what happens to data when an Account is deleted, reflecting the shared nature of co-parenting records.

When One Parent Deletes Their Account

Your personal authentication record and profile are removed from the platform. Shared records — including access event logs, conversations, access schedules, and compliance records — remain intact for the benefit of the other parent, who retains a legitimate interest in those records. Children's data follows the shared record and is not deleted while either parent's Account remains active. Payment requests, with their event trails and attached files, and calendar items shared with the other parent are also part of the shared record and remain for the other parent. Calendar items that only you could see, your private payment requests switch and its change log, and your calendar reminders are removed with your Account. The deleting parent's own 30-day grace period applies first, as described below.

When Both Parents Delete Their Accounts

All shared data — including all shared records, payment requests (with their event trails and attached files), calendar items, children's data, documents, and communications — is permanently and irreversibly deleted from our systems within 30 days of the second Account deletion. This is the second parent's own grace period, so deletion completes when that period ends. Apart from the crisis-detection logs described in the retention schedule below, no residual personal data is retained. If we ever create aggregated, de-identified statistics that cannot be linked back to any individual, they may be retained for research and public interest purposes.

How to Delete Your Account

Account deletion is initiated from the Settings screen within the Application. You will be asked to confirm with Face ID or your device passcode. A 30-day grace period follows, during which your Account is suspended but not yet permanently deleted. This allows you to reverse the decision if it was made in error. After 30 days, deletion is permanent and cannot be undone. We recommend exporting your data before initiating deletion.

Data Export

In accordance with your right to data portability, you may request a copy of your personal data at any time by contacting privacy@cochild.com. We are working on an in-app self-service export (conversation history and access event log, in PDF or CSV format); until it ships, we will provide your data manually within 30 days of your request. This right exists independently of Account deletion and may be exercised at any time.

Retention Schedule

• Account, profile, and sign-in details: kept while your Account is active. After you request deletion they are suspended for 30 days and then permanently deleted
• Shared records (conversations, access schedules, access event logs including parent GPS and IP records, compliance records, Hopes & Goals, Conflict Resolution content, visit journals, album photos, Email Hub content): kept while either parent's Account is active, then permanently deleted within 30 days of the second parent's deletion request
• Payment requests and cost proposals (including their event trails, and attached receipts, quotes, and proof of payment): kept for as long as the shared record exists, then permanently deleted within 30 days of the second parent's deletion request. There is no separate fixed period
• Calendar items: items shared with another person are kept for as long as the shared record exists, then permanently deleted within 30 days of the second parent's deletion request; items that only their author could see are deleted with that author's Account. Calendar reminder records are deleted with the Account of the person they remind
• Your payment requests switch and its change log: kept while your Account is active and deleted with it
• Copies in your phone's calendar: held on your phone and in any calendar account it syncs to, not by Cochild. You can remove everything Cochild added from the calendar settings in the Application
• Children's data: follows the shared record, as above, except where a shorter period is stated below
• Child location trail: 7 days, then automatically and permanently deleted. The single most recent shared location is kept only while sharing stays enabled
• Singpass and Myinfo details (including the NRIC hash): kept with your Account and deleted with it
• Myinfo children's records not selected for your shared record: discarded at the end of your Singpass verification session; never stored
• Court order PDFs: not retained after parsing. The details you confirm are kept with the shared record
• Receipts, quotes, and proof of payment attached to a payment (images and PDFs): kept with the shared record while it remains active. Files attached to payment requests are covered above
• Subscription status, the store's transaction identifier, and your billing token: kept while your Account is active
• Push notification tokens: kept while your Account is active and deleted with it
• Crisis-detection logs: a hashed, non-reversible account reference and a timestamp, with no message content. These are kept after your Account is deleted, because the hash cannot be linked back to you and the log is used only to improve this safety feature
• Records we must keep by law: kept for as long as the law requires

---

8. Security

We use industry-standard security measures including:

• Encryption in transit and encryption at rest
• Pseudonymisation of data before AI processing for the Kin assistant (except where you allow Kin to read your calendar, which shares your children's first names). Message moderation, calendar note checks, and payment request text checks send the real text to Anthropic, and court order parsing sends names, schedules, and maintenance terms, because they cannot work without them. Before court order text is sent, NRIC/FIN numbers, email addresses, and Singapore phone numbers written with the +65 country code, are removed on your device
• Access controls limiting who within Cochild can access personal data
• For location sharing, approximation is calculated before your child's location is ever stored, not afterwards — so a precise position is never retained outside an active access period

We will notify you and the relevant data protection authority of any data breach in accordance with applicable law. The Singapore process is set out in Appendix A1.

---

9. Your Data Rights

You have the following rights in relation to your personal data. To exercise any of these rights, contact us at privacy@cochild.com. We will respond within 30 days.

• Right of access: you may request a copy of the personal data we hold about you
• Right to correction: you may request that we correct inaccurate or incomplete data
• Right to deletion: you may request that we delete your personal data. We will do so within 30 days subject to any legal obligations to retain records
• Right to data portability: you may request your data in a structured, machine-readable format
• Right to restrict processing: you may ask us to restrict how we use your data in certain circumstances
• Right to object: you may object to processing based on legitimate interest
• Right to withdraw consent: where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing

If you are located in the European Union or United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

Singapore residents may address complaints to the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

---

10. Proactive Support (Welfare Signal)

None of this exists yet. No Welfare Signal is generated in the current version of the Application and no data is shared with any agency. This section describes how the feature would work if it were introduced.

Cochild may in future offer a Welfare Signal feature, developed in partnership with authorised social service providers including the Family Justice Courts and the Ministry of Social and Family Development. The purpose of this feature would be to identify parents and children who may benefit from early intervention support, before situations escalate to crisis. Because it would relate to identifiable individuals, it would run only with your opt-in consent, and it is separate from any aggregated statistics described in Section 3.

The Welfare Signal is built exclusively on behavioural metadata — for example: repeated access schedule breaches, high frequency of blocked messages, or sustained changes in communication patterns. It does not involve reading, analysing, or sharing the content of any message, document, or communication.

The distinction is fundamental: the Welfare Signal observes what happens, never what is said.

When this feature is introduced:

• You will be clearly informed and given the opportunity to opt in or opt out before the feature is activated on your account
• Any outreach from social services will be offered as support, not enforcement
• Authorised support teams will know only that a shared record has been flagged for potential support. They will not have access to any message content, court documents, or personal communications
• The feature will operate under a formal data sharing agreement between Cochild and the relevant government agency, subject to Singapore's data protection framework and applicable law

We will update this Policy before this feature becomes active, and you will have the opportunity to review the updated terms.

---

11. Updates to This Policy

We may update this Policy from time to time. When we make material changes, we will notify you through the Application and by email at least 14 days before the changes take effect.

Where a change materially alters the purposes for which we collect, use, or disclose your personal data, continued use alone will not be treated as your consent. We will ask you to review and agree to the change through an in-app consent prompt before it applies to you. For other changes, your continued use of the Application after the effective date means you accept the updated Policy.

Version History

• 1.9 (25 October 2026) — Brought the Policy into line with the Application. Subscriptions: Section 1 now states that a subscription is required, that access is locked but data is kept when it lapses, that the store's transaction identifier and a random billing token (containing no personal data) are kept, and that a child's messaging in Kids Mode depends on a parent's subscription. Court orders: Sections 1, 6, and 8 now state that the text is read on your device, that NRIC/FIN numbers, email addresses, and +65 phone numbers are removed there, and that the PDF never leaves your device. Calendar: added a Calendar disclosure to Section 1, including the optional one-way copy into your phone's calendar and that it can reach iCloud on iPhones that use it; extended Section 5 for children; added calendar note checks and Kin's optional calendar access to Sections 4 and 6; corrected Sections 5 and 8, which said a child's name was shared with Anthropic only for court order parsing and that only Kin used pseudonymisation. Payment requests: added a Payment Requests disclosure to Section 1 (PayNow number, content, files, event trail, on/off switch and its log), a statement that Cochild is not a payment service, AI checks of payment request text and reading of receipts and quotes (Section 6), and retention entries for payment requests and calendar items (Section 7, including that they are removed within 30 days of the second parent's deletion). Corrected Section 6, which implied every AI feature asks for agreement first, and the Biometric Authentication statement, which referred to confirming a payment.
• 1.8 (24 October 2026) — Wording changes only; no change to what data is collected, how it is used, or who it is shared with. Replaced "family record" with "shared record", defined in Section 1 as the single record that links both parents and their children in the Application, and used the same term in Sections 1, 5 and 7. Reworded the Singpass statement in Section 1 to say that verification is optional and encouraged, and can be used instead of email verification when linking your Account to your co-parent's shared record. Renamed Section 10 "Proactive Support (Welfare Signal)" and the feature "Welfare Signal" (previously "Family Welfare Signal"), matching the EULA. Stated in Section 5 that a child's data is retained while either parent's Account remains active, matching Section 7. Replaced "your family's situation" with "your situation" in the description of what Kin receives.
• 1.7 (4 October 2026) — Corrected the Account Information section, which implied Singpass could be used to sign in or register; Singpass is verification only, and you always sign in with your own email and password. Expanded "Singpass and Myinfo" to state what each retrieved field is used for, why the NRIC number is needed, that marital status is not requested, that Cochild never receives your Singpass password or credentials, and that verification is optional except when linking your Account to your co-parent's family record. Added that Myinfo returns all of a parent's registered children, that only the children selected are added to the family record, and that unselected records are discarded at the end of the Singpass session and never stored — reflected in Section 5 and the retention schedule. Added GovTech (Singpass and Myinfo) to Section 6 as a separate, consent-based data source, distinct from Cochild's processors.
• 1.6 (4 October 2026) — Renamed the subscription from Cochild Premium to Cochild Monthly throughout, including the v1.5 history entry. Reworded the Section 6 introduction so that "data processors acting on our instructions only" applies to Firebase, Anthropic, and Twilio SendGrid, and described Apple and Google separately as acting independently in their own roles for app distribution and subscription payment processing. Added a Subscription Status entry to Section 1 (what Cochild receives from the store, and that card details are never received) and to the Retention Schedule in Section 7.
• 1.5 (4 October 2026) — Rewrote the second sentence of Section 5's opening paragraph, which had become hard to parse, as a single clear sentence about what is never done with a child's data. Added a short disclosure to Section 6 that Apple and Google process Cochild Monthly subscription payments directly, that Cochild never receives payment card details, and that Cochild receives only subscription status back from the store.
• 1.4 (4 October 2026) — Expanded the Anthropic disclosure in Section 6 into a feature-by-feature breakdown (message moderation, Kin, court order parsing, and payment receipt reading) stating the purpose of each transfer; added detail on Anthropic's contractual data protection and security commitments (its Data Processing Addendum, encryption standards, subprocessor notice, deletion on termination, and audit rights) and a Model Training statement; corrected the payment receipt model from "Claude Vision" to the Claude Haiku model actually used; corrected the Kin disclosure (Sections 4 and 6) to state precisely what is sent with every message — access schedule, compliance and maintenance payment status, and harmony score, not a generic "summary" — after confirming the actual payload; corrected the message moderation disclosure to note that recent conversation messages are sent as context alongside the new message; and clarified that this Policy's description of Anthropic processing is additional to, and does not replace, the in-app consent you are separately asked to give before each feature processes your content.
• 1.3 (2 October 2026) — Aligned the Policy with how the Application works today. Added disclosures for Singpass and Myinfo, payment receipt reading, parent GPS and IP capture, other data collected, overseas transfers, co-parent details entered before they join, and a retention schedule. Corrected statements on message access, pseudonymisation (Kin only), account deletion confirmation (Face ID or device passcode), third-party sharing of children's data, crash reports, Firebase locations, and court order storage. Reworded the Welfare Signal and aggregated insights descriptions to state that neither exists yet. Replaced the breach notification wording with the statutory process, and added in-app re-consent for material changes. Renamed the AI assistant from AiKin to Kin.
• 1.2 (16 September 2026) — Added a dedicated breakdown of what Kid Mode collects, who can see it, our legal basis for processing a child's data (including the age-tiered consent model for location sharing), and how to request deletion or access on a child's behalf; added a plain-language summary for children; corrected the approximate location radius from ~500 metres to ~3 kilometres and clarified that a child's current location is kept only while sharing stays enabled, not deleted on a fixed schedule.
• 1.1 (4 September 2026) — Added disclosures for Kids Mode Accounts, Child Location, the Kin AI assistant, and Email Hub; corrected two claims that had become inaccurate as these features shipped.
• 1.0 (2 May 2026) — Initial publication.

---

APPENDIX A: Regional Supplements

The following supplements apply in addition to the main Policy where you are located in the relevant jurisdiction. In the event of any conflict between a regional supplement and the main Policy, the regional supplement shall prevail for users in that jurisdiction.

---

A1. Singapore (PDPA)

This supplement applies to users located in Singapore and governs our compliance with the Personal Data Protection Act 2012 (PDPA) and its associated regulations.

• Our Data Protection Officer (DPO) can be contacted at dpo@cochild.com
• If we have reason to believe a data breach affecting your personal data has occurred, we will assess it within 30 days. Where we decide the breach is notifiable, meaning it is likely to cause significant harm or is of significant scale, we will notify the Personal Data Protection Commission (PDPC) within 3 calendar days of that decision. We will also notify affected individuals where significant harm is likely, as required by the PDPA and the Personal Data Protection (Notification of Data Breaches) Regulations 2021
• You may withdraw your consent to the collection, use, or disclosure of your personal data at any time by contacting privacy@cochild.com, subject to legal or contractual restrictions
• We will respond to data access and correction requests within 30 days

---

A2. European Union (GDPR)

This supplement applies to users located in the European Economic Area. The processing of your personal data is governed by the General Data Protection Regulation (EU) 2016/679.

Lawful basis for processing:

• Account operation and service delivery: contractual necessity (Article 6(1)(b))
• AI message moderation: legitimate interest in protecting children and supporting constructive co-parenting (Article 6(1)(f)), with appropriate safeguards
• Court order parsing: contractual necessity (Article 6(1)(b))
• Aggregated analytics for government partners (not currently produced): legitimate interest, where data is fully anonymised and falls outside the scope of the GDPR
• Communications and notifications: legitimate interest (Article 6(1)(f))

You have the right to lodge a complaint with the data protection authority in your EU member state. A list of authorities is available at edpb.europa.eu.

If you are located outside Singapore, Cochild transfers your data to Singapore under appropriate safeguards including standard contractual clauses where required.

---

A3. United Kingdom (UK GDPR)

This supplement applies to users located in the United Kingdom. The processing of your personal data is governed by the UK GDPR and the Data Protection Act 2018.

The lawful bases for processing are as described in Supplement A2 above, applied under UK law. You may lodge a complaint with the Information Commissioner's Office at ico.org.uk.

---

A4. Australia (Privacy Act 1988)

This supplement applies to users located in Australia. The processing of your personal data is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

• We will not use or disclose your personal data for a purpose other than the primary purpose for which it was collected, except as permitted by the APPs
• You may request access to or correction of your personal data by contacting privacy@cochild.com
• You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have interfered with your privacy

---

Contact Us

---

Cochild Pte. Ltd.
A Social Enterprise committed to building technology that serves families, not advertisers.
cochild.com