Loading...
CoOwlPrivacy Policy
Your privacy is important to us. Learn how we protect your family’s information and maintain the highest standards of data security.
Last updated: 4 May 2026
1. Introduction2. What Information We Collect3. How We Use Your Information4. Lawful Basis for Processing5. Who Has Access to Your Data6. International Data Transfers7. Data Retention8. How We Protect Your Data9. Children’s Privacy10. Your Rights Under UK GDPR11. Cookies and Tracking12. Changes to This Policy13. Complaints14. California Privacy Rights (CCPA/CPRA)
1. Introduction
CoOwl (“we”, “us”, or “our”) is committed to protecting your privacy and the privacy of your family. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our co-parenting platform, available as a mobile app and web application.
CoOwl Ltd is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office (ICO) under registration number⚠️ ICO registration pending — will register before public launch.
This policy applies to all users of CoOwl, including parents, guardians, extended family members, and any individual whose data is processed through our platform. Please read this policy carefully. If you do not agree with our practices, please do not use the service.
2. What Information We Collect
We collect only the information necessary to provide our co-parenting services. The types of data we collect depend on how you use the platform.
2.1 Information You Provide Directly
| Category | Examples | Why We Collect It |
|---|---|---|
| Account Information | Name, email address, phone number, password | To create and secure your account |
| Profile Information | Avatar photo, co-parent role, contact preferences | To personalise your experience |
| Children’s Information | First name, date of birth, school year, interests | To enable custody scheduling and age-appropriate features |
| Messages | Text communications between co-parents | To facilitate co-parenting communication |
| Expenses | Shared expense entries, receipts, payment records | To enable expense splitting and financial transparency |
| Custody Schedule | Calendar entries, custody exchange times, recurring events | To provide the core scheduling functionality |
| Health & Mood Data | Child mood tracking entries, wellbeing notes (optional) | To support child wellbeing monitoring (with your consent) |
2.2 Information Collected Automatically
| Category | Examples | Why We Collect It |
|---|---|---|
| Photos (Picture Wall) | Shared images of children and family moments | To create a shared family photo timeline (with your explicit consent) |
| GPS Location | Latitude/longitude during check-in events only | To verify custody exchange handovers (with your explicit consent) |
| Usage Data | Feature interactions, session duration, device type | To improve our platform and user experience |
| Device Information | Operating system, browser type, device model | To optimise performance and diagnose issues |
2.3 Information from Third Parties
We may receive information from third-party services you choose to connect, such as calendar integrations. We only access the minimum data needed for the integration to function.
3. How We Use Your Information
We use your information only for the purposes described in this policy. We do not sell your personal information to third parties. Here is how we use each category of data:
To Provide Our Service
Account management, custody scheduling, messaging, expense tracking, picture sharing, check-in verification, and all core app features. This processing is necessary for the performance of our contract with you.
To Improve Our Platform
We analyse anonymised usage patterns to understand how our app is used, identify bugs, and develop new features. This processing is based on our legitimate interest in improving our service.
To Communicate With You
We send service-related communications (e.g., payment receipts, security alerts, feature updates). Marketing communications require your separate consent and can be opted out at any time.
To Comply With Legal Obligations
We retain certain data (such as messages and expense records) to comply with legal obligations, including potential disclosure requirements in family court proceedings.
4. Lawful Basis for Processing
Under the UK GDPR, we are required to have a lawful basis for each type of data processing. Here is a summary:
| Lawful Basis | What It Covers | Your Rights |
|---|---|---|
| Contract (Art. 6(1)(b)) | Account creation, messaging, expenses, scheduling, payment processing | Data necessary for the service cannot be objected to while using the service |
| Legitimate Interest (Art. 6(1)(f)) | Children’s names/ages for scheduling, service improvement, security | You can object to this processing |
| Explicit Consent (Art. 9(2)(a)) | Photo uploads, GPS location tracking, health/mood data | You can withdraw consent at any time |
| Legal Obligation (Art. 6(1)(c)) | Message retention for court disclosure, ICO compliance | Retention is mandatory by law |
5. Who Has Access to Your Data
We limit access to your personal data to only those who need it for legitimate purposes.
5.1 Within Your Family Unit
Data you enter on CoOwl is shared with other members of your family unit according to their role:
- Co-Parents have full access to all shared family data (messages, schedule, expenses, picture wall, children’s information)
- Extended Family have limited access as configured by the primary parents
- Teen View allows age-appropriate access for children with restricted visibility
5.2 Service Providers
We engage trusted third parties who process data on our behalf under strict Data Processing Agreements (DPAs):
- Google Cloud Platform (Firebase) — Cloud hosting, database, storage, and authentication. Data centres in the European Economic Area.
- Stripe — Payment processing. CoOwl does not store your card details.
- Vercel — Web application hosting.
- BigDataCloud — Reverse geocoding for check-in location verification (no location data stored by them).
5.3 Legal Disclosure
We may disclose your information if required to do so by law, court order, or other legal process. This includes disclosure of messages, schedules, and expense records in the context of family court proceedings.
5.4 We Do Not Sell Your Data
We Do Not Sell Your Data
CoOwl does not sell personal information to third parties. We do not use your data for behavioural advertising, profiling, or any commercial purpose beyond providing our co-parenting service.
6. International Data Transfers
Your personal data is primarily processed on servers located within the European Economic Area (EEA). Specifically, our data is hosted in:
- Belgium (europe-west1) — Primary database and storage
- London, UK (europe-west2) — Backup and disaster recovery
Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including:
- UK Adequacy Regulations for transfers to the EEA
- Standard Contractual Clauses (SCCs) with non-EEA sub-processors
- Data Processing Agreements that meet UK GDPR requirements
7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our retention periods are:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account information | Until account deletion + 30 days | Contract termination |
| Messages | 7 years | Court evidence / legal obligation |
| Photos | Until you delete them | Your control |
| GPS location | 90 days | Check-in verification |
| Expenses | 7 years | Tax / court disclosure |
| Health/Mood data | 2 years after last entry | Limited utility period |
| Analytics | 26 months | Industry standard |
When you delete your account, we will delete or anonymise your personal information within 30 days, except where we are required by law to retain certain data (see Section 10 — Your Rights).
8. How We Protect Your Data
We implement comprehensive technical and organisational measures to protect your personal data:
Encryption
- Data encrypted at rest (AES-256)
- Data encrypted in transit (TLS 1.3)
- End-to-end encryption for messages
Access Controls
- Firestore Security Rules (document-level)
- Firebase Authentication with 2FA option
- Role-based family permissions
Pseudonymisation
- UUIDs instead of emails/names as identifiers
- Pseudonymised analytics processing
- Separate data stores
Organisational
- Annual staff GDPR training
- Data Protection Officer appointed
- Regular security audits
9. Children’s Privacy
Our Commitment to Children’s Privacy
CoOwl complies fully with the UK ICO Age-Appropriate Design Code (the “Children’s Code”). We have designed our platform with the best interests of children as a primary consideration.
9.1 Children Do Not Have Accounts
Children do not create accounts on CoOwl. All children’s data is entered, managed, and controlled by parent or guardian accounts. The “Teen View” feature provides limited, age-appropriate access under full parental supervision.
9.2 Data Minimisation
We collect only the minimum information about children necessary for the co-parenting function: first name and date of birth (for scheduling). Optional data such as photos, health/mood entries, and school information require explicit parental consent.
9.3 Parental Controls
Parents have full control over their children’s data:
- Review all children’s data at any time through family settings
- Modify or correct children’s information
- Delete children’s data (except where retention is legally required)
- Control which family members can see children’s information
- Enable or disable optional features (photo sharing, location check-ins, mood tracking)
9.4 No Behavioural Targeting
We do not engage in behavioural advertising, profiling, or any form of automated decision-making involving children’s data. Children’s data is never sold or shared with third parties for marketing purposes.
10. Your Rights Under UK GDPR
Under the UK GDPR and Data Protection Act 2018, you have the following rights regarding your personal data:
Right of Access (Art. 15)
You can request a copy of the personal data we hold about you. We will respond within 30 calendar days. You can also use our in-app Data Export feature for instant access to your data.
Right to Rectification (Art. 16)
You can update or correct inaccurate personal data at any time through your account settings. For corrections involving other family members, contact us and we will facilitate the update.
Right to Erasure (“Right to be Forgotten”) (Art. 17)
You can request deletion of your personal data. We will comply within 30 calendar days.Please note: Messages and expense records may be retained for up to 7 years where they are required for legal compliance (court evidence, tax obligations). You can submit a deletion request through our Data Deletion page.
Right to Restrict Processing (Art. 18)
You can request that we restrict processing of your data in certain circumstances (e.g., while a rectification request is being considered).
Right to Data Portability (Art. 20)
You can request a machine-readable export of your data (JSON format) that you can transfer to another service. Use our in-app Data Export feature or email us.
Right to Object (Art. 21)
You can object to processing based on legitimate interest, including service improvement analytics. Note that objecting to core processing (account management, scheduling) may affect our ability to provide the service.
How to Exercise Your Rights
To exercise any of these rights, please:
- Email us at privacy@coowl.app
- Use our in-app Data Export feature (for access/portability)
- Visit our Data Deletion page at /legal/data-deletion
- Write to us at Registered address pending — will update before launch
We will respond to all requests within 30 calendar days. We may need to verify your identity before processing your request. There is no charge for exercising your rights unless the request is manifestly unfounded or excessive.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make significant changes:
- We will post the updated policy on this page with a new “Last Updated” date
- We will notify users via email for material changes
- We may request renewed consent where required by law
We encourage you to review this policy periodically. Your continued use of CoOwl after changes take effect constitutes acceptance of the updated policy.
13. Complaints
If you have concerns about how we handle your personal data, please contact us first. We will do our best to resolve your issue.
Contact Our Data Protection Officer:
Email: privacy@coowl.app
Post: Data Protection Officer, CoOwl Ltd, Registered address pending — will update before launch
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113
Website: ico.org.uk
14. California Privacy Rights (CCPA/CPRA)
Your California Privacy Rights
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information.
14.1 Right to Opt Out of Sale or Sharing
CoOwl does not sell personal information to third parties in exchange for monetary consideration. However, the CCPA defines “sale” and “sharing” broadly to include certain data sharing practices that may be considered a “sale” under California law.
You have the right to opt out of any future sale or sharing of your personal information. To exercise this right, you can:
- Toggle “Do Not Sell or Share My Personal Information” in your account Settings → Privacy tab, or
- Email us at privacy@coowl.app with the subject “CCPA Opt-Out”
We will honor your opt-out request within 15 business days as required by law. You do not need to create an account to exercise this right — you may submit your request by email.
14.2 Right to Know
You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business purpose for collecting it, and the categories of third parties with whom we share it. Please see Section 2 of this policy for a detailed description of the information we collect.
14.3 Right to Delete
You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (such as completing transactions, detecting security incidents, or complying with legal obligations).
14.4 Right to Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights. This means we will not deny services, charge different prices, or provide a different quality of service based on your privacy choices.
14.5 Sensitive Personal Information
Under CPRA, health data, precise geolocation, and children’s data are classified as sensitive personal information. We only use sensitive personal information for the purposes necessary to provide our service (co-parenting coordination, custody scheduling, and health passport features). We do not use sensitive personal information for any secondary purpose, including profiling or behavioral advertising.
14.6 How to Exercise Your Rights
To exercise your CCPA rights, contact us at:
Email: privacy@coowl.app
Response Time: We will acknowledge receipt within 10 business days and respond substantively within 45 calendar days.
Verification: We may need to verify your identity before processing your request. We will only use the information you provide for verification purposes.
Last updated: 4 May 2026
© 2026 CoOwl Ltd. All rights reserved.