Privacy Policy

01 Data We Collect

COSI collects several types of data to personalize your ambient comfort environment. We only collect what is necessary to deliver the service.

02 Why We Collect It

Every piece of data we collect serves a specific purpose directly tied to improving your comfort experience.

• Personalize your environment in real time based on your physiological state
• Build and refine your personal comfort baseline over time
• Generate sleep quality insights and environment recommendations
• Enable the COSI AI to give context-aware, personalized responses
• Trigger smart automations based on your location and schedule
• Process payments securely and manage your subscription
• Improve the COSI platform using anonymized, aggregated data only
• Send you product updates and important account notices (with consent)

03 Camera & Ambient Light Detection

COSI optionally uses your device's camera to detect ambient light levels in your environment. This helps us calibrate your comfort score more accurately by understanding the lighting conditions around you — not just what a sensor reports.

• The camera is used to measure brightness levels only — no facial recognition, no image analysis
• No photos or video are ever captured, stored, or transmitted
• All camera processing happens locally on your device using a single-pixel brightness average
• Camera access is entirely optional — you can disable it at any time in Settings
• If denied, COSI falls back to the Hub sensor for light data

You will be asked for camera permission explicitly during onboarding. You can revoke this permission at any time through your device settings without affecting other COSI features.

04 Location Data

COSI optionally uses your device's location to enable smart automations — for example, starting your arrival routine when you get home, or switching to away mode when you leave.

• Location data is processed on-device and used only to trigger automations you have configured
• We do not store your GPS coordinates on our servers
• We do not track your location continuously or build a location history
• Location is only checked at zone entry/exit events — not in the background otherwise
• Location access is entirely optional — all COSI features work without it

You will be asked for location permission explicitly during onboarding. You can revoke this permission at any time without losing access to manual COSI features.

05 Audio & Sound Monitoring

COSI monitors ambient sound levels to understand your acoustic environment as part of your comfort score. Loud environments are associated with reduced comfort and sleep quality.

• We measure decibel (dB) levels only — we do not record, store, or transmit audio
• No voice data, conversations, or identifiable sounds are ever captured
• Sound level processing happens entirely on your device
• The Hub sensor handles sound monitoring — the microphone is not used by the app itself
• Audio monitoring can be disabled in Settings → Environmental Tracking

06 Who We Share Your Data With

We work with a small number of trusted service providers to operate COSI. We share only what is necessary for each service to function.

• Google Firebase — Backend infrastructure, database, authentication, and cloud functions. Your data is stored on Google Cloud servers in the United States.
• Anthropic — Powers the COSI AI chatbot. Messages you send are processed by Anthropic's API to generate responses. Anthropic does not retain your messages for model training without explicit consent.
• Stripe — Handles all payment processing. We share your email and subscription status only. No health or comfort data is ever shared with Stripe.
• Smart Home Integrations (Govee, Google Nest, Philips Hue, Sensibo, Tuya) — When you connect smart home devices, COSI sends control commands to their APIs on your behalf. Only device control commands are transmitted — no health or biometric data is shared with device providers. Each provider's own privacy policy governs their data handling.
• Sensibo — AC control API. Receives device control commands on your behalf.
• Philips Hue — Light control API. Receives brightness and color temperature commands.
• Fitbit — Syncs heart rate and activity data via OAuth. Health data shared only for comfort calculation.
• Apple Health / Google Fit — Reads health data. Data stays on-device unless you authorize sync.
• Health Platforms (Apple Health, Google Fit, Fitbit) — When you optionally link a health platform, COSI reads relevant data (activity, sleep stages, heart rate) from that platform to improve your comfort score. COSI does not write personal data back to these platforms. Your use of these platforms is governed by their respective privacy policies.

07 Data Storage & Security

• All data is stored on Google Cloud infrastructure (Firebase) with encryption at rest and in transit using TLS 1.3
• Access to your data is controlled by Firebase Security Rules — only you can access your own data
• API keys and secrets are stored using Google Secret Manager — never hardcoded
• Your password is never stored — Firebase Auth uses secure, salted hashing
• Camera and audio data never leave your device
• Location data is not stored on our servers

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users within 72 hours of becoming aware of the breach and will report to relevant supervisory authorities as required by applicable law (including GDPR Article 33).

08 Your Rights

You have full control over your data. The following rights apply to all COSI users regardless of location.

To exercise any of these rights, go to Profile → Account Settings or email us at hello@somacomfort.com.

09 Data Retention

• Your data is kept for as long as your account is active
• If you delete your account, all personal data is permanently deleted within 30 days
• Chat history older than 90 days is automatically purged (Free plan: 7 days)
• Anonymized, aggregated comfort data may be retained indefinitely for platform improvement
• Payment records are retained for 7 years as required by law

10 Children's Privacy

COSI is not designed for or directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. By using COSI, you confirm that you are at least 16 years old. If you believe someone under 16 has created a COSI account, please contact us at hello@somacomfort.com and we will delete the account promptly.

COSI is not directed at children under 16.

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email and through a notice in the COSI app at least 14 days before the changes take effect. Continued use of COSI after the effective date constitutes acceptance of the updated policy.

You can always find the current version of this policy at somacomfort.com/privacy.

12 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, we're here to help.

13 GDPR — Legal Bases for Processing

If you are located in the European Economic Area (EEA) or United Kingdom, COSI processes your personal data under the following legal bases as set out in GDPR Article 6:

• Contract performance (Art. 6(1)(b)) — Processing necessary to deliver the COSI service you subscribed to, including account management, comfort scoring, and device control.
• Legitimate interests (Art. 6(1)(f)) — Processing necessary for our legitimate interests in operating, improving, and securing the platform — where these interests are not overridden by your rights. This includes anonymized analytics and fraud prevention.
• Legal obligation (Art. 6(1)(c)) — Processing required to comply with applicable law, including financial record-keeping and responding to lawful requests.
• Consent (Art. 6(1)(a)) — For optional features such as camera access, location services, audio monitoring, health platform integrations, and marketing communications. You may withdraw consent at any time without affecting the legality of prior processing.

For processing of special category data (physiological/biometric data), we rely on your explicit consent under GDPR Article 9(2)(a). You may withdraw this consent at any time by deleting your account or disabling data collection in Settings.

You have the right to lodge a complaint with your local data protection authority. In the EU, find your authority at edpb.europa.eu.

14 CCPA — California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following additional rights:

• Right to Know — You may request disclosure of the categories and specific pieces of personal information we have collected about you, and the purposes for which it is used.
• Right to Delete — You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale — COSI does not sell your personal information. No opt-out action is required.
• Right to Non-Discrimination — We will not discriminate against you for exercising any CCPA rights.

To exercise your California rights, email us at hello@somacomfort.com with the subject line "CCPA Request." We will respond within 45 days.