Privacy Policy

01 Data We Collect

COSI collects several types of data to personalize your ambient comfort environment. We only collect what is necessary to deliver the service.

02 Why We Collect It

Every piece of data we collect serves a specific purpose directly tied to improving your comfort experience.

• Personalize your environment in real time based on your physiological state
• Build and refine your personal comfort baseline over time
• Generate sleep quality insights and environment recommendations
• Enable the COSI AI to give context-aware, personalized responses
• Trigger smart automations based on your location and schedule
• Process payments securely and manage your subscription
• Improve the COSI platform using anonymized, aggregated data only
• Send you product updates and important account notices (with consent)

03 Camera & Ambient Light Detection

COSI optionally uses your device's camera to detect ambient light levels in your environment. This helps us calibrate your comfort score more accurately by understanding the lighting conditions around you — not just what a sensor reports.

• The camera is used to measure brightness levels only — no facial recognition, no image analysis
• No photos or video are ever captured, stored, or transmitted
• All camera processing happens locally on your device using a single-pixel brightness average
• Camera access is entirely optional — you can disable it at any time in Settings
• If denied, COSI falls back to the Hub sensor for light data

You will be asked for camera permission explicitly during onboarding. You can revoke this permission at any time through your device settings without affecting other COSI features.

04 Location Data

COSI optionally uses your device's location to enable smart automations — for example, starting your arrival routine when you get home, or switching to away mode when you leave.

• Location data is processed on-device and used only to trigger automations you have configured
• We do not store your GPS coordinates on our servers
• We do not track your location continuously or build a location history
• Location is only checked at zone entry/exit events — not in the background otherwise
• Location access is entirely optional — all COSI features work without it

You will be asked for location permission explicitly during onboarding. You can revoke this permission at any time without losing access to manual COSI features.

05 Audio & Sound Monitoring

COSI monitors ambient sound levels to understand your acoustic environment as part of your comfort score. Loud environments are associated with reduced comfort and sleep quality.

• We measure decibel (dB) levels only — we do not record, store, or transmit audio
• No voice data, conversations, or identifiable sounds are ever captured
• Sound level processing happens entirely on your device
• The Hub sensor handles sound monitoring — the microphone is not used by the app itself
• Audio monitoring can be disabled in Settings → Environmental Tracking

06 Who We Share Your Data With

We work with a small number of trusted service providers to operate COSI. We share only what is necessary for each service to function.

• Google Firebase — Backend infrastructure, database, authentication, and cloud functions. Your data is stored on Google Cloud servers in the United States.
• Anthropic — Powers the COSI AI chatbot. Messages you send are processed by Anthropic's API to generate responses. Anthropic does not retain your messages for model training without explicit consent.
• Stripe — Handles all payment processing. We share your email and subscription status only. No health or comfort data is ever shared with Stripe.
• Govee / Google Nest — When you connect smart home devices, COSI sends commands to their APIs on your behalf. Only device control commands are sent — no health or personal data.

07 Data Storage & Security

• All data is stored on Google Cloud infrastructure (Firebase) with encryption at rest and in transit using TLS 1.3
• Access to your data is controlled by Firebase Security Rules — only you can access your own data
• API keys and secrets are stored using Google Secret Manager — never hardcoded
• Your password is never stored — Firebase Auth uses secure, salted hashing
• Camera and audio data never leave your device
• Location data is not stored on our servers

08 Your Rights

You have full control over your data. The following rights apply to all COSI users regardless of location.

To exercise any of these rights, go to Profile → Account Settings or email us at hello@somacomfort.com.

09 Data Retention

• Your data is kept for as long as your account is active
• If you delete your account, all personal data is permanently deleted within 30 days
• Chat history older than 90 days is automatically purged (Free plan: 7 days)
• Anonymized, aggregated comfort data may be retained indefinitely for platform improvement
• Payment records are retained for 7 years as required by law

10 Children's Privacy

COSI is not designed for or directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created a COSI account, please contact us at hello@somacomfort.com and we will delete the account promptly.

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email and through a notice in the COSI app at least 14 days before the changes take effect. Continued use of COSI after the effective date constitutes acceptance of the updated policy.

You can always find the current version of this policy at somacomfort.com/privacy.

12 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, we're here to help.