Privacy Policy

Effective date: November 12, 2026

This policy explains what information CoParentNotes collects, how we use it, and the choices you have. We've tried to write it in plain English — if anything is unclear, contact us at the email address at the bottom of this page.

Information we collect

Account information

To create and access your account, we collect your sign-in identity — for example, the email address you use to sign in.

Billing information

If you buy a paid plan, we keep your subscription status and plan. Stripe keeps your payment details. We never see your card number. If you delete your account, we cancel your plan and delete your account, but we keep the Stripe customer id (an identifier Stripe assigned, not your name or email) for 7 years, with Stripe's own payment history, for payment and tax records.

Case content

When you use CoParentNotes to document a case, we store the information you enter:

• The date of each incident, and an optional time
• Your verbatim account of what happened, in your own words
• Who was involved
• A category you assign
• A location
• Photos, screenshots, and PDFs you attach to an entry
• Any addenda you add later — dated notes appended to an incident over time
• Drafts: text you start typing and any details you pick are saved to your account before you add the entry, so you can finish later

Other information we keep

• Your display name, auto-lock setting, and smart suggestions choice
• Names, nicknames, and relationships for the people you record
• File names, types, and sizes of your attachments
• A record of each PDF export: what you chose to include and the counts. We keep an encrypted copy of the PDF for about 7 days so you can download it, then delete it.

You can edit what you first wrote about an incident. The original is always kept and shown, and edits are marked with a date. The record shows what changed and every version of your account. Follow-ups can also be edited, with every earlier version kept and shown.

How we use your information

We use your information to provide the service: storing your case record, showing it back to you, and letting you add to it over time.

AI field suggestions

AI field suggestions ("smart suggestions") are off unless you turn them on in Settings, and you can turn them off at any time. Your choice is saved to your account, and our server checks it before every suggestion request, so turning it off on one device turns it off on all of them. When it's off, nothing is sent to Anthropic.

When it's on, the app sends to Anthropic only the incident entry you are currently capturing — the text for that one event, and nothing else you've written — plus your own previously saved people, children, and location names, used to help resolve who was involved and where it happened. Nothing else about your case is sent off our servers for AI processing, and your case history is never sent. Anthropic's AI only proposes values for fields; it never writes anything to your record. You review and confirm every field yourself, and nothing is saved that you did not see and confirm. The app works exactly the same way if the AI call never returns — you can always fill in every field on your own.

Where your data lives, and how it's protected

Case data is encrypted in transit and at rest, protected by account sign-in, and walled off from other accounts by row-level security. It is never sold. It is shared only with the service providers that run the app, listed under "Sharing" below, and when the law requires it.

Photos and other attachments are stored on our servers, encrypted in transit and at rest. Images are re-encoded before upload to remove embedded metadata, including location. Text or locations visible in the image remain visible.

When you export a PDF, the app stores an encrypted copy of it in a private folder so you can download it. We delete it about an hour after it turns 7 days old. If the emails are never sent, we delete it within about two hours. We email you two messages through our email provider, Resend: one with a download link and one with the password. The emails contain no case details. Our server handles the password while sending it, in the same way it can already read your case data. If the emails cannot be sent, the app can show you the password once on your screen instead, so you can still save the protected PDF on your device. We do not keep the password. Deleting your account removes your stored exports.

Your data is server-backed, stored in a Supabase-hosted Postgres database — it is not kept only in the app on your phone or computer. Your case tables are scoped to your account by row-level security, so other users cannot see your case data. There is no client-held encryption key, which means CoParentNotes (the operator) can access case content — for example, to operate the service, investigate abuse, or respond to a legal request as described below.

Sharing

We never sell your information, and we do not share it for anyone else's marketing. We share it only with the service providers (sub-processors) that run CoParentNotes, each receiving only what its job needs:

• Supabase — hosts our database and file storage and handles account sign-in. Your account and case data, including attachments, are stored there.
• Vercel — hosts this website and the web app. It handles your web requests (for example your IP address and browser type in standard logs); it does not store your case content.
• Resend — sends account emails, such as sign-up confirmation and password reset, and the two emails for a PDF export (a download link and a password), using your email address. Those emails contain no case details.
• Stripe — processes payments if you buy a paid plan. Stripe receives your account email address, an internal account id we assign (not your name), and the payment details you enter on Stripe's own page; we do not receive your card number.
• Forward Email — forwards messages you send to our support and privacy addresses to our team. It handles those messages and your email address.
• Anthropic — only if you turn on AI field suggestions: receives the entry text and saved names described above, for that one suggestion request.

We also disclose information when the law requires it, as described under "Legal requests" below.

Legal requests

Because your case data is server-backed, it can be compelled by a valid subpoena, warrant, or other legal process, the same as information held by any service provider. See our legal requests policy for how we handle these requests, including our notice practices.

On your device

• The web app keeps your sign-in and your preferences (such as theme) in your browser's storage. The iPhone app keeps your sign-in in the iPhone Keychain. This website keeps your theme choice in your browser.
• Dictation uses your browser's speech recognition. Your browser decides where the audio is processed. We do not receive the audio.
• After you export, you can save a copy of the PDF to your device (a download on the web, the share sheet on iPhone). It is the same password-protected file. We email the password to you separately. If the emails cannot be sent, the app shows the password once on your screen while you are on the Export screen. The app does not store it, but if you tap Copy, it goes to your device's clipboard. Anyone who has the file and the password can open it, so keep both somewhere safe.

Retention & deletion

See data practices for details on how long we keep your data and how to delete it. When a deletion finishes, we remove your data, including any stored PDF exports, from our active systems. Backups can lag behind for a period before they rotate out and the deleted data is gone from those too. Stripe and our other providers keep some records under their own rules.

Your choices

You can review your account information and delete your data as described above. You can also contact us with questions or requests about your information at any time.

Children

CoParentNotes is not directed to children, and we do not knowingly collect account information from children. Case content you enter may mention your own children — for example, as people involved in an incident. Those mentions are treated as ordinary case content, protected the same way as the rest of your record, as described above.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date at the top of this page.

Contact

Questions about this policy or your data? Email us at privacy@coparentnotes.com.