Legal

Privacy Policy

How we handle your information — and why we handle so little of it

Cody Labs LLC  ·  Effective Date: July 17, 2026

This Privacy Policy explains how Cody Labs LLC ("we," "us," or "our") collects, uses, stores, and protects information when you use CODY, our mobile reflection application (the "App"). We built CODY with a foundational principle: your data belongs to you. We collect the minimum necessary to run the app, we keep it on your device, and we never sell it.

1. Who This Policy Applies To

CODY is built for teens and young adults — we design the experience around ages 13 to 21. Anyone aged 13 or older may create an account; there is no upper age limit. We do not knowingly allow children under 13 to create accounts or use the App. If we discover that a user is under 13, we will delete their account and any associated data promptly.

If you are between 13 and 17, a parent or legal guardian may need to consent to your use of the App depending on applicable laws in your jurisdiction. We encourage parents to review this policy with their teens.

2. Information We Collect

2.1 Information You Provide Directly

During onboarding and use, you provide:

2.2 Information Generated Automatically

As you use CODY, the App generates:

A copy of the session metadata above (sentiment, emotional arc, session length, and topics) is also stored on our secure server, linked to your account so that only you can access it, and permanently deleted when you delete your account. The crisis flag is not part of this server copy. It never includes the words you typed.

2.3 Analytics Data We Collect

We collect de-identified, aggregate analytics to improve the App. This event data:

Crisis detection is handled separately and is described in Section 6.2. The crisis-path event we record carries no user ID and is not part of the hashed-ID analytics described here.

Separately, the per-session record described in Section 2.2 (sentiment, emotional arc, session length, and topics) is stored linked to your account rather than to a hashed ID — so that you can access it and we can fully delete it when you delete your account.

We use Google Firebase / Firestore for this storage. See Section 5 for third-party details.

2.4 Information We Do NOT Collect

2.5 Message Feedback You Choose to Send

If you flag a specific CODY response — for example, marking it unhelpful or wrong — that message and the few messages immediately before it are sent to our team so we can review and improve CODY's responses. This happens only when you choose to flag a message; we do not send any other conversation content.

3. How We Use Your Information

3.1 To Run the App

3.2 To Improve CODY

3.3 What We Never Do With Your Information

4. Where Your Data Lives

Almost all of your personal data is stored locally on your device. This includes your profile, conversation summaries, insights, recaps, and name preferences.

You may back up your CODY data to your personal iCloud account. This backup is stored in your iCloud — we have no access to it. Cody Labs never receives or holds your backup file.

The data that leaves your device is:

5. Third-Party Services

CODY uses a limited set of third-party services to operate. We do not use advertising networks, data brokers, analytics platforms that build user profiles, or any third-party services beyond those necessary to run the App.

6. Crisis Detection

CODY includes a safety feature designed to surface support resources when serious concerns arise. The teen is always in control.

6.1 How Crisis Detection Works

CODY's AI monitors conversations for signals across seven defined categories of concern (including self-harm, suicidal ideation, and unsafe home environments). When a signal is detected, the App surfaces crisis resources and hotlines on-screen so you can reach real-world help. CODY does not contact anyone on your behalf and does not send any message to your Trusted Adult or any other person.

6.2 Crisis Event Logging

CODY does not keep a per-user crisis log. When crisis detection occurs during a chat session, no crisis record is sent to our servers — the category of concern is stored only on your own device, as part of your conversation record, and never transmitted to us.

Separately, when a crisis signal fires on the mood-logging path, we record a single de-identified event for safety accountability. This event contains only a timestamp, a flag that a crisis path fired, and which path it came from. It is deliberately kept stricter than ordinary analytics: it carries no user ID, no email, no crisis category, and no link to any account or session. It cannot be traced back to you.

7. Data Retention and Deletion

7.1 Deleting Your Data or Account

You may delete all your local data or your full account at any time from the Profile screen — no need to contact us. Account deletion permanently removes your Firebase account, your server-side profile and session data stored in Firestore, and all data stored locally on your device. It does not automatically delete your iCloud backup — you must delete that separately from your iCloud settings.

To request deletion of de-identified analytics data, contact us at privacy@codylabs.co. As described in Section 6.2, the crisis-path event contains no personal identifiers and cannot be individually deleted.

8. Children's Privacy

CODY is designed for teens ages 13 and older. We do not knowingly collect personal information from children under 13. Users are required to enter their date of birth during onboarding, and we reject accounts where the date of birth indicates the user is under 13.

If we discover a user is under 13, we will immediately suspend their account and delete all associated personal information.

8.1 Parental Rights for Teen Users (Ages 13–17)

If your child is between 13 and 17 and uses CODY, you have the right to request access to, correction of, or deletion of their personal information. Contact us at privacy@codylabs.co. We will respond within 30 days.

9. California SB 243 Compliance

California SB 243 establishes requirements for companion chatbot operators with respect to minors. CODY operates transparently under this framework:

10. Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your data, and to object to certain processing. California residents have additional rights under CCPA/CPRA.

To exercise any of these rights, contact us at privacy@codylabs.co. We will respond within 30 days. Note that self-serve deletion is available directly in the app.

11. Security

12. Changes to This Policy

When we update this policy, we will update the Effective Date and notify you in-app. For material changes, we will ask for your acknowledgment before they take effect.

13. Contact Us

Cody Labs LLC
Privacy inquiries: privacy@codylabs.co