Privacy Policy

CoAdvocate Privacy Policy

Effective Date: 11/04/2026 Last Updated: 11/04/2026

This Privacy Policy explains how Coadvocate.ai LLC, d/b/a CoAdvocate ("CoAdvocate," "we," "us," or "our"), collects, uses, shares, and protects information when you use the CoAdvocate website, applications, and services (the "Service"). By using the Service, you agree to this Policy. If you do not agree, do not use the Service.

CoAdvocate is an AI-assisted co-parenting communication tool intended for adults. It is not a law firm and does not provide legal advice; see our Terms of Service.

1. Who We Are

The entity responsible for your information ("data controller") is Coadvocate.ai LLC, located at 1093 Larson Rd, Moscow ID 83843. You can reach us at [privacy@coadvocate.ai].

2. Information We Collect

Information you provide:

  • Account information — such as your name, email address, password, and any profile details you choose to add.
  • Communications and content — the messages you draft, send, or log; documents you upload (such as a parenting plan); and any other text or files you submit to the Service ("User Content"). This content may reference other people, including your co-parent and your children.
  • Support and correspondence — information you provide when you contact us.
  • Mobile number — if you add one, we store it to send you one-time security codes by text message (see Section 6).
  • Partner referral — if you arrive through a professional partner's link or code (for example coadvocate.ai/p/<code>), we record which partner referred you and keep that record with your account (see Section 6A).
  • Partner applications — if you are a professional who applies to join our partner program, or joins it, we collect your application (your name, organization, email address, profession, the state you practice in, website and message; our bot-check provider, Cloudflare Turnstile, also sees your IP address when you submit it) and the partner page content and logo you provide. The partner page you provide (name, organization, note and logo) is shown publicly at its link and on the printable handout. If you invite colleagues to your partner team, we keep their email addresses and their acceptance of the partner terms.
  • Payment information — if you purchase a paid plan, payment is handled by our third-party payment processor; we do not store full card numbers. We may receive limited billing details (such as the last four digits, billing zip, and transaction status).

Information we collect automatically:

  • Usage data — features used, actions taken, timestamps, and similar activity.
  • Device and technical data — IP address, browser or device type, operating system, app version, and diagnostic or crash data.
  • Cookies and similar technologies — used to keep you signed in, remember preferences, and, where analytics is on for you, measure how the Service is used. See Section 9.
  • Analytics and attribution data — where analytics is on for you (Section 9 explains when), we use Google Analytics on our website and web app and Firebase Analytics in our mobile app to collect: the pages and app screens you view, your visits and the time you spend engaged; the sign-up and subscription steps you complete (for a new subscription, its amount, tax, currency and plan, with a random reference we generate rather than any payment-processor identifier); that you reached a first-use milestone (not which feature you used, and with its time rounded to the hour); approximate location (such as country and region); device, operating system and browser type; a randomly generated analytics identifier; and the campaign that brought you to us (such as the campaign tags or advertising click identifier in the link you followed). Google receives your IP address when your browser or device connects to it. If analytics is on for you when you sign up on our website or web app, we also store your analytics identifier and the campaign that first brought you to us with your account, and send the sign-up, first-use milestone and subscription events to Google from our servers using that identifier, together with the analytics session in which you signed up or subscribed. When you create an account in our mobile app, we ask for your choice before the account is set up; if you allow analytics then, we store the app's random analytics identifier with your new account, and the sign-up event may be sent, and later the first-use milestone and subscription events are sent, to Google from our servers using that identifier. If you allow analytics in the app later, we store the app's current identifier with your account from then on (unless we already hold a website identifier for you) and send only events that happen after you allowed; we never send a sign-up event, or any other earlier event, for that account. We do not send to Google the content of your messages, plans or imported records, your children's names, your name, email address or phone number, your CoAdvocate address or account identifiers, or the names of the people you communicate with. Page addresses are generalized before they are sent (for example, every conversation in your inbox is reported as the same "/inbox/threads/:threadId"), page titles are replaced with fixed page names, and the address of the site that referred you is reduced to its domain (or left out). This applies to everything sent from your browser, including as you move between pages of the web app.
  • Advertising measurement data — in the places and for the visitors described in Section 9, we measure whether our own ads on Reddit and Meta (Facebook and Instagram) lead to sign-ups and paid subscriptions. (Google's measurement is described above and in Section 6.) This works in two ways. First, the ad network's script in your browser reports the sign-up and first paid subscription to that network, using the same random event reference our server uses. Because the script runs in your browser, the network also receives your IP address, browser details and the address of the page you are on, as any website you load does. That page address is the full address, including any query string such as campaign tags or a partner code in the link you followed, and Reddit's script also receives the page title. Meta's script does not load on partner pages (/p/...) or when the address holds a partner code, but Reddit's script does run on our public website, including partner pages, so Reddit can see which partner page you visited. Second, our servers report the same two events to Reddit and Meta (the Reddit and Meta server reports are sent only when the link you followed carried that network's click identifier). These server reports carry: the event and when it happened; the network's click and browser identifiers; the random event reference; for a subscription, its price before tax and currency; the page address without any query string; and SHA-256 hashes (one-way scrambles) of your email address and your CoAdvocate account number. Reports to Meta also include your IP address and browser user-agent string from the sign-up and checkout requests. We do not send these networks your name, phone number, CoAdvocate address, messages, plans, records or anything about your children. We do not build audiences or retargeting from this data, and we use it only to measure our own ads; the networks' own use of it is described in their policies.
  • Internal first-use record — we keep our own record of the first time you use a key feature (such as sending a message to your co-parent, receiving a reply from the AI companion, or getting an answer about your parenting plan), whether or not analytics is on for you, to understand whether the Service is working for new users. This record stays with us and is not sent to Google.

Information from third parties:

  • We may receive limited information from service providers such as our payment processor, entitlement/subscription manager, and authentication providers. Our analytics providers (Section 6) receive the data described above and provide us with reports about how the Service is used.

3. How We Use Information

We use information to:

  • Provide, operate, maintain, and secure the Service;
  • Generate AI-assisted drafts, analyses, summaries, and other outputs you request;
  • Process transactions and manage subscriptions and entitlements;
  • Communicate with you, including sending transactional and service emails (see Section 5);
  • Respond to support requests;
  • Monitor, debug, and improve the Service and develop new features;
  • Where analytics is on for you, measure how people find, sign up for, and use the Service, and how well our own marketing works (see Sections 2 and 9);
  • Apply a partner's client discount, and include you in a partner's aggregate statistics (Section 6A);
  • Run our partner program and contact the professionals who apply to it or join it;
  • Send one-time security codes by text message to a mobile number you add;
  • Detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms; and
  • Comply with legal obligations and enforce our agreements.

4. AI Processing of Your Content

To provide AI features, your User Content (such as the text and documents you submit) is transmitted to and processed by third-party AI model providers acting as our service providers ("subprocessors"). This processing is necessary to generate the outputs you request. These currently include Anthropic (model inference), OpenAI (model inference for classifying incoming messages and for choosing which excerpts of your uploaded parenting plan or court orders to cite alongside them), Voyage AI (text embeddings), and Amazon Web Services Textract (document OCR).

  • We share with these providers only what is needed to generate your output.
  • We aim to work with providers that do not use your content to train their general-purpose models, but you should review the current list of subprocessors requestable at info@coadvocate.ai for details.
  • Do not submit information you are not comfortable having processed by an AI system. Although the Service helps you handle sensitive co-parenting communications, you control what you enter, and you should avoid submitting information you do not wish to share.

5. Email Communications and Your Choices

  • Transactional and service emails — such as account verification, security alerts, password resets, receipts, and important Service notices. These are necessary to operate your account, and you cannot opt out of them while you have an active account.
  • Marketing or product-update emails — if we send these, we will do so only where permitted, and every such email will include an unsubscribe link. You may opt out at any time, either through that link or by emailing privacy@coadvocate.ai. Opting out of marketing email does not affect transactional email.
  • We honor unsubscribe requests promptly and process email bounces and complaints to maintain list quality. We do not sell your email address or send unsolicited bulk email.

6. How We Share Information

We do not sell your personal information. We share information only as follows:

  • Service providers / subprocessors — companies that perform services on our behalf, such as cloud hosting and email delivery (e.g., Amazon Web Services), payment processing (e.g., Stripe), AI model providers (e.g., Anthropic, OpenAI, Voyage AI, AWS Textract), text messaging (Amazon Web Services), bot checks on our public forms (Cloudflare Turnstile), and analytics (Google LLC, through Google Analytics and Firebase Analytics, and, on our public website, Plausible). They are permitted to use information only to provide services to us.
  • Advertising networks (Reddit and Meta) — where advertising measurement is on (Section 9), their scripts in your browser and our server reports send them the data described in Section 2. These networks are not our service providers for this purpose: they receive the data to measure and optimize advertising and may use it under their own terms and privacy policies, including to tailor ads you see on their services. Under some laws, including California's, this can count as "sharing" personal information for cross-context behavioral advertising. We do not send them your messages or other content, we do not sell your information for money, and you can stop the sharing as described in Section 8.
  • At your direction — for example, if you authorize a third party (such as an attorney) to access certain content, or when you send a communication to an intended recipient.
  • Legal and safety — when we believe disclosure is required by law, subpoena, or court order, or is reasonably necessary to protect the rights, property, or safety of any person, prevent fraud or abuse, or enforce our Terms.
  • Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
  • With your consent — for any other purpose we disclose to you.

Analytics. Google processes analytics data on our behalf as our service provider, only where analytics is on for you. We have set up Google Analytics so that advertising features, Google signals and ad personalization are turned off, and we do not use an advertising identifier in our mobile app. We do not use analytics data to show you advertisements, and we do not build remarketing audiences from it. We may use Google Analytics reports, including sign-ups and subscriptions attributed to the campaign that led to them, to measure our own advertising campaigns, including in Google Ads.

6A. Professional partner program. Some professionals (for example attorneys, mediators and counselors) share CoAdvocate with their clients through a link or code. If you arrive through one, we record which partner referred you and keep that record with your account, to apply the client discount and to include you in the partner's aggregate statistics. If, when you sign up, you choose "Let [partner name] know I joined," we share your name, sign-in email address and the month you joined with that partner, and nothing else. You can withdraw that choice at any time in Settings → Privacy & Data, and the partner then stops seeing this information. The partner's statistics are monthly totals across all of its clients: how many signed up, how many started a paid subscription, how many were refunded and how many are currently subscribed. Small numbers are hidden or grouped so no one client can be picked out. Partners never see your messages, records or any other data in your account. We do not sell this data.

6B. Text messages and your mobile number. We use your mobile number only to send one-time security codes by text message, when you ask for one: to verify the number, to confirm an attorney invitation, or to confirm a change to your phone settings. We do not send marketing texts. We do not sell or share your mobile number, or your consent to receive texts, with third parties for their marketing purposes. Message frequency varies with your use. Message and data rates may apply. Reply HELP for help or STOP to stop receiving texts, or remove your number at any time in Settings → Security. Questions: support@coadvocate.ai.

7. Data Retention

We retain different categories of information for different periods:

  • Companion conversations are automatically deleted after a window you choose (48 hours to 7 days, with a 48-hour default) and are rendered irrecoverable; you can also delete them sooner.
  • Your on-the-record message archive (communications tied to a tagged co-parent or party) is retained as a legal record for as long as it may be needed, including after you close your account, to preserve its chain of custody.
  • Records of your legal-agreement acceptances are retained for legal-defense purposes as permitted by law (including GDPR Article 17(3)(e) and equivalent exceptions).
  • Analytics data — Google Analytics is set to keep event-level data for 2 months, the shortest period it offers; Google then deletes it on its own schedule, and aggregated reports may be kept longer. This is separate from how long analytics cookies stay on your device (Section 9). When you close your account, we delete the analytics identifiers, campaign information and any unsent analytics events we stored with it, and our internal first-use record is no longer linked to you.
  • Partner referral record — kept with your account while it is open. When you close your account we keep a de-identified record (the partner and the dates only, with nothing that names you) so the partner's totals stay correct. Partner terms acceptances by partner team members are kept as a record of what was agreed.
  • Partner applications and partner pages — kept while the professional is a partner, and for a reasonable period afterward (or, for an application that is not approved, a reasonable period after we decide) so that we can answer questions and keep our program records.
  • Advertising measurement data — the identifiers and hashes used to report your sign-up and first subscription are kept with your account and deleted when you close it or withdraw ad measurement. Reports waiting to be sent are dropped after 7 days, and for Meta, the IP address and user agent in our records are deleted within 7 days.
  • Other personal account data is retained while your account is active and is deleted or anonymized when you delete your account, subject to limited backup and legal-hold windows.

8. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email privacy@coadvocate.ai. We will respond as required by applicable law and may need to verify your identity.

When you delete your account, we anonymize or delete your personal account data; however, your on-the-record evidence record and your legal-agreement acceptances are retained as described in Section 7 (Data Retention), so the right to deletion is scoped accordingly.

  • California residents may have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. We do not sell personal information for money. Where Reddit and Meta advertising measurement is on (Section 9), their scripts and our server reports send them data for advertising, which can count as "sharing" for cross-context behavioral advertising under California law (Section 6). You can opt out of that, and of analytics, at any time by declining in Analytics preferences (Section 8). In the United States our website and web app also treat a Global Privacy Control signal as a request to decline both analytics and this advertising measurement. We will not discriminate against you for exercising these rights.
  • EEA/UK residents may have rights under the GDPR/UK GDPR, including the right to lodge a complaint with a supervisory authority. Our legal bases for processing include performing our contract with you, your consent, our legitimate interests, and compliance with legal obligations.
  • Your analytics choice — you can allow or decline analytics at any time: "Analytics preferences" in the footer of coadvocate.ai; Settings → Privacy & Data → Analytics preferences in the web app; or Settings → Privacy & Data → Usage analytics in the mobile app. These controls appear only while analytics is in use. Declining stops further collection on that browser or device and deletes the analytics cookies (on the web) or resets the app's analytics data (in the app). Once our server receives your decision, we delete any analytics events for your account that have not yet been sent to Google and send no further ones. A choice made while you are signed in is sent to our server right away; a choice made in the app while you are creating your account is sent when the account is created; a choice made while signed out, or one that could not reach us, is sent the next time you open the web app while signed in or sign in to the mobile app, and until then events from our servers for your account may still be sent. You can also block analytics with your browser's privacy settings, with Global Privacy Control, or with Google's opt-out browser add-on. Declining analytics does not affect your use of the Service.
  • Partner sharing — you can withdraw "Let [partner name] know I joined" at any time in Settings → Privacy & Data.
  • Advertising measurement — declining analytics in the places described in Section 9 (in "Analytics preferences", described above) also declines Reddit and Meta advertising measurement, and so does a Global Privacy Control signal from your browser, which keeps it off even if you previously allowed analytics: the ad networks' scripts stop and their cookies are deleted, and once our server receives your decision we delete the ad-measurement information stored with your account and send nothing further. Allowing analytics in a region where we ask first covers analytics only; it does not turn on advertising measurement.
  • Withdrawing consent — where we asked for your consent to analytics, you may withdraw it at any time as described above. Withdrawal does not affect processing that took place before it.

9. Cookies and Tracking

We use cookies and similar technologies to operate the Service, keep you signed in, and remember preferences. We also use Google Analytics (on our website and web app) and Firebase Analytics (in our mobile app) to analyze usage, as follows:

  • United States, website and web app — if our content delivery network places your connection in the United States, analytics runs unless you decline it or your browser sends a Global Privacy Control signal. If your browser is set to a European time zone, we ask first instead.
  • Everywhere else, or if we cannot tell where you are — we ask first, and nothing is loaded (no Google script, and no Google Analytics or campaign cookies) until you choose "Allow analytics".
  • Mobile app — we always ask first, and nothing is collected until you allow it. If you create your account in the app, we ask after you accept our Terms of Service and this Privacy Policy and before your account is set up; otherwise we ask after you sign in. Allowing applies only to the account you are signed in with: if someone else signs in to the app on the same device, they are asked for their own choice and nothing is collected until they make it. Declining applies to every account on that device.

Reddit and Meta advertising measurement runs only in the United States for website and web app visitors, only when you have not declined, your browser is not sending a Global Privacy Control signal, and your browser is not set to a European time zone. It is never on in the mobile app or where we ask first. Where it is off, no ad network script loads and no advertising cookie is set, and our servers send nothing about you to those networks.

We never use your browser's language or time zone to turn analytics on. A choice you have made always takes priority: in the United States, a Global Privacy Control signal keeps analytics off unless you choose "Allow" in Analytics preferences. Our public website also uses Plausible, which does not use cookies and reports aggregate page statistics.

The cookies and device storage used for analytics are first-party (shared between coadvocate.ai and app.coadvocate.ai), and each has one purpose:

Name Purpose How long it stays on your device
ca_consent Remembers your analytics choice. 365 days
ca_attr Remembers the campaign that first brought you to us (campaign tags, advertising click identifier, and the generalized page you landed on). Set only once analytics is on for you. 90 days
ca_region Holds your connection's country as a two-letter code, set by our content delivery network, and is used only to decide whether analytics may start or we ask first. It is set for every visitor whose country our network can tell, whether or not analytics is on, because it is needed to offer the right choice; it is written when it is missing or your country has changed. 24 hours
_ga, _ga_<id> Google Analytics visitor and session identifiers. Set by Google's tag only once analytics is on for you; deleted when you decline. About 2 years (Google's default)
ca_attr (additions) When ad measurement is on, the advertising click identifiers in the link you followed (Reddit's rdt_cid, Meta's fbclid) are remembered in ca_attr. 90 days
_rdt_uuid, _rdt_cid Reddit's visitor identifier and the Reddit click identifier. Set by Reddit's script only while ad measurement is on; deleted when you decline. 90 days
_fbp, _fbc Meta's browser identifier and the Meta click identifier. Set by Meta's script only while ad measurement is on; deleted when you decline. Meta's script may also set cookies of its own on facebook.com, which we cannot delete. 90 days
analytics_consent (mobile app storage) Remembers your analytics choice in the app and which account made it. 365 days
ca_consent_pending_deny (website storage), analytics_consent_sync_pending (mobile app storage) Remembers a choice our server has not yet received, so that it can be sent again. Until our server receives it

Partner codes in your browser. If you arrive through a partner's link or code, we store the partner code (with the date) in your browser's local storage on app.coadvocate.ai, under coadvocate.touches, so the discount and the partner credit survive until you sign up. That list can also hold the marketing page you landed on, and, only while analytics is on for you, the campaign tags in your link. Nothing in it is older than 180 days, and a partner code counts toward credit for 90 days. If you tick "Let [partner name] know I joined," your choice is held in coadvocate.sharePartnerJoin until your account is created. The stored list itself is sent only to our own servers, not to an ad network or Google, and all of it is removed from your browser once you sign up. (The partner code can still appear in the address of a page you visit, and that address can reach Reddit's script, as described in Section 2.) On Android, the partner code can also arrive through the Google Play install referrer when you install the app from a partner's link; Google Play provides it to the app, which keeps it in the app's storage until you sign up and then removes it. This storage is needed for the discount and referral to work, so we do not ask for consent before using it; you can clear it at any time by clearing your site data.

Once you allow analytics in the app, Firebase Analytics keeps a random app-instance identifier on your device, and we store it with your account so that the events described in Section 2 can be sent from our servers; declining resets it on your device, and we then send no further events for your account. None of these identifiers contains your name. How long these items stay on your device is separate from how long Google keeps analytics data, which is described in Section 7.

You can change your choice at any time, as described in Section 8. We do not currently respond to the older "Do Not Track" signal, as no common standard exists. You can control cookies through your browser settings, though disabling the cookies the Service needs to keep you signed in may affect functionality.

10. Information About Children

The Service is intended only for adults (18+) and is not directed to children, and we do not knowingly collect personal information directly from children under 13 (or under the minimum age in your jurisdiction). We recognize that your co-parenting communications may reference your children; that information is provided by you as an adult user, is treated as your User Content, and is handled under this Policy. If you believe a child has provided us personal information directly, contact privacy@coadvocate.ai and we will take appropriate steps to delete it.

11. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

12. International Data Transfers

We are based in the United States, and your information may be processed and stored in the United States and other countries where we or our service providers operate. These countries may have data-protection laws that differ from those in your location. Where required, we use appropriate safeguards for such transfers.

13. Third-Party Links and Services

The Service may link to or rely on third-party websites and services that we do not control. This Policy does not apply to them, and we are not responsible for their privacy practices. Review their policies separately.

14. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will post the updated Policy with a new effective date and, where appropriate, notify you by email or within the Service. Your continued use after changes take effect constitutes acceptance.

15. Contact Us

If you have questions or requests regarding this Policy or your information, contact:

Coadvocate.ai LLC 1093 Larson Rd Moscow, ID 83843 Email: privacy@coadvocate.ai